#!/usr/bin/env bash
set +e
set +u
umask 077

STEP="STEP_050M07R10_RECONCILE_MODEL_METHODS_AND_BUILD_CODE_TEST"

TOKEN="e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4"
ROOT="/opt/router-ops"
STATE="$ROOT/state"
PUBROOT="$ROOT/public/r/$TOKEN"
PUBLIC_BASE="https://helena-background-beam-harry.trycloudflare.com/r/$TOKEN"

CANONICAL_STATE="$STATE/current-vm101-canonical.env"
WORKFLOW_STATE="$STATE/current-m07-workflow.env"

LOCAL_PLAN_SLUG="20260711-181158_local_architecture_plan_vm101_autonomous_hmn_recovery"
GLOBAL_PLAN_SLUG="20260711-123348_global_project_plan_wg_paid"
XS_MAP_SLUG="20260711-120734_xs_map_audit_repair_publish"

LOCAL_PLAN="$PUBLIC_BASE/$LOCAL_PLAN_SLUG/"
GLOBAL_PLAN="$PUBLIC_BASE/$GLOBAL_PLAN_SLUG/"
XS_MAP="$PUBLIC_BASE/$XS_MAP_SLUG/"

VM101_REFERENCE="$PUBLIC_BASE/vm101-reference/current/"
VM101_CANONICAL="$PUBLIC_BASE/vm101-canonical/current/"

EXPECTED_REFRESH_SHA="d4d7cbd8aad4cee0297b9f96dcd61ef244a63126e23f9aeb94b4f981d2943797"
EXPECTED_RUNTIME_SHA="1fd8d8b9258f7ca1d711323b7652f0b46991e1d17346b59e1d8ff5d71ba471d9"

EXPECTED_CODE_TEST_SOURCE_SHA="3515205270211206a9f3a34bc5c62d94a9f14a54ad712d6fa7e9c7d50db1370a"
EXPECTED_CODE_TEST_LINES=66
EXPECTED_CODE_TEST_REGION_SHA="637eeaee0dd437ccd2eeaaffd6a136d40b39c7381eab50bb82e944d8af922b6a"

TS="$(date -u +%Y%m%d-%H%M%S)"

REPORT_SLUG="${TS}_step050m07r10_reconcile_model_methods_and_build_code_test"
REPORT_DIR="$PUBROOT/$REPORT_SLUG"

STEP_REPORT="$PUBLIC_BASE/$REPORT_SLUG/"
REPORT_TXT="${STEP_REPORT}report.txt"
FACTS_JSON="${STEP_REPORT}facts.json"

MODEL_SLUG="${TS}_vm101_model_after_r09b"
MODEL_PRIVATE="$STATE/vm101-model/snapshots/$MODEL_SLUG"
MODEL_PUBLIC="$PUBROOT/$MODEL_SLUG"
VM101_MODEL="$PUBLIC_BASE/$MODEL_SLUG/"

METHODS_SLUG="${TS}_vm101_methods"
METHODS_PRIVATE="$STATE/vm101-methods/snapshots/$METHODS_SLUG"
METHODS_PUBLIC="$PUBROOT/$METHODS_SLUG"
VM101_METHODS="$PUBLIC_BASE/$METHODS_SLUG/"

CODE_WORKSPACE="$STATE/m07-single-target/code_test/${TS}_code_test_v1"
CODE_SOURCE_DIR="$CODE_WORKSPACE/source/root/hmn"
CODE_CANDIDATE_DIR="$CODE_WORKSPACE/candidate/root/hmn"
CODE_TEST_DIR="$CODE_WORKSPACE/tests"
CODE_DIFF_DIR="$CODE_WORKSPACE/diffs"

CODE_SOURCE="$CODE_SOURCE_DIR/hmn-code-test.sh"
CODE_CANDIDATE="$CODE_CANDIDATE_DIR/hmn-code-test.sh"
CODE_DIFF="$CODE_DIFF_DIR/hmn-code-test.private.diff"

PULL_DIR="$STATE/m07-live-sync/$TS"
PULLED_REFRESH="$PULL_DIR/root/hmn/hmn-refresh-pool-safe.sh"
PULLED_RUNTIME="$PULL_DIR/usr/local/lib/router-egress-vm101-runtime.sh"
REMOTE_AUDIT="$REPORT_DIR/vm101-live-audit.env"
SSH_STDERR="$REPORT_DIR/ssh.stderr"

CANONICAL_WORKSPACE="UNRESOLVED"
CANONICAL_CODE_SOURCE="UNRESOLVED"
CANONICAL_RUNTIME="UNRESOLVED"

PREVIOUS_MODEL="UNRESOLVED"
MODEL_TARGET_REL="UNRESOLVED"
MODEL_RUNTIME_REL="UNRESOLVED"
MODEL_TREE_PREFIX="UNRESOLVED"

LIVE_REFRESH_SHA="UNRESOLVED"
LIVE_RUNTIME_SHA="UNRESOLVED"
LIVE_CODE_TEST_SHA="UNRESOLVED"

CODE_SOURCE_SHA="UNRESOLVED"
CODE_REGION_SHA="UNRESOLVED"
CODE_CANDIDATE_SHA="UNRESOLVED"

REMOTE_HEALTHY_COUNT=0
REMOTE_ROUTE_COUNT=0

METHODS_PASS=false
LIVE_SYNC_PASS=false
MODEL_PASS=false
CODE_SYNTAX_PASS=false
CODE_STATIC_PASS=false
CODE_FIXTURE_PASS=false
CODE_DIFF_PASS=false
CODE_PRIVATE_SHA_PASS=false
WORKFLOW_UPDATED=false
ALL_OK=false

FAILURE_REASON="NONE"
OPERATION_RESULT="R10_NOT_COMPLETED"

mkdir -p \
  "$REPORT_DIR" \
  "$PULL_DIR/root/hmn" \
  "$PULL_DIR/usr/local/lib" \
  "$CODE_SOURCE_DIR" \
  "$CODE_CANDIDATE_DIR" \
  "$CODE_TEST_DIR" \
  "$CODE_DIFF_DIR" \
  "$STATE/vm101-model/snapshots" \
  "$STATE/vm101-methods/snapshots"

cp -a "$0" "$REPORT_DIR/step.sh"
chmod 600 "$REPORT_DIR/step.sh"

state_value() {
  local file="$1"
  local key="$2"

  sed -n "s/^${key}=//p" "$file" |
    tail -n1
}

file_sha() {
  sha256sum "$1" |
    awk '{print $1}'
}

clone_tree_incremental() {
  local source="$1"
  local destination="$2"
  local log="$3"

  rm -rf "$destination"
  mkdir -p "$destination"

  if cp -al "$source/." "$destination/" \
       >"$log" 2>&1
  then
    echo "clone_method=hardlink" >>"$log"
    return 0
  fi

  rm -rf "$destination"
  mkdir -p "$destination"

  if cp -a "$source/." "$destination/" \
       >>"$log" 2>&1
  then
    echo "clone_method=copy_fallback" >>"$log"
    return 0
  fi

  return 1
}

safe_update_symlink() {
  local target="$1"
  local link="$2"

  if [ -e "$link" ] && [ ! -L "$link" ]; then
    return 1
  fi

  ln -sfn "$target" "$link"
}

fail_step() {
  FAILURE_REASON="$1"
  return 1
}

create_methods_snapshot() {
  local previous_methods=""
  local model_reference="$VM101_REFERENCE"

  if [ -L "$STATE/vm101-methods/current" ]; then
    previous_methods="$(
      readlink -f "$STATE/vm101-methods/current"
    )"
  fi

  if [ -n "$previous_methods" ] &&
     [ -d "$previous_methods" ]
  then
    clone_tree_incremental \
      "$previous_methods" \
      "$METHODS_PRIVATE" \
      "$REPORT_DIR/methods-clone.log" ||
      return 1
  else
    rm -rf "$METHODS_PRIVATE"
    mkdir -p "$METHODS_PRIVATE"
    echo "clone_method=initial_snapshot" \
      > "$REPORT_DIR/methods-clone.log"
  fi

  for file in \
    README.md \
    access.md \
    environment.md \
    verified-tools.md \
    verified-commands.md \
    reporting-and-model-contract.md \
    methods-manifest.json \
    file-list.txt \
    index.html \
    SHA256SUMS
  do
    rm -f "$METHODS_PRIVATE/$file"
  done

  cat > "$METHODS_PRIVATE/README.md" <<EOF
# VM101 working methods

Snapshot: \`${METHODS_SLUG}\`

This directory records only verified methods for work with MGTS VM101.

Primary rule: commands supplied to the operator start from the existing
\`ops@router-ops\` shell. Do not prepend \`ssh router-ops\`.

Related model at snapshot creation:
${model_reference}
EOF

  cat > "$METHODS_PRIVATE/access.md" <<'EOF'
# Access route

Operator shell:

    ops@router-ops

Verified route from router-ops:

    router-ops -> pve-mgts -> VM101 10.71.100.2

Verified outer alias:

    ssh -T -o BatchMode=yes -o ConnectTimeout=10 pve-mgts

Verified inner access from pve-mgts:

    ssh -T \
      -o BatchMode=yes \
      -o ConnectTimeout=10 \
      -o StrictHostKeyChecking=yes \
      -i /root/.ssh/pve_to_openwrt_mgts_ed25519 \
      root@10.71.100.2

Do not run `ssh router-ops` when already logged in as `ops@router-ops`.
On router-ops that name may resolve to localhost and the local account
does not use the phone SSH private key.
EOF

  cat > "$METHODS_PRIVATE/environment.md" <<'EOF'
# VM101 environment

- OS: OpenWrt 24.10.2.
- Shell: BusyBox `ash`.
- Runtime WireGuard CLI: `/usr/bin/amneziawg`.
- `/usr/bin/wg` is not the authoritative runtime CLI for AmneziaWG.
- Authoritative egress route tables: 201, 202, 203, 204, 205.
- Table 200 is legacy/bootstrap information only and may be absent.
- Active production interfaces: vpn1, vpn2, vpn3, vpn4, vpn5.
- Large temporary files and archives should use `/tmp`.
- Root overlay has limited metadata and storage capacity.
- `df -i` is not supported by the installed BusyBox build.
- Filesystem metadata can be checked with `stat -f -c`.
- Health gates use up to three probe addresses per interface:
  1.1.1.1, 8.8.8.8, 9.9.9.9.
EOF

  cat > "$METHODS_PRIVATE/verified-tools.md" <<'EOF'
# Verified tools

## router-ops

- bash
- python3
- ssh
- sha256sum
- tar
- find
- diff
- awk
- sed
- grep

## VM101 OpenWrt

- /bin/sh / BusyBox ash
- /usr/bin/amneziawg
- ip
- ping
- sha256sum
- tar
- df -k
- stat -f
- find
- awk
- sed
- grep

## Known limitations

- Do not assume GNU options on VM101.
- Do not use `df -i`.
- Do not use a single ICMP probe as a mandatory installation gate.
- Do not infer the AmneziaWG runtime endpoint from UCI when
  `/usr/bin/amneziawg show IFACE dump` is available.
EOF

  cat > "$METHODS_PRIVATE/verified-commands.md" <<'EOF'
# Verified command patterns

## Runtime endpoint

    /usr/bin/amneziawg show vpn1 dump |
      awk 'NR == 2 {print $3; exit}'

## Authoritative route

    ip route show table 201

Tables 201 through 205 correspond to vpn1 through vpn5.

## Strict multi-probe health

    for probe in 1.1.1.1 8.8.8.8 9.9.9.9
    do
      ping -I vpn1 -c 1 -W 2 "$probe" && break
    done

## File hash

    sha256sum /root/hmn/hmn-refresh-pool-safe.sh |
      awk '{print $1}'

## Root capacity

    df -k /

## Filesystem metadata

    stat -f -c '%b %f %a %c %d' /

## Shell syntax

    sh -n /root/hmn/script.sh
EOF

  cat > "$METHODS_PRIVATE/reporting-and-model-contract.md" <<'EOF'
# Reporting and VM101 model contract

Every STEP must print separate links for:

1. Current STEP report.
2. Local M07 plan.
3. Global project plan.
4. XS Map.
5. Timestamped VM101 model.
6. Timestamped VM101 methods.

When a STEP successfully changes files on the real VM101:

1. Verify the final live file hashes.
2. Pull only the changed files from VM101.
3. Clone the previous local model incrementally.
4. Replace or add only those changed machine files.
5. Create a new timestamped model snapshot.
6. Validate the new model.
7. Preserve the previous snapshot.
8. Publish the immutable timestamped model URL.
9. Update the `current` pointer only after validation.
10. Do not declare the modifying STEP fully complete until model sync
    and mandatory links have been produced.
EOF

  python3 - \
    "$METHODS_PRIVATE/methods-manifest.json" \
    "$METHODS_SLUG" \
    "$TS" \
    "$LOCAL_PLAN" \
    "$GLOBAL_PLAN" \
    "$XS_MAP" \
    "$VM101_REFERENCE" \
    "$VM101_CANONICAL" <<'PY'
import json
import sys
from pathlib import Path

(
    output,
    methods_id,
    generated,
    local_plan,
    global_plan,
    xs_map,
    reference,
    canonical,
) = sys.argv[1:]

Path(output).write_text(
    json.dumps({
        "schema": "vm101-methods-snapshot-v1",
        "methods_id": methods_id,
        "generated_at_utc": generated,
        "scope": "verified VM101 working methods",
        "operator_origin": "ops@router-ops",
        "access_route": [
            "router-ops",
            "pve-mgts",
            "VM101 10.71.100.2",
        ],
        "links": {
            "local_plan": local_plan,
            "global_plan": global_plan,
            "xs_map": xs_map,
            "vm101_reference": reference,
            "vm101_canonical": canonical,
        },
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)
PY

  find "$METHODS_PRIVATE" \
    -type f \
    ! -name file-list.txt \
    ! -name SHA256SUMS \
    -printf '%P\n' |
  sort > "$METHODS_PRIVATE/file-list.txt"

  cat > "$METHODS_PRIVATE/index.html" <<EOF
<!doctype html>
<html lang="ru">
<head>
<meta charset="utf-8">
<title>VM101 methods ${METHODS_SLUG}</title>
</head>
<body style="font-family:system-ui;max-width:1000px;margin:40px auto">
<h1>VM101 methods</h1>
<p>Snapshot: <code>${METHODS_SLUG}</code></p>
<ul>
<li><a href="README.md">README</a></li>
<li><a href="access.md">Access route</a></li>
<li><a href="environment.md">Environment</a></li>
<li><a href="verified-tools.md">Verified tools</a></li>
<li><a href="verified-commands.md">Verified commands</a></li>
<li><a href="reporting-and-model-contract.md">Reporting and model contract</a></li>
<li><a href="methods-manifest.json">Manifest</a></li>
<li><a href="file-list.txt">File list</a></li>
<li><a href="SHA256SUMS">SHA256SUMS</a></li>
</ul>
</body>
</html>
EOF

  (
    cd "$METHODS_PRIVATE" || exit 1

    find . \
      -type f \
      ! -name SHA256SUMS \
      -print0 |
    sort -z |
    xargs -0 sha256sum \
      > SHA256SUMS

    sha256sum -c SHA256SUMS
  ) > "$REPORT_DIR/methods-sha256-check.txt" 2>&1 ||
    return 1

  rm -rf "$METHODS_PUBLIC"

  clone_tree_incremental \
    "$METHODS_PRIVATE" \
    "$METHODS_PUBLIC" \
    "$REPORT_DIR/methods-publish.log" ||
    return 1

  chmod -R a+rX "$METHODS_PUBLIC"

  mkdir -p \
    "$STATE/vm101-methods" \
    "$PUBROOT/vm101-methods"

  safe_update_symlink \
    "snapshots/$METHODS_SLUG" \
    "$STATE/vm101-methods/current" ||
    return 1

  safe_update_symlink \
    "../$METHODS_SLUG" \
    "$PUBROOT/vm101-methods/current" ||
    return 1

  cat > "$STATE/current-vm101-methods.env" <<EOF
VM101_METHODS_ID=${METHODS_SLUG}
VM101_METHODS_PRIVATE=${METHODS_PRIVATE}
VM101_METHODS_PUBLIC=${METHODS_PUBLIC}
VM101_METHODS_URL=${VM101_METHODS}
VM101_METHODS_GENERATED_AT_UTC=${TS}
EOF

  chmod 600 "$STATE/current-vm101-methods.env"

  METHODS_PASS=true
  return 0
}

pull_and_verify_live_files() {
  ssh -T \
    -o BatchMode=yes \
    -o ConnectTimeout=10 \
    pve-mgts \
    "ssh -T \
      -o BatchMode=yes \
      -o ConnectTimeout=10 \
      -o StrictHostKeyChecking=yes \
      -i /root/.ssh/pve_to_openwrt_mgts_ed25519 \
      root@10.71.100.2 \
      'cat /root/hmn/hmn-refresh-pool-safe.sh'" \
    > "$PULLED_REFRESH" \
    2> "$SSH_STDERR"

  [ "$?" -eq 0 ] ||
    return 1

  ssh -T \
    -o BatchMode=yes \
    -o ConnectTimeout=10 \
    pve-mgts \
    "ssh -T \
      -o BatchMode=yes \
      -o ConnectTimeout=10 \
      -o StrictHostKeyChecking=yes \
      -i /root/.ssh/pve_to_openwrt_mgts_ed25519 \
      root@10.71.100.2 \
      'cat /usr/local/lib/router-egress-vm101-runtime.sh'" \
    > "$PULLED_RUNTIME" \
    2>> "$SSH_STDERR"

  [ "$?" -eq 0 ] ||
    return 1

  ssh -T \
    -o BatchMode=yes \
    -o ConnectTimeout=10 \
    pve-mgts \
    "ssh -T \
      -o BatchMode=yes \
      -o ConnectTimeout=10 \
      -o StrictHostKeyChecking=yes \
      -i /root/.ssh/pve_to_openwrt_mgts_ed25519 \
      root@10.71.100.2 \
      'sh -s'" \
    > "$REMOTE_AUDIT" \
    2>> "$SSH_STDERR" <<'REMOTE'
set -u

hash_file() {
  sha256sum "$1" 2>/dev/null |
    awk '{print $1}'
}

echo "host=$(hostname)"
echo "refresh_sha256=$(
  hash_file /root/hmn/hmn-refresh-pool-safe.sh
)"
echo "runtime_sha256=$(
  hash_file /usr/local/lib/router-egress-vm101-runtime.sh
)"
echo "code_test_sha256=$(
  hash_file /root/hmn/hmn-code-test.sh
)"

healthy=0
routes=0
slot=1

while [ "$slot" -le 5 ]
do
  iface="vpn$slot"
  table="$((200 + slot))"

  if ip route show table "$table" 2>/dev/null |
     grep -E "^default .*dev ${iface}([[:space:]]|$)" \
     >/dev/null
  then
    routes="$((routes + 1))"
  fi

  probe_ok=false

  for probe in 1.1.1.1 8.8.8.8 9.9.9.9
  do
    if ping -I "$iface" -c 1 -W 2 "$probe" \
         >/dev/null 2>&1
    then
      probe_ok=true
      break
    fi
  done

  if [ "$probe_ok" = "true" ]; then
    healthy="$((healthy + 1))"
  fi

  slot="$((slot + 1))"
done

echo "route_count=$routes"
echo "healthy_count=$healthy"
echo "read_only=true"
echo "files_written=false"
REMOTE

  [ "$?" -eq 0 ] ||
    return 1

  LIVE_REFRESH_SHA="$(file_sha "$PULLED_REFRESH")"
  LIVE_RUNTIME_SHA="$(file_sha "$PULLED_RUNTIME")"

  AUDIT_REFRESH="$(
    state_value "$REMOTE_AUDIT" refresh_sha256
  )"

  AUDIT_RUNTIME="$(
    state_value "$REMOTE_AUDIT" runtime_sha256
  )"

  LIVE_CODE_TEST_SHA="$(
    state_value "$REMOTE_AUDIT" code_test_sha256
  )"

  REMOTE_ROUTE_COUNT="$(
    state_value "$REMOTE_AUDIT" route_count
  )"

  REMOTE_HEALTHY_COUNT="$(
    state_value "$REMOTE_AUDIT" healthy_count
  )"

  [ "$LIVE_REFRESH_SHA" = "$EXPECTED_REFRESH_SHA" ] ||
    return 1

  [ "$LIVE_RUNTIME_SHA" = "$EXPECTED_RUNTIME_SHA" ] ||
    return 1

  [ "$AUDIT_REFRESH" = "$EXPECTED_REFRESH_SHA" ] ||
    return 1

  [ "$AUDIT_RUNTIME" = "$EXPECTED_RUNTIME_SHA" ] ||
    return 1

  [ "$LIVE_CODE_TEST_SHA" = "$EXPECTED_CODE_TEST_SOURCE_SHA" ] ||
    return 1

  [ "$REMOTE_ROUTE_COUNT" = "5" ] ||
    return 1

  [ "$REMOTE_HEALTHY_COUNT" = "5" ] ||
    return 1

  sh -n "$PULLED_REFRESH" ||
    return 1

  sh -n "$PULLED_RUNTIME" ||
    return 1

  LIVE_SYNC_PASS=true
  return 0
}

create_model_snapshot() {
  PREVIOUS_MODEL="$(
    readlink -f "$PUBROOT/vm101-reference/current" 2>/dev/null
  )"

  [ -d "$PREVIOUS_MODEL" ] ||
    return 1

  clone_tree_incremental \
    "$PREVIOUS_MODEL" \
    "$MODEL_PRIVATE" \
    "$REPORT_DIR/model-clone.log" ||
    return 1

  mapfile -t target_matches < <(
    find "$MODEL_PRIVATE" \
      -type f \
      -path '*/root/hmn/hmn-refresh-pool-safe.sh' \
      -print
  )

  [ "${#target_matches[@]}" -eq 1 ] ||
    return 1

  model_target="${target_matches[0]}"
  MODEL_TARGET_REL="${model_target#"$MODEL_PRIVATE"/}"

  case "$MODEL_TARGET_REL" in
    root/hmn/hmn-refresh-pool-safe.sh)
      MODEL_TREE_PREFIX=""
      ;;
    */root/hmn/hmn-refresh-pool-safe.sh)
      MODEL_TREE_PREFIX="${
        MODEL_TARGET_REL%/root/hmn/hmn-refresh-pool-safe.sh
      }"
      ;;
    *)
      return 1
      ;;
  esac

  if [ -n "$MODEL_TREE_PREFIX" ]; then
    MODEL_RUNTIME_REL="$MODEL_TREE_PREFIX/usr/local/lib/router-egress-vm101-runtime.sh"
  else
    MODEL_RUNTIME_REL="usr/local/lib/router-egress-vm101-runtime.sh"
  fi

  model_runtime="$MODEL_PRIVATE/$MODEL_RUNTIME_REL"

  rm -f "$model_target"
  mkdir -p "$(dirname "$model_target")"

  cp -a "$PULLED_REFRESH" "$model_target" ||
    return 1

  chmod 700 "$model_target"

  rm -f "$model_runtime"
  mkdir -p "$(dirname "$model_runtime")"

  cp -a "$PULLED_RUNTIME" "$model_runtime" ||
    return 1

  chmod 644 "$model_runtime"

  for metadata in \
    model-manifest.json \
    machine-diff.json \
    changed-files.tsv \
    file-list.txt \
    index.html \
    SHA256SUMS
  do
    rm -f "$MODEL_PRIVATE/$metadata"
  done

  python3 - \
    "$PREVIOUS_MODEL" \
    "$MODEL_PRIVATE" \
    "$MODEL_TREE_PREFIX" \
    "$MODEL_TARGET_REL" \
    "$MODEL_RUNTIME_REL" \
    "$EXPECTED_REFRESH_SHA" \
    "$EXPECTED_RUNTIME_SHA" \
    "$REPORT_DIR/model-machine-diff.json" <<'PY'
import hashlib
import json
import sys
from pathlib import Path

(
    source_root,
    model_root,
    tree_prefix,
    target_rel,
    runtime_rel,
    target_sha,
    runtime_sha,
    output,
) = sys.argv[1:]

source_root = Path(source_root)
model_root = Path(model_root)

machine_top = {
    "bin",
    "etc",
    "lib",
    "opt",
    "root",
    "sbin",
    "usr",
    "var",
}


def sha(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def machine_map(base: Path) -> dict[str, str]:
    result = {}

    scan_root = (
        base / tree_prefix
        if tree_prefix
        else base
    )

    if not scan_root.is_dir():
        return result

    for path in scan_root.rglob("*"):
        if not path.is_file():
            continue

        rel_inside = path.relative_to(scan_root)

        if not rel_inside.parts:
            continue

        if rel_inside.parts[0] not in machine_top:
            continue

        rel = (
            Path(tree_prefix) / rel_inside
            if tree_prefix
            else rel_inside
        )

        result[rel.as_posix()] = sha(path)

    return result


before = machine_map(source_root)
after = machine_map(model_root)

all_paths = sorted(set(before) | set(after))

changes = []

for path in all_paths:
    old = before.get(path)
    new = after.get(path)

    if old != new:
        changes.append({
            "path": path,
            "before_sha256": old,
            "after_sha256": new,
            "change": (
                "added" if old is None
                else "removed" if new is None
                else "modified"
            ),
        })

allowed = {target_rel, runtime_rel}

unexpected = [
    item
    for item in changes
    if item["path"] not in allowed
]

checks = {
    "no_machine_files_removed":
        not any(
            item["change"] == "removed"
            for item in changes
        ),

    "only_expected_machine_paths_changed":
        not unexpected,

    "target_final_hash":
        after.get(target_rel) == target_sha,

    "runtime_final_hash":
        after.get(runtime_rel) == runtime_sha,

    "machine_file_count_not_reduced":
        len(after) >= len(before),
}

failures = [
    name
    for name, passed in checks.items()
    if not passed
]

data = {
    "schema": "vm101-model-machine-diff-v1",
    "passed": not failures,
    "tree_prefix": tree_prefix,
    "machine_file_count_before": len(before),
    "machine_file_count_after": len(after),
    "changed_machine_file_count": len(changes),
    "changes": changes,
    "unexpected_changes": unexpected,
    "checks": checks,
    "failures": failures,
}

Path(output).write_text(
    json.dumps(
        data,
        ensure_ascii=False,
        indent=2,
    ) + "\n",
    encoding="utf-8",
)

if failures:
    raise SystemExit(20)
PY

  [ "$?" -eq 0 ] ||
    return 1

  cp -a \
    "$REPORT_DIR/model-machine-diff.json" \
    "$MODEL_PRIVATE/machine-diff.json"

  cat > "$MODEL_PRIVATE/changed-files.tsv" <<EOF
path	sha256	source
/root/hmn/hmn-refresh-pool-safe.sh	${EXPECTED_REFRESH_SHA}	live_VM101_after_R09B
/usr/local/lib/router-egress-vm101-runtime.sh	${EXPECTED_RUNTIME_SHA}	live_VM101_after_R09B
EOF

  python3 - \
    "$MODEL_PRIVATE/model-manifest.json" \
    "$MODEL_SLUG" \
    "$TS" \
    "$PREVIOUS_MODEL" \
    "$MODEL_TREE_PREFIX" \
    "$MODEL_TARGET_REL" \
    "$MODEL_RUNTIME_REL" \
    "$EXPECTED_REFRESH_SHA" \
    "$EXPECTED_RUNTIME_SHA" \
    "$LIVE_CODE_TEST_SHA" \
    "$VM101_METHODS" <<'PY'
import json
import sys
from pathlib import Path

(
    output,
    model_id,
    generated,
    previous,
    tree_prefix,
    target_rel,
    runtime_rel,
    target_sha,
    runtime_sha,
    code_test_sha,
    methods_url,
) = sys.argv[1:]

Path(output).write_text(
    json.dumps({
        "schema": "vm101-local-model-v1",
        "model_id": model_id,
        "generated_at_utc": generated,
        "previous_model": previous,
        "update_mode": "incremental",
        "tree_prefix": tree_prefix,
        "machine_files_updated": [
            {
                "path": "/root/hmn/hmn-refresh-pool-safe.sh",
                "model_relative_path": target_rel,
                "sha256": target_sha,
            },
            {
                "path": "/usr/local/lib/router-egress-vm101-runtime.sh",
                "model_relative_path": runtime_rel,
                "sha256": runtime_sha,
            },
        ],
        "verified_live_unchanged_file": {
            "path": "/root/hmn/hmn-code-test.sh",
            "sha256": code_test_sha,
        },
        "vm101_modified_by_this_step": False,
        "source_of_changed_files": "read-only pull from live VM101",
        "methods_url": methods_url,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)
PY

  find "$MODEL_PRIVATE" \
    -type f \
    ! -name file-list.txt \
    ! -name SHA256SUMS \
    -printf '%P\n' |
  sort > "$MODEL_PRIVATE/file-list.txt"

  python3 - \
    "$MODEL_PRIVATE/index.html" \
    "$MODEL_SLUG" \
    "$MODEL_TREE_PREFIX" <<'PY'
import html
import sys
from pathlib import Path

output = Path(sys.argv[1])
model_id = sys.argv[2]
prefix = sys.argv[3]

browse = (
    f"{prefix}/"
    if prefix
    else "file-list.txt"
)

output.write_text(
    f"""<!doctype html>
<html lang="ru">
<head>
<meta charset="utf-8">
<title>VM101 model {html.escape(model_id)}</title>
</head>
<body style="font-family:system-ui;max-width:1050px;margin:40px auto">
<h1>VM101 local model</h1>
<p>Snapshot: <code>{html.escape(model_id)}</code></p>
<p>Update mode: incremental. Only machine files changed by R09B were replaced.</p>
<ul>
<li><a href="model-manifest.json">Model manifest</a></li>
<li><a href="machine-diff.json">Machine diff</a></li>
<li><a href="changed-files.tsv">Changed machine files</a></li>
<li><a href="file-list.txt">All files</a></li>
<li><a href="{html.escape(browse)}">Browse model tree</a></li>
<li><a href="SHA256SUMS">SHA256SUMS</a></li>
</ul>
</body>
</html>
""",
    encoding="utf-8",
)
PY

  (
    cd "$MODEL_PRIVATE" || exit 1

    find . \
      -type f \
      ! -name SHA256SUMS \
      -print0 |
    sort -z |
    xargs -0 sha256sum \
      > SHA256SUMS

    sha256sum -c SHA256SUMS
  ) > "$REPORT_DIR/model-sha256-check.txt" 2>&1 ||
    return 1

  rm -rf "$MODEL_PUBLIC"

  clone_tree_incremental \
    "$MODEL_PRIVATE" \
    "$MODEL_PUBLIC" \
    "$REPORT_DIR/model-publish.log" ||
    return 1

  chmod -R a+rX "$MODEL_PUBLIC"

  mkdir -p \
    "$STATE/vm101-model" \
    "$PUBROOT/vm101-model"

  safe_update_symlink \
    "snapshots/$MODEL_SLUG" \
    "$STATE/vm101-model/current" ||
    return 1

  safe_update_symlink \
    "../$MODEL_SLUG" \
    "$PUBROOT/vm101-model/current" ||
    return 1

  cat > "$STATE/current-vm101-model.env" <<EOF
VM101_MODEL_ID=${MODEL_SLUG}
VM101_MODEL_PRIVATE=${MODEL_PRIVATE}
VM101_MODEL_PUBLIC=${MODEL_PUBLIC}
VM101_MODEL_URL=${VM101_MODEL}
VM101_MODEL_PREVIOUS=${PREVIOUS_MODEL}
VM101_MODEL_UPDATE_MODE=incremental
VM101_MODEL_CHANGED_FILE_COUNT=2
VM101_MODEL_REFRESH_SHA256=${EXPECTED_REFRESH_SHA}
VM101_MODEL_RUNTIME_SHA256=${EXPECTED_RUNTIME_SHA}
VM101_MODEL_CODE_TEST_LIVE_SHA256=${LIVE_CODE_TEST_SHA}
VM101_MODEL_GENERATED_AT_UTC=${TS}
EOF

  chmod 600 "$STATE/current-vm101-model.env"

  MODEL_PASS=true
  return 0
}

build_and_test_code_candidate() {
  CANONICAL_WORKSPACE="$(
    state_value \
      "$CANONICAL_STATE" \
      VM101_CANONICAL_PRIVATE_WORKSPACE
  )"

  [ -d "$CANONICAL_WORKSPACE" ] ||
    return 1

  CANONICAL_CODE_SOURCE="$CANONICAL_WORKSPACE/source/root/hmn/hmn-code-test.sh"
  CANONICAL_RUNTIME="$CANONICAL_WORKSPACE/candidate/usr/local/lib/router-egress-vm101-runtime.sh"
  LOCKS="$CANONICAL_WORKSPACE/contracts/source-locks.tsv"

  for required in \
    "$CANONICAL_CODE_SOURCE" \
    "$CANONICAL_RUNTIME" \
    "$LOCKS"
  do
    [ -s "$required" ] ||
      return 1
  done

  if [ ! -x "$ROOT/bin/vm101-canonical-validate" ]; then
    return 1
  fi

  "$ROOT/bin/vm101-canonical-validate" \
    > "$REPORT_DIR/canonical-validator.txt" \
    2>&1 ||
    return 1

  LOCKED_CODE_SHA="$(
    awk -F '\t' \
      '$1 == "code_test" {print $3}' \
      "$LOCKS"
  )"

  CODE_SOURCE_SHA="$(file_sha "$CANONICAL_CODE_SOURCE")"

  CODE_SOURCE_LINES="$(
    wc -l < "$CANONICAL_CODE_SOURCE" |
      tr -d '[:space:]'
  )"

  CANONICAL_RUNTIME_SHA="$(file_sha "$CANONICAL_RUNTIME")"

  [ "$LOCKED_CODE_SHA" = "$EXPECTED_CODE_TEST_SOURCE_SHA" ] ||
    return 1

  [ "$CODE_SOURCE_SHA" = "$EXPECTED_CODE_TEST_SOURCE_SHA" ] ||
    return 1

  [ "$CODE_SOURCE_LINES" = "$EXPECTED_CODE_TEST_LINES" ] ||
    return 1

  [ "$CANONICAL_RUNTIME_SHA" = "$EXPECTED_RUNTIME_SHA" ] ||
    return 1

  sh -n "$CANONICAL_RUNTIME" ||
    return 1

  grep -Eq \
    '^[[:space:]]*vm101_healthy_bootstrap_iface[[:space:]]*\(\)[[:space:]]*\{' \
    "$CANONICAL_RUNTIME" ||
    return 1

  cp -a "$CANONICAL_CODE_SOURCE" "$CODE_SOURCE"
  cp -a "$CANONICAL_CODE_SOURCE" "$CODE_CANDIDATE"

  chmod 600 "$CODE_SOURCE" "$CODE_CANDIDATE"

  python3 - \
    "$CODE_SOURCE" \
    "$CODE_CANDIDATE" \
    "$EXPECTED_CODE_TEST_SOURCE_SHA" \
    "$EXPECTED_CODE_TEST_LINES" \
    "$EXPECTED_CODE_TEST_REGION_SHA" \
    "$REPORT_DIR/transformation.json" <<'PY'
import hashlib
import json
import sys
from pathlib import Path

(
    source_name,
    candidate_name,
    expected_sha,
    expected_lines,
    expected_region_sha,
    output_name,
) = sys.argv[1:]

source_path = Path(source_name)
candidate_path = Path(candidate_name)

raw = source_path.read_bytes()
source_sha = hashlib.sha256(raw).hexdigest()

if source_sha != expected_sha:
    raise SystemExit("SOURCE_SHA_MISMATCH")

text = raw.decode("utf-8")
lines = text.splitlines(keepends=True)

if len(lines) != int(expected_lines):
    raise SystemExit(
        f"SOURCE_LINE_COUNT_MISMATCH:{len(lines)}"
    )

region = "".join(lines[12:39]).encode("utf-8")
region_sha = hashlib.sha256(region).hexdigest()

if region_sha != expected_region_sha:
    raise SystemExit(
        f"REGION_SHA_MISMATCH:{region_sha}"
    )

old_block = "".join(lines[20:31])

checks_before = {
    "active_from_table200":
        "ACTIVE=" in lines[20]
        and "table 200" in lines[20],

    "explicit_override_present":
        "HMN_REQUEST_IFACE" in old_block,

    "table200_hard_failure_present":
        "не нашёл active VPN interface в table 200"
        in old_block,
}

failures = [
    name
    for name, passed in checks_before.items()
    if not passed
]

if failures:
    raise SystemExit(
        "SOURCE_STRUCTURE_MISMATCH:"
        + ",".join(failures)
    )

new_block = r'''# BEGIN CANONICAL_M07_CODE_TEST_SELECTOR
VM101_RUNTIME_LIB="${VM101_RUNTIME_LIB:-/usr/local/lib/router-egress-vm101-runtime.sh}"

if [ ! -r "$VM101_RUNTIME_LIB" ]; then
  echo "ERROR: runtime library not found: $VM101_RUNTIME_LIB"
  exit 1
fi

. "$VM101_RUNTIME_LIB"

PREFERRED_ACTIVE=""

if [ "${HMN_REQUEST_IFACE:-auto}" != "auto" ]; then
  PREFERRED_ACTIVE="$HMN_REQUEST_IFACE"
else
  PREFERRED_ACTIVE="$(
    ip route show table 200 2>/dev/null |
      awk '/^default dev /{print $3; exit}'
  )"
fi

ACTIVE="$(
  vm101_healthy_bootstrap_iface \
    "$PREFERRED_ACTIVE" \
    2>/dev/null ||
  true
)"

if [ -z "${ACTIVE:-}" ]; then
  echo "ERROR: no strict healthy VPN interface among vpn1-vpn5."
  exit 1
fi
# END CANONICAL_M07_CODE_TEST_SELECTOR
'''.splitlines(keepends=True)

candidate_lines = (
    lines[:20]
    + new_block
    + lines[31:]
)

candidate = "".join(candidate_lines)

if not candidate.endswith("\n"):
    candidate += "\n"

candidate_path.write_text(
    candidate,
    encoding="utf-8",
)

candidate_sha = hashlib.sha256(
    candidate.encode("utf-8")
).hexdigest()

Path(output_name).write_text(
    json.dumps({
        "schema": "vm101-code-test-transform-v1",
        "source_sha256": source_sha,
        "source_line_count": len(lines),
        "region_id": "code_test-r1",
        "region_sha256": region_sha,
        "replaced_source_lines": {
            "start": 21,
            "end": 31,
        },
        "candidate_sha256": candidate_sha,
        "changes": [
            "source canonical runtime library",
            "preserve explicit HMN_REQUEST_IFACE as preferred candidate",
            "use table 200 only as optional preferred candidate",
            "select interface using vm101_healthy_bootstrap_iface",
            "fail when no strict healthy vpn1-vpn5 exists",
        ],
        "checks_before": checks_before,
        "complete_file_generated": True,
        "installation_performed": False,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)
PY

  [ "$?" -eq 0 ] ||
    return 1

  CODE_REGION_SHA="$(
    python3 -c '
import json
import sys
print(json.load(open(sys.argv[1]))["region_sha256"])
' "$REPORT_DIR/transformation.json"
  )"

  CODE_CANDIDATE_SHA="$(file_sha "$CODE_CANDIDATE")"

  sh -n "$CODE_CANDIDATE" \
    > "$REPORT_DIR/code-syntax-check.txt" \
    2>&1 ||
    return 1

  CODE_SYNTAX_PASS=true

  diff -u \
    "$CODE_SOURCE" \
    "$CODE_CANDIDATE" \
    > "$CODE_DIFF"

  [ "$?" -eq 1 ] ||
    return 1

  python3 - \
    "$CODE_SOURCE" \
    "$CODE_CANDIDATE" \
    "$CODE_DIFF" \
    "$REPORT_DIR/code-static-tests.json" \
    "$REPORT_DIR/code-diff-review.json" <<'PY'
import json
import sys
from pathlib import Path

(
    source_name,
    candidate_name,
    diff_name,
    static_name,
    review_name,
) = sys.argv[1:]

source = Path(source_name).read_text(
    encoding="utf-8",
    errors="strict",
)

candidate = Path(candidate_name).read_text(
    encoding="utf-8",
    errors="strict",
)

diff_lines = Path(diff_name).read_text(
    encoding="utf-8",
    errors="strict",
).splitlines()

source_lines = source.splitlines(keepends=True)

prefix = "".join(source_lines[:20])
suffix = "".join(source_lines[31:])

static_checks = {
    "runtime_library_variable":
        'VM101_RUNTIME_LIB="${VM101_RUNTIME_LIB:-/usr/local/lib/router-egress-vm101-runtime.sh}"'
        in candidate,

    "runtime_library_sourced":
        '. "$VM101_RUNTIME_LIB"' in candidate,

    "healthy_bootstrap_helper_called":
        "vm101_healthy_bootstrap_iface"
        in candidate,

    "explicit_request_preserved":
        'PREFERRED_ACTIVE="$HMN_REQUEST_IFACE"'
        in candidate,

    "table200_optional_candidate":
        "ip route show table 200 2>/dev/null"
        in candidate,

    "old_table200_hard_failure_removed":
        "не нашёл active VPN interface в table 200"
        not in candidate,

    "strict_no_healthy_failure":
        "no strict healthy VPN interface among vpn1-vpn5"
        in candidate,

    "selector_markers_unique":
        candidate.count(
            "# BEGIN CANONICAL_M07_CODE_TEST_SELECTOR"
        ) == 1
        and candidate.count(
            "# END CANONICAL_M07_CODE_TEST_SELECTOR"
        ) == 1,

    "original_prefix_preserved":
        candidate.startswith(prefix),

    "original_suffix_preserved":
        candidate.endswith(suffix),

    "table200_not_hard_contract":
        candidate.count("table 200") == 1,
}

static_failures = [
    name
    for name, passed in static_checks.items()
    if not passed
]

added = [
    line[1:]
    for line in diff_lines
    if line.startswith("+")
    and not line.startswith("+++")
]

removed = [
    line[1:]
    for line in diff_lines
    if line.startswith("-")
    and not line.startswith("---")
]

expected_removed = [
    line.rstrip("\n")
    for line in source_lines[20:31]
]

review_checks = {
    "only_expected_source_block_removed":
        removed == expected_removed,

    "candidate_prefix_preserved":
        candidate.startswith(prefix),

    "candidate_suffix_preserved":
        candidate.endswith(suffix),

    "candidate_is_complete_file":
        candidate.startswith("#!/bin/ash"),

    "selector_added":
        any(
            "BEGIN CANONICAL_M07_CODE_TEST_SELECTOR"
            in line
            for line in added
        ),
}

review_failures = [
    name
    for name, passed in review_checks.items()
    if not passed
]

Path(static_name).write_text(
    json.dumps({
        "schema": "vm101-code-test-static-tests-v1",
        "passed": not static_failures,
        "test_count": len(static_checks),
        "pass_count": sum(
            1
            for passed in static_checks.values()
            if passed
        ),
        "failure_count": len(static_failures),
        "checks": static_checks,
        "failures": static_failures,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)

Path(review_name).write_text(
    json.dumps({
        "schema": "vm101-code-test-private-diff-review-v1",
        "passed": not review_failures,
        "added_line_count": len(added),
        "removed_line_count": len(removed),
        "checks": review_checks,
        "failures": review_failures,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)

if static_failures:
    raise SystemExit(20)

if review_failures:
    raise SystemExit(21)
PY

  [ "$?" -eq 0 ] ||
    return 1

  CODE_STATIC_PASS=true
  CODE_DIFF_PASS=true

  python3 - \
    "$CODE_CANDIDATE" \
    "$CODE_TEST_DIR/selector-under-test.sh" <<'PY'
import sys
from pathlib import Path

text = Path(sys.argv[1]).read_text(
    encoding="utf-8"
)

start_marker = "# BEGIN CANONICAL_M07_CODE_TEST_SELECTOR"
end_marker = "# END CANONICAL_M07_CODE_TEST_SELECTOR"

start = text.index(start_marker)
end = text.index(end_marker, start)
end += len(end_marker)

Path(sys.argv[2]).write_text(
    text[start:end] + "\n",
    encoding="utf-8",
)
PY

  [ "$?" -eq 0 ] ||
    return 1

  FAKE_BIN="$CODE_TEST_DIR/fake-bin"
  FAKE_RUNTIME="$CODE_TEST_DIR/fake-runtime.sh"
  FIXTURE_RUNNER="$CODE_TEST_DIR/run-selector-fixture.sh"

  mkdir -p "$FAKE_BIN"

  cat > "$FAKE_BIN/ip" <<'EOF'
#!/bin/sh

if [ "$#" -ge 4 ] &&
   [ "$1" = "route" ] &&
   [ "$2" = "show" ] &&
   [ "$3" = "table" ] &&
   [ "$4" = "200" ]
then
  if [ -n "${VM101_FIXTURE_TABLE200:-}" ]; then
    printf 'default dev %s\n' \
      "$VM101_FIXTURE_TABLE200"
  fi

  exit 0
fi

exit 1
EOF

  cat > "$FAKE_RUNTIME" <<'EOF'
#!/bin/sh

vm101_healthy_bootstrap_iface() {
  printf '%s\n' "${1:-}" \
    > "$VM101_FIXTURE_ARG_FILE"

  printf '%s\n' "${VM101_FIXTURE_RESULT:-}"
}
EOF

  cat > "$FIXTURE_RUNNER" <<'EOF'
#!/bin/sh
set -u

. "$SELECTOR_FILE"

printf 'ACTIVE=%s\n' "$ACTIVE"
EOF

  chmod 700 \
    "$FAKE_BIN/ip" \
    "$FAKE_RUNTIME" \
    "$FIXTURE_RUNNER"

  : > "$REPORT_DIR/code-fixture-results.tsv"

  run_fixture() {
    local name="$1"
    local request="$2"
    local table200="$3"
    local helper_result="$4"
    local expected_rc="$5"
    local expected_active="$6"
    local expected_arg="$7"

    local arg_file="$CODE_TEST_DIR/${name}.arg"
    local stdout_file="$CODE_TEST_DIR/${name}.stdout"
    local stderr_file="$CODE_TEST_DIR/${name}.stderr"

    rm -f \
      "$arg_file" \
      "$stdout_file" \
      "$stderr_file"

    PATH="$FAKE_BIN:$PATH" \
    VM101_RUNTIME_LIB="$FAKE_RUNTIME" \
    VM101_FIXTURE_ARG_FILE="$arg_file" \
    VM101_FIXTURE_TABLE200="$table200" \
    VM101_FIXTURE_RESULT="$helper_result" \
    HMN_REQUEST_IFACE="$request" \
    SELECTOR_FILE="$CODE_TEST_DIR/selector-under-test.sh" \
      sh "$FIXTURE_RUNNER" \
      > "$stdout_file" \
      2> "$stderr_file"

    local actual_rc=$?
    local actual_active
    local actual_arg
    local passed=true

    actual_active="$(
      sed -n 's/^ACTIVE=//p' "$stdout_file" |
        tail -n1
    )"

    actual_arg="$(
      cat "$arg_file" 2>/dev/null
    )"

    [ "$actual_rc" -eq "$expected_rc" ] ||
      passed=false

    [ "$actual_active" = "$expected_active" ] ||
      passed=false

    [ "$actual_arg" = "$expected_arg" ] ||
      passed=false

    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
      "$name" \
      "$passed" \
      "$actual_rc" \
      "$actual_active" \
      "$actual_arg" \
      "$expected_active" \
      "$expected_arg" \
      >> "$REPORT_DIR/code-fixture-results.tsv"
  }

  run_fixture \
    auto_table200_preferred \
    auto \
    vpn4 \
    vpn4 \
    0 \
    vpn4 \
    vpn4

  run_fixture \
    auto_without_table200 \
    auto \
    "" \
    vpn1 \
    0 \
    vpn1 \
    ""

  run_fixture \
    explicit_iface_preferred \
    vpn3 \
    vpn4 \
    vpn3 \
    0 \
    vpn3 \
    vpn3

  run_fixture \
    no_healthy_iface_refused \
    auto \
    vpn2 \
    "" \
    1 \
    "" \
    vpn2

  python3 - \
    "$REPORT_DIR/code-fixture-results.tsv" \
    "$REPORT_DIR/code-fixture-results.json" <<'PY'
import csv
import json
import sys
from pathlib import Path

rows = []

with Path(sys.argv[1]).open(
    encoding="utf-8",
    newline="",
) as handle:
    reader = csv.reader(handle, delimiter="\t")

    for row in reader:
        (
            name,
            passed,
            actual_rc,
            actual_active,
            actual_arg,
            expected_active,
            expected_arg,
        ) = row

        rows.append({
            "name": name,
            "passed": passed == "true",
            "actual_rc": int(actual_rc),
            "actual_active": actual_active,
            "actual_helper_argument": actual_arg,
            "expected_active": expected_active,
            "expected_helper_argument": expected_arg,
        })

failures = [
    row["name"]
    for row in rows
    if not row["passed"]
]

Path(sys.argv[2]).write_text(
    json.dumps({
        "schema": "vm101-code-test-selector-fixtures-v1",
        "passed": not failures,
        "case_count": len(rows),
        "pass_count": sum(
            1 for row in rows if row["passed"]
        ),
        "failure_count": len(failures),
        "cases": rows,
        "failures": failures,
    }, ensure_ascii=False, indent=2) + "\n",
    encoding="utf-8",
)

if failures:
    raise SystemExit(30)
PY

  [ "$?" -eq 0 ] ||
    return 1

  CODE_FIXTURE_PASS=true

  (
    cd "$CODE_WORKSPACE" || exit 1

    find . \
      -type f \
      ! -name SHA256SUMS \
      -print0 |
    sort -z |
    xargs -0 sha256sum \
      > SHA256SUMS

    sha256sum -c SHA256SUMS
  ) > "$REPORT_DIR/code-private-sha256-check.txt" 2>&1 ||
    return 1

  CODE_PRIVATE_SHA_PASS=true
  return 0
}

update_workflow_state() {
  python3 - \
    "$WORKFLOW_STATE" \
    "$CODE_WORKSPACE" \
    "$CODE_SOURCE_SHA" \
    "$CODE_CANDIDATE_SHA" \
    "$VM101_MODEL" \
    "$VM101_METHODS" \
    "$STEP_REPORT" <<'PY'
import sys
from pathlib import Path

path = Path(sys.argv[1])

updates = {
    "M07_NEXT_TARGET":
        "code_test",

    "M07_CODE_TEST_WORKSPACE":
        sys.argv[2],

    "M07_CODE_TEST_SOURCE_SHA256":
        sys.argv[3],

    "M07_CODE_TEST_CANDIDATE_SHA256":
        sys.argv[4],

    "M07_CODE_TEST_STATUS":
        "CANDIDATE_TESTED_NOT_INSTALLED",

    "M07_VM101_MODEL_URL":
        sys.argv[5],

    "M07_VM101_METHODS_URL":
        sys.argv[6],

    "M07_R10_REPORT":
        sys.argv[7],

    "M07_NEXT_STEP":
        "REVIEW_CODE_TEST_DIFF_AND_BUILD_BUNDLE",
}

lines = path.read_text(
    encoding="utf-8",
    errors="replace",
).splitlines()

result = []
seen = set()

for line in lines:
    if "=" not in line:
        result.append(line)
        continue

    key, _ = line.split("=", 1)

    if key in updates:
        result.append(f"{key}={updates[key]}")
        seen.add(key)
    else:
        result.append(line)

for key, value in updates.items():
    if key not in seen:
        result.append(f"{key}={value}")

path.write_text(
    "\n".join(result) + "\n",
    encoding="utf-8",
)
PY

  [ "$?" -eq 0 ] ||
    return 1

  chmod 600 "$WORKFLOW_STATE"
  WORKFLOW_UPDATED=true
  return 0
}

run_step() {
  if [ "$(id -un)" != "ops" ]; then
    fail_step "WRONG_USER"
    return 1
  fi

  for required_dir in \
    "$PUBROOT/$LOCAL_PLAN_SLUG" \
    "$PUBROOT/$GLOBAL_PLAN_SLUG" \
    "$PUBROOT/$XS_MAP_SLUG" \
    "$PUBROOT/vm101-reference/current" \
    "$PUBROOT/vm101-canonical/current"
  do
    if [ ! -e "$required_dir" ]; then
      echo "MISSING_REQUIRED_LINK_PATH=$required_dir" \
        >> "$REPORT_DIR/missing-required-links.txt"

      fail_step "MANDATORY_LINK_SOURCE_MISSING"
      return 1
    fi
  done

  if [ ! -s "$CANONICAL_STATE" ] ||
     [ ! -s "$WORKFLOW_STATE" ]
  then
    fail_step "REQUIRED_STATE_MISSING"
    return 1
  fi

  REFRESH_STATUS="$(
    state_value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_STATUS
  )"

  if [ "$REFRESH_STATUS" != "INSTALLED_VERIFIED_NO_REFRESH" ]; then
    fail_step "R09B_INSTALL_STATUS_NOT_VERIFIED"
    return 1
  fi

  create_methods_snapshot || {
    fail_step "METHODS_SNAPSHOT_FAILED"
    return 1
  }

  pull_and_verify_live_files || {
    fail_step "LIVE_VM101_SYNC_VERIFICATION_FAILED"
    return 1
  }

  create_model_snapshot || {
    fail_step "VM101_MODEL_INCREMENTAL_SYNC_FAILED"
    return 1
  }

  build_and_test_code_candidate || {
    fail_step "CODE_TEST_CANDIDATE_BUILD_OR_TEST_FAILED"
    return 1
  }

  update_workflow_state || {
    fail_step "WORKFLOW_STATE_UPDATE_FAILED"
    return 1
  }

  ALL_OK=true
  OPERATION_RESULT="MODEL_AND_METHODS_PUBLISHED_CODE_TEST_CANDIDATE_TESTED"
  return 0
}

run_step
RUN_RC=$?

if [ "$RUN_RC" -ne 0 ]; then
  ALL_OK=false
fi

if [ "$ALL_OK" = "true" ]; then
  DECISION="PASS_${STEP}"
  EXECUTION="PASS"
  NEXT_STEP="REVIEW_CODE_TEST_DIFF_AND_BUILD_BUNDLE"
else
  DECISION="STOP_${STEP}_${FAILURE_REASON}"
  EXECUTION="STOP"
  NEXT_STEP="REPAIR_R10_MODEL_METHODS_OR_CODE_TEST"
fi

python3 - \
  "$REPORT_DIR/facts.json" \
  "$STEP" \
  "$DECISION" \
  "$EXECUTION" \
  "$OPERATION_RESULT" \
  "$FAILURE_REASON" \
  "$METHODS_PASS" \
  "$LIVE_SYNC_PASS" \
  "$MODEL_PASS" \
  "$LIVE_REFRESH_SHA" \
  "$LIVE_RUNTIME_SHA" \
  "$LIVE_CODE_TEST_SHA" \
  "$REMOTE_HEALTHY_COUNT" \
  "$REMOTE_ROUTE_COUNT" \
  "$MODEL_SLUG" \
  "$MODEL_PRIVATE" \
  "$MODEL_TARGET_REL" \
  "$MODEL_RUNTIME_REL" \
  "$METHODS_SLUG" \
  "$METHODS_PRIVATE" \
  "$CODE_WORKSPACE" \
  "$CODE_SOURCE_SHA" \
  "$CODE_REGION_SHA" \
  "$CODE_CANDIDATE_SHA" \
  "$CODE_SYNTAX_PASS" \
  "$CODE_STATIC_PASS" \
  "$CODE_FIXTURE_PASS" \
  "$CODE_DIFF_PASS" \
  "$CODE_PRIVATE_SHA_PASS" \
  "$WORKFLOW_UPDATED" \
  "$ALL_OK" \
  "$NEXT_STEP" \
  "$STEP_REPORT" \
  "$LOCAL_PLAN" \
  "$GLOBAL_PLAN" \
  "$XS_MAP" \
  "$VM101_MODEL" \
  "$VM101_METHODS" \
  "$VM101_REFERENCE" \
  "$VM101_CANONICAL" <<'PY'
import json
import sys
from pathlib import Path

(
    output,
    step,
    decision,
    execution,
    operation,
    reason,
    methods_pass,
    live_sync_pass,
    model_pass,
    live_refresh_sha,
    live_runtime_sha,
    live_code_sha,
    healthy,
    routes,
    model_id,
    model_private,
    model_target_rel,
    model_runtime_rel,
    methods_id,
    methods_private,
    code_workspace,
    code_source_sha,
    code_region_sha,
    code_candidate_sha,
    syntax_pass,
    static_pass,
    fixture_pass,
    diff_pass,
    private_sha_pass,
    workflow_updated,
    all_ok,
    next_step,
    step_report,
    local_plan,
    global_plan,
    xs_map,
    model_url,
    methods_url,
    reference_url,
    canonical_url,
) = sys.argv[1:]

data = {
    "schema": "router-step-facts-v1",
    "step": step,

    "assessment": {
        "decision": decision,
        "step_execution": execution,
        "operation_result": operation,
        "production_health": (
            "HEALTHY_5_OF_5"
            if healthy == "5" and routes == "5"
            else "NOT_CONFIRMED_5_OF_5"
        ),
        "milestone_status": "M07_IN_PROGRESS",
        "all_ok": all_ok == "true",
        "failure_reason": (
            None if execution == "PASS" else reason
        ),
    },

    "live_vm101_sync": {
        "performed": live_sync_pass == "true",
        "read_only": True,
        "refresh_pool_safe_sha256":
            live_refresh_sha,
        "runtime_library_sha256":
            live_runtime_sha,
        "code_test_sha256":
            live_code_sha,
        "healthy_count":
            int(healthy),
        "route_count":
            int(routes),
    },

    "vm101_model": {
        "model_id": model_id,
        "private_path": model_private,
        "update_mode": "incremental",
        "updated_from_live_vm101":
            model_pass == "true",
        "machine_files_updated": [
            {
                "path":
                    "/root/hmn/hmn-refresh-pool-safe.sh",
                "model_relative_path":
                    model_target_rel,
            },
            {
                "path":
                    "/usr/local/lib/router-egress-vm101-runtime.sh",
                "model_relative_path":
                    model_runtime_rel,
            },
        ],
        "vm101_modified_by_this_step": False,
    },

    "vm101_methods": {
        "methods_id": methods_id,
        "private_path": methods_private,
        "published": methods_pass == "true",
    },

    "code_test_candidate": {
        "workspace": code_workspace,
        "source_sha256": code_source_sha,
        "region_sha256": code_region_sha,
        "candidate_sha256": code_candidate_sha,
        "syntax_pass": syntax_pass == "true",
        "static_pass": static_pass == "true",
        "fixture_pass": fixture_pass == "true",
        "private_diff_review_pass":
            diff_pass == "true",
        "private_sha256_pass":
            private_sha_pass == "true",
        "installed": False,
    },

    "workflow_state_updated":
        workflow_updated == "true",

    "safety": {
        "single_target": True,
        "vm101_contacted_read_only": True,
        "vm101_modified": False,
        "installation_performed": False,
        "canonical_current_modified": False,
        "refresh_ran": False,
        "rebalance_ran": False,
        "services_restarted": False,
    },

    "mandatory_links": {
        "step_report": step_report,
        "local_plan": local_plan,
        "global_plan": global_plan,
        "xs_map": xs_map,
        "vm101_model": model_url,
        "vm101_methods": methods_url,
    },

    "additional_links": {
        "vm101_reference": reference_url,
        "vm101_canonical": canonical_url,
    },

    "next_step": next_step,
}

Path(output).write_text(
    json.dumps(
        data,
        ensure_ascii=False,
        indent=2,
    ) + "\n",
    encoding="utf-8",
)
PY

cat > "$REPORT_DIR/report.txt" <<EOF
=== ${STEP} RESULT ===
step=${STEP}
decision=${DECISION}
step_execution=${EXECUTION}
operation_result=${OPERATION_RESULT}
milestone_status=M07_IN_PROGRESS
all_ok=${ALL_OK}
failure_reason=${FAILURE_REASON}

live_vm101_sync:
  read_only=true
  sync_pass=${LIVE_SYNC_PASS}
  refresh_pool_safe_sha256=${LIVE_REFRESH_SHA}
  runtime_library_sha256=${LIVE_RUNTIME_SHA}
  code_test_sha256=${LIVE_CODE_TEST_SHA}
  healthy_count=${REMOTE_HEALTHY_COUNT}
  route_count=${REMOTE_ROUTE_COUNT}

vm101_model:
  model_id=${MODEL_SLUG}
  private_path=${MODEL_PRIVATE}
  update_mode=incremental
  sync_pass=${MODEL_PASS}
  updated_machine_file_1=/root/hmn/hmn-refresh-pool-safe.sh
  updated_machine_file_2=/usr/local/lib/router-egress-vm101-runtime.sh
  vm101_modified_by_this_step=false

vm101_methods:
  methods_id=${METHODS_SLUG}
  private_path=${METHODS_PRIVATE}
  published=${METHODS_PASS}

code_test_candidate:
  workspace=${CODE_WORKSPACE}
  source_sha256=${CODE_SOURCE_SHA}
  region_sha256=${CODE_REGION_SHA}
  candidate_sha256=${CODE_CANDIDATE_SHA}
  syntax_pass=${CODE_SYNTAX_PASS}
  static_pass=${CODE_STATIC_PASS}
  fixture_pass=${CODE_FIXTURE_PASS}
  private_diff_review_pass=${CODE_DIFF_PASS}
  private_sha256_pass=${CODE_PRIVATE_SHA_PASS}
  installed=false

safety:
  single_target=true
  vm101_contacted_read_only=true
  vm101_modified=false
  installation_performed=false
  canonical_current_modified=false
  refresh_ran=false
  rebalance_ran=false
  services_restarted=false

next_step=${NEXT_STEP}

STEP_REPORT=${STEP_REPORT}
LOCAL_PLAN=${LOCAL_PLAN}
GLOBAL_PLAN=${GLOBAL_PLAN}
XS_MAP=${XS_MAP}
VM101_MODEL=${VM101_MODEL}
VM101_METHODS=${VM101_METHODS}

VM101_REFERENCE=${VM101_REFERENCE}
VM101_CANONICAL=${VM101_CANONICAL}
REPORT_TXT=${REPORT_TXT}
FACTS_JSON=${FACTS_JSON}
EOF

cat > "$REPORT_DIR/index.html" <<EOF
<!doctype html>
<html lang="ru">
<head>
<meta charset="utf-8">
<title>${STEP}</title>
</head>
<body style="font-family:system-ui;max-width:1100px;margin:40px auto">
<h1>${STEP}</h1>

<h2>Результат</h2>
<ul>
<li><a href="report.txt">report.txt</a></li>
<li><a href="facts.json">facts.json</a></li>
<li><a href="vm101-live-audit.env">VM101 live audit</a></li>
<li><a href="model-machine-diff.json">Model machine diff</a></li>
<li><a href="code-static-tests.json">Code static tests</a></li>
<li><a href="code-fixture-results.json">Code fixtures</a></li>
<li><a href="code-diff-review.json">Code diff review</a></li>
<li><a href="step.sh">step.sh</a></li>
</ul>

<h2>Обязательные ссылки</h2>
<ul>
<li><a href="${STEP_REPORT}">Current STEP report</a></li>
<li><a href="${LOCAL_PLAN}">Local M07 plan</a></li>
<li><a href="${GLOBAL_PLAN}">Global project plan</a></li>
<li><a href="${XS_MAP}">XS Map</a></li>
<li><a href="${VM101_MODEL}">Timestamped VM101 model</a></li>
<li><a href="${VM101_METHODS}">Timestamped VM101 methods</a></li>
</ul>

<h2>Дополнительно</h2>
<ul>
<li><a href="${VM101_REFERENCE}">VM101 reference current</a></li>
<li><a href="${VM101_CANONICAL}">VM101 canonical current</a></li>
</ul>
</body>
</html>
EOF

find "$REPORT_DIR" \
  -type f \
  ! -name SHA256SUMS \
  -print0 |
sort -z |
xargs -0 sha256sum \
  > "$REPORT_DIR/SHA256SUMS"

chmod -R a+rX "$REPORT_DIR"

echo
echo "decision=$DECISION"
echo "operation_result=$OPERATION_RESULT"
echo "all_ok=$ALL_OK"
echo "failure_reason=$FAILURE_REASON"

echo
echo "methods_pass=$METHODS_PASS"
echo "live_sync_pass=$LIVE_SYNC_PASS"
echo "model_pass=$MODEL_PASS"
echo "code_syntax_pass=$CODE_SYNTAX_PASS"
echo "code_static_pass=$CODE_STATIC_PASS"
echo "code_fixture_pass=$CODE_FIXTURE_PASS"
echo "code_diff_pass=$CODE_DIFF_PASS"
echo "code_private_sha_pass=$CODE_PRIVATE_SHA_PASS"
echo "workflow_updated=$WORKFLOW_UPDATED"

echo
echo "vm101_modified=false"
echo "installation_performed=false"
echo "refresh_ran=false"
echo "rebalance_ran=false"
echo "services_restarted=false"

echo
echo "STEP_REPORT=$STEP_REPORT"
echo "LOCAL_PLAN=$LOCAL_PLAN"
echo "GLOBAL_PLAN=$GLOBAL_PLAN"
echo "XS_MAP=$XS_MAP"
echo "VM101_MODEL=$VM101_MODEL"
echo "VM101_METHODS=$VM101_METHODS"

echo
echo "VM101_REFERENCE=$VM101_REFERENCE"
echo "VM101_CANONICAL=$VM101_CANONICAL"
echo "REPORT_TXT=$REPORT_TXT"
echo "FACTS_JSON=$FACTS_JSON"

true