#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
PUBLISHER="/opt/router-ops/bin/router-publish-report"
BACKUP="/opt/router-ops/steps/20260716-064557_STEP_050M07R14B2_PUBLISHER_ACTIVATION_AND_SALVAGE_R02/router-publish-report.before"
REINDEX="/opt/router-ops/bin/router-public-reindex"
TOKEN_FILE="/opt/router-ops/public/.router-public-token"
EXPECTED_BACKUP_SHA256="1157a1fab94390200d2c0c0d03848e8b539f34f86cec134a94c5ed57f9f48d28"
SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
[[ -f "$BACKUP" ]] || BACKUP="$SELF_DIR/router-publish-report.before"

[[ "$(id -un)" == "ops" ]] || { echo 'RESULT=STOP_MUST_RUN_AS_OPS'; exit 1; }
[[ -f "$BACKUP" ]] || { echo 'RESULT=STOP_PUBLISHER_BACKUP_MISSING'; exit 1; }
[[ "$(sha256sum "$BACKUP" | awk '{print $1}')" == "$EXPECTED_BACKUP_SHA256" ]] || { echo 'RESULT=STOP_PUBLISHER_BACKUP_SHA_MISMATCH'; exit 1; }
install -m 755 "$BACKUP" "$PUBLISHER.rollback-new"
mv -f "$PUBLISHER.rollback-new" "$PUBLISHER"
sh -n "$PUBLISHER"
"$REINDEX"
echo 'RESULT=PASS_PUBLISHER_FILE_ROLLBACK'
echo "PUBLISHER_SHA256=$(sha256sum "$PUBLISHER" | awk '{print $1}')"
echo 'NOTE=Published canonical folders are retained as historical evidence; publication-state rollback requires a dedicated STEP.'