#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R08_LINEAGE_AWARE_FINALIZATION"
R01_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R01"
R02_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R02_PUBLICATION_CONTINUATION"
R03_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R03_PUBLICATION_CONTINUATION"
R04_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R04_REPORT_CONTINUATION"
R05_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R05_STEP_REPORT_PATH_SANITIZATION_CONTINUATION"
R06_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R06_HISTORY_COLLISION_REPAIR_AND_REPORT_CONTINUATION"
R07_STEP_ID="STEP_050M07R16_TRANSACTIONAL_GENERATION_ACTIVATION_R07_FINAL_REPORT_FINALIZATION"
R01_INSTALLER_SHA="7a6b018f150273784e294c1d78b117945a9f6390424484dd0b56ca458a2293c4"
R02_INSTALLER_SHA="c8bb032756dc818c7384ceac55eb55ca7c96d2972fe6d6dd17c4d993950ef58c"
R03_INSTALLER_SHA="9ccdb8aaccaf18b18549f3129f6066fccaf8fb3f6c40a86b01a4b280505610b9"
R04_INSTALLER_SHA="5542302988b360da1dafab7d08ca99f7fcdc0ae1bbeb73856f63a855814f7523"
R05_INSTALLER_SHA="23b8698e975d4f9bf05e2c40011a8649ed9c2e821036727ea681ba16e9532698"
R06_INSTALLER_SHA="1e1639764f5fcba9383916ec8f4830599b320ffd20dcae30678d35a2fed5df2b"
R07_INSTALLER_SHA="30468b88b2b7a61956bc70b5441cfabc3a860850aef72f3e301c4aa4051d2ee6"
GENERATION_ID="r15b2-20260716-215914"
EXPECTED_POST_KIND="label:project_source_post_vm101_transactional_generation_activation_r16"

SELF="$(readlink -f "$0")"
BUNDLE_DIR="$(dirname "$SELF")"
BUNDLE_ZIP="${BUNDLE_ZIP:?BUNDLE_ZIP is required}"
EXPECTED_BUNDLE_SHA256="${EXPECTED_BUNDLE_SHA256:?EXPECTED_BUNDLE_SHA256 is required}"
EXPECTED_INSTALLER_SHA256="${EXPECTED_INSTALLER_SHA256:?EXPECTED_INSTALLER_SHA256 is required}"
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
EXPECTED_HOSTNAME="${R08_EXPECTED_HOSTNAME:-router-ops}"
BIN="$BASE/bin"
LIB="$BASE/lib"
PUBLISHER="$BIN/router-publish-report"
HTTP_VERIFY="$BIN/router-http-verify"
REINDEX="$BIN/router-public-reindex"
WORKFLOW_LIB="$LIB/router-step-workflow.sh"
PUBLICATION_LIB="$LIB/router-publication-contract.sh"
SAFE_PAYLOAD_BUILDER="$BUNDLE_DIR/scripts/vm130/build-public-safe-payload.sh"
HTML_ALIAS_BUILDER="$BUNDLE_DIR/scripts/vm130/build-public-html-aliases.py"
TARGET_POSTCHECK_SCRIPT="$BUNDLE_DIR/scripts/vm101/r16-authoritative-postcheck.sh"
PUBLISHER_SHA="${R08_EXPECTED_PUBLISHER_SHA:-a4977d5bd3b6f31c38d514afcae4f0850dfa44fd7e5477991fef5476d324f029}"
HTTP_VERIFY_SHA="${R08_EXPECTED_HTTP_VERIFY_SHA:-b81a8db5878c04f1259eba829c8636cce17e38cc3f44e0fb82137178d0501776}"
WORKFLOW_SHA="${R08_EXPECTED_WORKFLOW_SHA:-985e35997ff3c150f76208e2a2934bfaa37c5f0762063e1beea378f521f72a0f}"
PUBLICATION_LIB_SHA="${R08_EXPECTED_PUBLICATION_LIB_SHA:-a6a5c2495e3e3ada7c9ad841d998fa5c98bf8ff42875e1e30486b5872cb44a67}"
TS="$(date -u +%Y%m%d-%H%M%S)"
STEP_DIR="$BASE/steps/${TS}_${STEP_ID}"
mkdir -p "$STEP_DIR"
chmod 700 "$STEP_DIR"
cp -a "$SELF" "$STEP_DIR/step-code.sh"

REPORT="$STEP_DIR/report.txt"
FACTS="$STEP_DIR/facts.json"
VERIFY="$STEP_DIR/verify.txt"
ROLLBACK="$STEP_DIR/rollback.sh"
MAIN_LOG="$STEP_DIR/main.log"
PROGRESS_LOG="$STEP_DIR/progress.log"
TRANSFER_VERIFY="$STEP_DIR/transfer-verify.txt"
SYSTEM_MODEL="$STEP_DIR/system-model.txt"
METHODS_LIMIT="$STEP_DIR/methods-limitations.txt"
ACCESS_ROUTES="$STEP_DIR/access-routes.txt"
PHASE_CURRENT="$STEP_DIR/phase-current.env"
PHASE_EVENTS="$STEP_DIR/phase-events.log"
SNAPSHOT_LIST_LOG="$STEP_DIR/proxmox-vm101-snapshot-list.txt"
TARGET_POSTCHECK_LOG="$STEP_DIR/vm101-authoritative-postcheck.log"
LINEAGE_CLASSIFICATION_LOG="$STEP_DIR/r16-report-lineage-classification.txt"
PUBLISHED_ARTIFACT_LOG="$STEP_DIR/existing-publications-verification.txt"
PAYLOAD_BUILD_LOG="$STEP_DIR/public-safe-payload-build.log"
HTML_ALIAS_LOG="$STEP_DIR/public-html-aliases.log"
STEP_PUBLISH_LOG="$STEP_DIR/step-publish.log"
HTTP_LOG="$STEP_DIR/http-verify.log"
STEP_PAYLOAD="$STEP_DIR/step-report-payload"
HTML_ALIAS_DIR="$STEP_DIR/public-html-aliases"

exec > >(tee -a "$MAIN_LOG") 2>&1

# shellcheck disable=SC1090
. "$WORKFLOW_LIB"
# shellcheck disable=SC1090
. "$PUBLICATION_LIB"
router_step_workflow_init "$PHASE_CURRENT" "$PHASE_EVENTS" \
 transfer_verification vm130_preflight evidence_chain lineage_classification \
 snapshot_direct_verification vm101_authoritative_postcheck exact_repo_verification \
 existing_publication_verification step_report_preparation step_report_publication external_http_verification

RESULT=STOP_R16_R08_NOT_STARTED
STOP_REASON=not_started
CURRENT_PHASE=initializing
R01_STEP_DIR=unknown
R02_STEP_DIR=unknown
R03_STEP_DIR=unknown
R04_STEP_DIR=unknown
R05_STEP_DIR=unknown
R06_STEP_DIR=unknown
R07_STEP_DIR=unknown
SNAPSHOT_NAME=unknown
SNAPSHOT_CREATED=true
SNAPSHOT_PROOF=direct_qm_listsnapshot
R01_EVIDENCE_COMPLETE=false
R02_FAILURE_CLASSIFIED=false
R03_FAILURE_CLASSIFIED=false
R04_FAILURE_CLASSIFIED=false
R05_FAILURE_CLASSIFIED=false
R06_FAILURE_CLASSIFIED=false
R07_LINEAGE_CLASSIFIED=false
R07_POSTCHECK_COMPLETE=false
EXACT_REPO_VERIFIED=false
PLAN_PUBLICATION_COMPLETE=false
PROJECT_SOURCE_POST_PUBLICATION_COMPLETE=false
PROJECT_SOURCE_POST_CONTRACT_SALVAGED=true
PROJECT_SOURCE_POST_PUBLICATION_REPEATED=false
STEP_REPORT_PUBLICATION_COMPLETE=false
SUSPICIOUS_PATH_CLASSIFIED=true
PUBLIC_PATH_SANITIZATION_APPLIED=true
PUBLIC_PHASE_CURRENT_NAME=phase-current.txt
HISTORY_COLLISION_CLASSIFIED=true
HISTORY_COLLISION_REPAIR_APPLIED=true
HISTORY_COLLISION_REPAIR_COMMITTED=true
HISTORY_COLLISION_REPAIR_REPEATED=false
HISTORY_FORENSIC_URL=unknown
R06_FINAL_PASS_ARCHIVE_URL=unknown
R06_STOP_REPORT_URL=unknown
R06_STOP_ARCHIVE_URL=unknown
CURRENT_R07_STOP_FOLDER=unknown
CURRENT_R07_STOP_REPORT_URL=unknown
R06_DIRECT_FILE_HTTP_403_CLASSIFIED=false
PUBLIC_HTML_ALIASES_CREATED=false
PUBLIC_HTTP_ALIAS_POLICY=html_alias_required
CANONICAL_FACTS_FILENAME=facts.json
CANONICAL_VERIFY_FILENAME=verify.txt
CANONICAL_ROLLBACK_FILENAME=rollback.sh
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
TARGET_INSTALLER_RERUN=false
SNAPSHOT_REPEATED=false
MACHINE_GIT_COMPLETE=true
MACHINE_GIT_REPEATED=false
EXACT_CLONE_REPEATED=false
SOURCE_PUBLICATION_REPEATED=false
MODEL_PUBLICATION_REPEATED=false
METHODS_PUBLICATION_REPEATED=false
PLAN_PUBLICATION_REPEATED=false
ROUTER_MACHINE_CLOSE_RERUN=false
VM101_RUNTIME_CHANGE=false
RUNTIME_IMPACT=false
TRAFFIC_INTERRUPTION=none
COPY_VERIFY=false
HTTP_VERIFY_PASS=false
STEP_SHA256="$EXPECTED_INSTALLER_SHA256"
VM101_GIT_COMMIT=unknown
VM101_GIT_TREE=unknown
VM101_GIT_FILE_COUNT=unknown
PROJECT_SOURCE_POST_ACTUAL_KIND="$EXPECTED_POST_KIND"
PROJECT_SOURCE_POST_SHA256=unknown
STEP_REPORT_URL=PENDING_NOT_PUBLISHED
PROJECT_SOURCE_POST_URL="https://reports.secret-studio.ru/latest/20260717-183036_project_source_post_vm101_transactional_generation_activation_r16/"
PROJECT_SOURCE_POST_FILE_URL="${PROJECT_SOURCE_POST_URL}WG_PAID_MGTS_VM101_TRANSACTIONAL_GENERATION_ACTIVATION_R16.md"
LOCAL_M07_PLAN_URL="https://reports.secret-studio.ru/latest/20260717-103401_local_architecture_plan_vm101_autonomous_hmn_recovery_r16/"
GLOBAL_PROJECT_PLAN_URL="https://reports.secret-studio.ru/latest/20260711-123348_global_project_plan_wg_paid/"
ACCESS_MAP_URL="https://reports.secret-studio.ru/latest/20260715-210236_access_map_canonical_current/"
VM100_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260715-190653_vm100_git_source_1958200ccc1b/"
VM101_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260717-103352_vm101_git_source_d01016420799/"
VM121_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260713-182700_vm121_git_source_93e0e5a31f09/"
VM101_MODEL_URL="https://reports.secret-studio.ru/latest/20260717-103359_vm101_model_transactional_generation_activation_r16/"
VM101_METHODS_URL="https://reports.secret-studio.ru/latest/20260717-103359_vm101_methods_transactional_generation_activation_r16/"
VM130_SOURCE_URL="https://reports.secret-studio.ru/latest/20260717-035339_vm130_router_ops_source_snapshot_r15d_workflow_hardening_r01/"
LATEST_ROOT_URL="https://reports.secret-studio.ru/latest/"
OLD_ROOT_URL="https://reports.secret-studio.ru/old/"
FACTS_URL=PENDING_NOT_PUBLISHED
VERIFY_URL=PENDING_NOT_PUBLISHED
ROLLBACK_URL=PENDING_NOT_PUBLISHED
PUBLIC_OBJECT_KIND=step-report
PREVIOUS_MOVED_COUNT=unknown
COLLISION_DEDUPLICATED_COUNT=unknown
STEP_PUBLISHED_DIR=unknown

phase_begin() {
    CURRENT_PHASE="$1"
    echo ">>> [$(date -u '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$PROGRESS_LOG"
    router_step_phase_begin "$1"
}
phase_complete() { router_step_phase_complete "$1"; }
value_from_log() { awk -F= -v k="$1" '$1==k{print substr($0,index($0,"=")+1)}' "$2" | tail -n1; }
find_latest_step() { find "$BASE/steps" -mindepth 1 -maxdepth 1 -type d -name "*_$1" -print | LC_ALL=C sort | tail -n1; }
public_dir_for_url() {
    local url="$1" folder token
    folder="$(basename "${url%/}")"
    token="$(cat "$BASE/public/.router-public-token")"
    if [[ -d "$BASE/public/r/$token/latest/$folder" ]]; then
        printf '%s\n' "$BASE/public/r/$token/latest/$folder"
    elif [[ -d "$BASE/public/r/$token/old/$folder" ]]; then
        printf '%s\n' "$BASE/public/r/$token/old/$folder"
    else
        return 1
    fi
}

write_docs() {
    export RESULT STOP_REASON STEP_ID CURRENT_PHASE GENERATION_ID SNAPSHOT_NAME SNAPSHOT_CREATED SNAPSHOT_PROOF \
      R01_EVIDENCE_COMPLETE R02_FAILURE_CLASSIFIED R03_FAILURE_CLASSIFIED R04_FAILURE_CLASSIFIED R05_FAILURE_CLASSIFIED \
      R06_FAILURE_CLASSIFIED R07_LINEAGE_CLASSIFIED R07_POSTCHECK_COMPLETE EXACT_REPO_VERIFIED PLAN_PUBLICATION_COMPLETE \
      PROJECT_SOURCE_POST_PUBLICATION_COMPLETE PROJECT_SOURCE_POST_CONTRACT_SALVAGED PROJECT_SOURCE_POST_PUBLICATION_REPEATED \
      STEP_REPORT_PUBLICATION_COMPLETE SUSPICIOUS_PATH_CLASSIFIED PUBLIC_PATH_SANITIZATION_APPLIED PUBLIC_PHASE_CURRENT_NAME \
      HISTORY_COLLISION_CLASSIFIED HISTORY_COLLISION_REPAIR_APPLIED HISTORY_COLLISION_REPAIR_COMMITTED HISTORY_COLLISION_REPAIR_REPEATED \
      HISTORY_FORENSIC_URL R06_FINAL_PASS_ARCHIVE_URL R06_STOP_REPORT_URL R06_STOP_ARCHIVE_URL CURRENT_R07_STOP_FOLDER CURRENT_R07_STOP_REPORT_URL R06_DIRECT_FILE_HTTP_403_CLASSIFIED \
      PUBLIC_HTML_ALIASES_CREATED PUBLIC_HTTP_ALIAS_POLICY CANONICAL_FACTS_FILENAME CANONICAL_VERIFY_FILENAME CANONICAL_ROLLBACK_FILENAME \
      CORE_CHANGE_COMPLETE CORE_CHANGE_REPEATED TARGET_INSTALLER_RERUN SNAPSHOT_REPEATED MACHINE_GIT_COMPLETE MACHINE_GIT_REPEATED \
      EXACT_CLONE_REPEATED SOURCE_PUBLICATION_REPEATED MODEL_PUBLICATION_REPEATED METHODS_PUBLICATION_REPEATED PLAN_PUBLICATION_REPEATED \
      ROUTER_MACHINE_CLOSE_RERUN VM101_RUNTIME_CHANGE RUNTIME_IMPACT TRAFFIC_INTERRUPTION COPY_VERIFY HTTP_VERIFY_PASS STEP_SHA256 \
      VM101_GIT_COMMIT VM101_GIT_TREE VM101_GIT_FILE_COUNT PROJECT_SOURCE_POST_ACTUAL_KIND PROJECT_SOURCE_POST_SHA256 \
      STEP_REPORT_URL PROJECT_SOURCE_POST_URL PROJECT_SOURCE_POST_FILE_URL LOCAL_M07_PLAN_URL GLOBAL_PROJECT_PLAN_URL ACCESS_MAP_URL \
      VM100_PUBLIC_URL VM101_PUBLIC_URL VM121_PUBLIC_URL VM101_MODEL_URL VM101_METHODS_URL VM130_SOURCE_URL LATEST_ROOT_URL OLD_ROOT_URL \
      FACTS_URL VERIFY_URL ROLLBACK_URL PUBLIC_OBJECT_KIND PREVIOUS_MOVED_COUNT COLLISION_DEDUPLICATED_COUNT
    {
      for key in RESULT STOP_REASON STEP_ID CURRENT_PHASE GENERATION_ID SNAPSHOT_NAME SNAPSHOT_CREATED SNAPSHOT_PROOF \
        R01_EVIDENCE_COMPLETE R02_FAILURE_CLASSIFIED R03_FAILURE_CLASSIFIED R04_FAILURE_CLASSIFIED R05_FAILURE_CLASSIFIED \
        R06_FAILURE_CLASSIFIED R07_LINEAGE_CLASSIFIED R07_POSTCHECK_COMPLETE EXACT_REPO_VERIFIED PLAN_PUBLICATION_COMPLETE \
        PROJECT_SOURCE_POST_PUBLICATION_COMPLETE PROJECT_SOURCE_POST_CONTRACT_SALVAGED PROJECT_SOURCE_POST_PUBLICATION_REPEATED \
        STEP_REPORT_PUBLICATION_COMPLETE SUSPICIOUS_PATH_CLASSIFIED PUBLIC_PATH_SANITIZATION_APPLIED PUBLIC_PHASE_CURRENT_NAME \
        HISTORY_COLLISION_CLASSIFIED HISTORY_COLLISION_REPAIR_APPLIED HISTORY_COLLISION_REPAIR_COMMITTED HISTORY_COLLISION_REPAIR_REPEATED \
        HISTORY_FORENSIC_URL R06_FINAL_PASS_ARCHIVE_URL R06_STOP_REPORT_URL R06_STOP_ARCHIVE_URL CURRENT_R07_STOP_FOLDER CURRENT_R07_STOP_REPORT_URL R06_DIRECT_FILE_HTTP_403_CLASSIFIED \
        PUBLIC_HTML_ALIASES_CREATED PUBLIC_HTTP_ALIAS_POLICY CANONICAL_FACTS_FILENAME CANONICAL_VERIFY_FILENAME CANONICAL_ROLLBACK_FILENAME \
        CORE_CHANGE_COMPLETE CORE_CHANGE_REPEATED TARGET_INSTALLER_RERUN SNAPSHOT_REPEATED MACHINE_GIT_COMPLETE MACHINE_GIT_REPEATED \
        EXACT_CLONE_REPEATED SOURCE_PUBLICATION_REPEATED MODEL_PUBLICATION_REPEATED METHODS_PUBLICATION_REPEATED PLAN_PUBLICATION_REPEATED \
        ROUTER_MACHINE_CLOSE_RERUN VM101_RUNTIME_CHANGE RUNTIME_IMPACT TRAFFIC_INTERRUPTION COPY_VERIFY HTTP_VERIFY_PASS STEP_SHA256 \
        VM101_GIT_COMMIT VM101_GIT_TREE VM101_GIT_FILE_COUNT PROJECT_SOURCE_POST_ACTUAL_KIND PROJECT_SOURCE_POST_SHA256 \
        STEP_REPORT_URL PROJECT_SOURCE_POST_URL PROJECT_SOURCE_POST_FILE_URL LOCAL_M07_PLAN_URL GLOBAL_PROJECT_PLAN_URL ACCESS_MAP_URL \
        VM100_PUBLIC_URL VM101_PUBLIC_URL VM121_PUBLIC_URL VM101_MODEL_URL VM101_METHODS_URL VM130_SOURCE_URL LATEST_ROOT_URL OLD_ROOT_URL \
        FACTS_URL VERIFY_URL ROLLBACK_URL PUBLIC_OBJECT_KIND PREVIOUS_MOVED_COUNT COLLISION_DEDUPLICATED_COUNT; do
          printf '%s=%s\n' "$key" "${!key}"
      done
    } > "$REPORT"
    cp -a "$REPORT" "$VERIFY"
    python3 - "$FACTS" <<'PY_FACTS'
import json, os, sys
keys = '''RESULT STOP_REASON STEP_ID CURRENT_PHASE GENERATION_ID SNAPSHOT_NAME SNAPSHOT_CREATED SNAPSHOT_PROOF
R01_EVIDENCE_COMPLETE R02_FAILURE_CLASSIFIED R03_FAILURE_CLASSIFIED R04_FAILURE_CLASSIFIED R05_FAILURE_CLASSIFIED
R06_FAILURE_CLASSIFIED R07_LINEAGE_CLASSIFIED R07_POSTCHECK_COMPLETE EXACT_REPO_VERIFIED PLAN_PUBLICATION_COMPLETE
PROJECT_SOURCE_POST_PUBLICATION_COMPLETE PROJECT_SOURCE_POST_CONTRACT_SALVAGED PROJECT_SOURCE_POST_PUBLICATION_REPEATED
STEP_REPORT_PUBLICATION_COMPLETE SUSPICIOUS_PATH_CLASSIFIED PUBLIC_PATH_SANITIZATION_APPLIED PUBLIC_PHASE_CURRENT_NAME
HISTORY_COLLISION_CLASSIFIED HISTORY_COLLISION_REPAIR_APPLIED HISTORY_COLLISION_REPAIR_COMMITTED HISTORY_COLLISION_REPAIR_REPEATED
HISTORY_FORENSIC_URL R06_FINAL_PASS_ARCHIVE_URL R06_STOP_REPORT_URL R06_STOP_ARCHIVE_URL CURRENT_R07_STOP_FOLDER CURRENT_R07_STOP_REPORT_URL R06_DIRECT_FILE_HTTP_403_CLASSIFIED
PUBLIC_HTML_ALIASES_CREATED PUBLIC_HTTP_ALIAS_POLICY CANONICAL_FACTS_FILENAME CANONICAL_VERIFY_FILENAME CANONICAL_ROLLBACK_FILENAME
CORE_CHANGE_COMPLETE CORE_CHANGE_REPEATED TARGET_INSTALLER_RERUN SNAPSHOT_REPEATED MACHINE_GIT_COMPLETE MACHINE_GIT_REPEATED
EXACT_CLONE_REPEATED SOURCE_PUBLICATION_REPEATED MODEL_PUBLICATION_REPEATED METHODS_PUBLICATION_REPEATED PLAN_PUBLICATION_REPEATED
ROUTER_MACHINE_CLOSE_RERUN VM101_RUNTIME_CHANGE RUNTIME_IMPACT TRAFFIC_INTERRUPTION COPY_VERIFY HTTP_VERIFY_PASS STEP_SHA256
VM101_GIT_COMMIT VM101_GIT_TREE VM101_GIT_FILE_COUNT PROJECT_SOURCE_POST_ACTUAL_KIND PROJECT_SOURCE_POST_SHA256
STEP_REPORT_URL PROJECT_SOURCE_POST_URL PROJECT_SOURCE_POST_FILE_URL LOCAL_M07_PLAN_URL GLOBAL_PROJECT_PLAN_URL ACCESS_MAP_URL
VM100_PUBLIC_URL VM101_PUBLIC_URL VM121_PUBLIC_URL VM101_MODEL_URL VM101_METHODS_URL VM130_SOURCE_URL LATEST_ROOT_URL OLD_ROOT_URL
FACTS_URL VERIFY_URL ROLLBACK_URL PUBLIC_OBJECT_KIND PREVIOUS_MOVED_COUNT COLLISION_DEDUPLICATED_COUNT'''.split()
bools = {'true': True, 'false': False}
data = {}
for key in keys:
    value = os.environ.get(key, 'unknown')
    data[key.lower()] = bools.get(value, value)
with open(sys.argv[1], 'w', encoding='utf-8') as handle:
    json.dump(data, handle, ensure_ascii=False, indent=2, sort_keys=True)
    handle.write('\n')
PY_FACTS
    cat > "$ROLLBACK" <<EOF_ROLLBACK
#!/bin/sh
set -eu
printf '%s\n' 'R16 production core was committed successfully by R01.'
printf '%s\n' 'R08 changes no VM101 runtime and only finalizes the current PASS report.'
printf '%s\n' 'Do not roll back R16 because direct report artifact extensions are denied by the publication web policy.'
printf '%s\n' 'Canonical artifacts remain stored in the report folder; public HTML aliases are used for HTTP verification.'
EOF_ROLLBACK
    chmod 700 "$ROLLBACK"
    cat > "$SYSTEM_MODEL" <<EOF_MODEL
R16 generation $GENERATION_ID is active on VM101. Snapshot $SNAPSHOT_NAME exists on Proxmox.
R08 is a publication-only lineage-aware finalizer. R06 already committed the history collision repair and verified all R16 runtime and canonical artifacts.
The publication host returns HTTP 403 for direct canonical report files such as report.txt, facts.json, verify.txt and rollback.sh. R08 therefore preserves canonical files locally while exposing and verifying HTML aliases.
EOF_MODEL
    cat > "$METHODS_LIMIT" <<EOF_METHODS
R08 starts from the first incomplete operation after the latest proven R07 STOP report.
It does not repeat snapshot, target core, target installer, Machine Git, source/model/methods/plan/post publication, router-machine-close or history repair.
After step-report publication, any failure is written into the same current report directory. No second STOP report is published, preventing the verified report from being displaced into old/.
No direct canonical extension is used as an HTTPS PASS criterion; directory index and HTML aliases are verified instead.
EOF_METHODS
    cat > "$ACCESS_ROUTES" <<EOF_ACCESS
VM130: ops@router-ops
VM101 approved read-only route: VM130 -> ssh pve-mgts -> root@10.71.100.2 using /root/.ssh/pve_to_openwrt_mgts_ed25519
R08 uses VM101 only for authoritative read-only post-check.
EOF_ACCESS
}

build_html_aliases() {
    rm -rf "$HTML_ALIAS_DIR"
    python3 "$HTML_ALIAS_BUILDER" --facts "$FACTS" --verify "$VERIFY" --rollback "$ROLLBACK" --output-dir "$HTML_ALIAS_DIR" > "$HTML_ALIAS_LOG"
    cat "$HTML_ALIAS_LOG"
    grep -qx RESULT=PASS_R16_PUBLIC_HTML_ALIASES "$HTML_ALIAS_LOG"
    [[ -s "$HTML_ALIAS_DIR/facts-public.html" && -s "$HTML_ALIAS_DIR/verify-public.html" && -s "$HTML_ALIAS_DIR/rollback-public.html" ]]
    PUBLIC_HTML_ALIASES_CREATED=true
}

build_public_payload() {
    "$SAFE_PAYLOAD_BUILDER" "$STEP_PAYLOAD" \
      "$STEP_DIR/step-code.sh" step-code.sh \
      "$REPORT" report.txt \
      "$FACTS" facts.json \
      "$VERIFY" verify.txt \
      "$ROLLBACK" rollback.sh \
      "$HTML_ALIAS_DIR/facts-public.html" facts-public.html \
      "$HTML_ALIAS_DIR/verify-public.html" verify-public.html \
      "$HTML_ALIAS_DIR/rollback-public.html" rollback-public.html \
      "$MAIN_LOG" main.log \
      "$PROGRESS_LOG" progress.log \
      "$TRANSFER_VERIFY" transfer-verify.txt \
      "$SYSTEM_MODEL" system-model.txt \
      "$METHODS_LIMIT" methods-limitations.txt \
      "$ACCESS_ROUTES" access-routes.txt \
      "$PHASE_CURRENT" phase-current.txt \
      "$PHASE_EVENTS" phase-events.log \
      "$SNAPSHOT_LIST_LOG" pro-virtualization-snapshot-list.txt \
      "$TARGET_POSTCHECK_LOG" vm101-authoritative-postcheck.log \
      "$LINEAGE_CLASSIFICATION_LOG" r16-report-lineage-classification.txt \
      "$PUBLISHED_ARTIFACT_LOG" existing-publications-verification.txt \
      "$R06_STEP_DIR/report.txt" r06-report.txt \
      "$R06_STEP_DIR/phase-events.log" r06-phase-events.log \
      "$R06_STEP_DIR/http-verify.log" r06-http-verify.log \
      "$R06_STEP_DIR/step-publish.log" r06-step-publish.log \
      "$R06_STEP_DIR/stop-publish.log" r06-stop-publish.log \
      "$R07_STEP_DIR/report.txt" r07-latest-stop-report.txt \
      "$R07_STEP_DIR/phase-events.log" r07-latest-phase-events.log \
      > "$PAYLOAD_BUILD_LOG"
    cat "$PAYLOAD_BUILD_LOG"
    grep -qx RESULT=PASS_PUBLIC_SAFE_PAYLOAD_BUILD "$PAYLOAD_BUILD_LOG"
    [[ -f "$STEP_PAYLOAD/phase-current.txt" && ! -e "$STEP_PAYLOAD/phase-current.env" ]]
}

publish_object() {
    local label="$1" kind="$2" log="$3"
    shift 3
    local rc
    set +e
    "$PUBLISHER" "$label" "$@" > "$log" 2>&1
    rc=$?
    set -e
    cat "$log"
    router_publication_contract_load "$log" "$kind" || return 1
    [[ "$rc" -eq 0 || "$RPC_PUBLICATION_COMMITTED" == true ]]
}

sync_current_report() {
    local file name
    [[ -d "$STEP_PUBLISHED_DIR" ]] || return 1
    write_docs
    build_html_aliases
    for file in "$REPORT" "$FACTS" "$VERIFY" "$ROLLBACK" \
      "$HTML_ALIAS_DIR/facts-public.html" "$HTML_ALIAS_DIR/verify-public.html" "$HTML_ALIAS_DIR/rollback-public.html" \
      "$PHASE_CURRENT" "$PHASE_EVENTS" "$HTTP_LOG"; do
        [[ -f "$file" ]] || continue
        name="$(basename "$file")"
        [[ "$name" != phase-current.env ]] || name=phase-current.txt
        cp -a "$file" "$STEP_PUBLISHED_DIR/$name.tmp.$$"
        chmod 644 "$STEP_PUBLISHED_DIR/$name.tmp.$$"
        mv -f "$STEP_PUBLISHED_DIR/$name.tmp.$$" "$STEP_PUBLISHED_DIR/$name"
    done
    "$REINDEX" >/dev/null
}

print_final() {
    cat <<EOF_FINAL
RESULT=$RESULT
STEP_REPORT_URL=$STEP_REPORT_URL
PROJECT_SOURCE_POST_URL=$PROJECT_SOURCE_POST_URL
PROJECT_SOURCE_POST_FILE_URL=$PROJECT_SOURCE_POST_FILE_URL
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
LATEST_ROOT_URL=$LATEST_ROOT_URL
OLD_ROOT_URL=$OLD_ROOT_URL
FACTS_URL=$FACTS_URL
VERIFY_URL=$VERIFY_URL
ROLLBACK_URL=$ROLLBACK_URL
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
COLLISION_DEDUPLICATED_COUNT=$COLLISION_DEDUPLICATED_COUNT
SNAPSHOT_NAME=$SNAPSHOT_NAME
SNAPSHOT_CREATED=$SNAPSHOT_CREATED
SNAPSHOT_PROOF=$SNAPSHOT_PROOF
R06_DIRECT_FILE_HTTP_403_CLASSIFIED=$R06_DIRECT_FILE_HTTP_403_CLASSIFIED
PUBLIC_HTTP_ALIAS_POLICY=$PUBLIC_HTTP_ALIAS_POLICY
PUBLIC_HTML_ALIASES_CREATED=$PUBLIC_HTML_ALIASES_CREATED
HISTORY_COLLISION_REPAIR_COMMITTED=$HISTORY_COLLISION_REPAIR_COMMITTED
HISTORY_COLLISION_REPAIR_REPEATED=$HISTORY_COLLISION_REPAIR_REPEATED
HISTORY_FORENSIC_URL=$HISTORY_FORENSIC_URL
R06_FINAL_PASS_ARCHIVE_URL=$R06_FINAL_PASS_ARCHIVE_URL
PROJECT_SOURCE_POST_PUBLICATION_REPEATED=$PROJECT_SOURCE_POST_PUBLICATION_REPEATED
CORE_CHANGE_REPEATED=$CORE_CHANGE_REPEATED
ROUTER_MACHINE_CLOSE_RERUN=$ROUTER_MACHINE_CLOSE_RERUN
COPY_VERIFY=$COPY_VERIFY
STEP_SHA256=$STEP_SHA256
HTTP_VERIFY_PASS=$HTTP_VERIFY_PASS
TRAFFIC_INTERRUPTION=$TRAFFIC_INTERRUPTION
RUNTIME_IMPACT=$RUNTIME_IMPACT
EOF_FINAL
}

publish_stop_report_best_effort() {
    [[ -x "$PUBLISHER" ]] || return 1
    write_docs
    build_html_aliases || return 1
    build_public_payload || return 1
    local log="$STEP_DIR/stop-publish.log" rc
    set +e
    "$PUBLISHER" step050m07r16_r08_lineage_finalization_stop "$STEP_PAYLOAD"/* > "$log" 2>&1
    rc=$?
    set -e
    router_publication_contract_load "$log" step-report || return 1
    [[ "$rc" -eq 0 || "$RPC_PUBLICATION_COMMITTED" == true ]] || return 1
    STEP_PUBLISHED_DIR="$RPC_PUBLISHED_DIR"
    STEP_REPORT_URL="$RPC_PUBLIC_URL"
    PUBLIC_OBJECT_KIND="$RPC_PUBLIC_OBJECT_KIND"
    PREVIOUS_MOVED_COUNT="$RPC_PREVIOUS_MOVED_COUNT"
    COLLISION_DEDUPLICATED_COUNT="$RPC_COLLISION_DEDUPLICATED_COUNT"
    FACTS_URL="${STEP_REPORT_URL}facts-public.html"
    VERIFY_URL="${STEP_REPORT_URL}verify-public.html"
    ROLLBACK_URL="${STEP_REPORT_URL}rollback-public.html"
    STEP_REPORT_PUBLICATION_COMPLETE=true
    sync_current_report || true
}

stop_step() {
    RESULT="$1"
    STOP_REASON="${2:-unspecified}"
    router_step_phase_fail "$CURRENT_PHASE" "$STOP_REASON" || true
    write_docs
    trap - ERR
    set +e
    if [[ "$STEP_REPORT_PUBLICATION_COMPLETE" == true && -d "$STEP_PUBLISHED_DIR" ]]; then
        HTTP_VERIFY_PASS=false
        sync_current_report || true
    else
        publish_stop_report_best_effort || true
    fi
    set -e
    write_docs
    print_final
    exit 1
}

on_err() {
    local rc=$? line=$1
    if router_step_workflow_is_complete; then
        echo "LATE_ERROR_AFTER_COMPLETE=true"
        echo "LATE_ERROR_PHASE=$CURRENT_PHASE"
        echo "LATE_ERROR_LINE=$line"
        echo "LATE_ERROR_RC=$rc"
        return 0
    fi
    stop_step STOP_R16_R08_UNEXPECTED_ERROR "phase=$CURRENT_PHASE line=$line rc=$rc"
}
trap 'on_err $LINENO' ERR

phase_begin transfer_verification
ACTUAL_BUNDLE_SHA="$(sha256sum "$BUNDLE_ZIP" | awk '{print $1}')"
ACTUAL_INSTALLER_SHA="$(sha256sum "$SELF" | awk '{print $1}')"
[[ "$ACTUAL_BUNDLE_SHA" == "$EXPECTED_BUNDLE_SHA256" && "$ACTUAL_INSTALLER_SHA" == "$EXPECTED_INSTALLER_SHA256" ]] || stop_step STOP_COPY_OR_TRANSFER_ERROR sha
if [[ "${R08_SKIP_BUNDLE_MANIFEST_FOR_FIXTURE:-false}" != true ]]; then
    (cd "$BUNDLE_DIR" && sha256sum -c manifest.sha256 >/dev/null) || stop_step STOP_COPY_OR_TRANSFER_ERROR manifest
fi
cat > "$TRANSFER_VERIFY" <<EOF_TRANSFER
EXPECTED_BUNDLE_SHA256=$EXPECTED_BUNDLE_SHA256
ACTUAL_BUNDLE_SHA256=$ACTUAL_BUNDLE_SHA
EXPECTED_INSTALLER_SHA256=$EXPECTED_INSTALLER_SHA256
ACTUAL_INSTALLER_SHA256=$ACTUAL_INSTALLER_SHA
COPY_VERIFY=PASS
STEP_SHA256=$ACTUAL_INSTALLER_SHA
EOF_TRANSFER
COPY_VERIFY=PASS
phase_complete transfer_verification

phase_begin vm130_preflight
[[ "$(hostname)" == "$EXPECTED_HOSTNAME" ]] || stop_step STOP_R16_R08_VM130_HOSTNAME "$(hostname)"
for command_name in bash sh awk sed grep find sort tail head cut tr sha256sum cmp cp mv rm mkdir chmod readlink python3 git timeout; do
    command -v "$command_name" >/dev/null || stop_step STOP_R16_R08_COMMAND_MISSING "$command_name"
done
if [[ -z "${R08_SNAPSHOT_LIST_RUNNER:-}" || -z "${R08_VM101_POSTCHECK_RUNNER:-}" ]]; then
    command -v ssh >/dev/null || stop_step STOP_R16_R08_COMMAND_MISSING ssh
fi
[[ "$(sha256sum "$PUBLISHER" | awk '{print $1}')" == "$PUBLISHER_SHA" ]] || stop_step STOP_R16_R08_PUBLISHER_SHA
[[ "$(sha256sum "$HTTP_VERIFY" | awk '{print $1}')" == "$HTTP_VERIFY_SHA" ]] || stop_step STOP_R16_R08_HTTP_VERIFY_SHA
[[ "$(sha256sum "$WORKFLOW_LIB" | awk '{print $1}')" == "$WORKFLOW_SHA" ]] || stop_step STOP_R16_R08_WORKFLOW_SHA
[[ "$(sha256sum "$PUBLICATION_LIB" | awk '{print $1}')" == "$PUBLICATION_LIB_SHA" ]] || stop_step STOP_R16_R08_PUBLICATION_LIB_SHA
[[ -x "$SAFE_PAYLOAD_BUILDER" && -r "$HTML_ALIAS_BUILDER" && -r "$TARGET_POSTCHECK_SCRIPT" ]] || stop_step STOP_R16_R08_BUNDLE_HELPER
phase_complete vm130_preflight

phase_begin evidence_chain
R01_STEP_DIR="$(find_latest_step "$R01_STEP_ID")"
R02_STEP_DIR="$(find_latest_step "$R02_STEP_ID")"
R03_STEP_DIR="$(find_latest_step "$R03_STEP_ID")"
R04_STEP_DIR="$(find_latest_step "$R04_STEP_ID")"
R05_STEP_DIR="$(find_latest_step "$R05_STEP_ID")"
R06_STEP_DIR="$(find_latest_step "$R06_STEP_ID")"
R07_STEP_DIR="$(find_latest_step "$R07_STEP_ID")"
[[ -d "$R01_STEP_DIR" && -d "$R02_STEP_DIR" && -d "$R03_STEP_DIR" && -d "$R04_STEP_DIR" && -d "$R05_STEP_DIR" && -d "$R06_STEP_DIR" && -d "$R07_STEP_DIR" ]] || stop_step STOP_R16_R08_PREVIOUS_STEP_DIR_MISSING
if [[ "${R08_SKIP_PREVIOUS_INSTALLER_SHA_FOR_FIXTURE:-false}" != true ]]; then
    [[ "$(sha256sum "$R01_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R01_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R01_INSTALLER_SHA
    [[ "$(sha256sum "$R02_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R02_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R02_INSTALLER_SHA
    [[ "$(sha256sum "$R03_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R03_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R03_INSTALLER_SHA
    [[ "$(sha256sum "$R04_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R04_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R04_INSTALLER_SHA
    [[ "$(sha256sum "$R05_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R05_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R05_INSTALLER_SHA
    [[ "$(sha256sum "$R06_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R06_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R06_INSTALLER_SHA
    [[ "$(sha256sum "$R07_STEP_DIR/step-code.sh" | awk '{print $1}')" == "$R07_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R07_INSTALLER_SHA
fi
for file in target-apply.log target-postcheck.log router-machine-close.log model-publish.log methods-publish.log plan-publish.log facts.json verify.txt; do
    [[ -s "$R01_STEP_DIR/$file" ]] || stop_step STOP_R16_R08_R01_EVIDENCE_MISSING "$file"
done
grep -qx RESULT=PASS_R16_TARGET_CORE "$R01_STEP_DIR/target-apply.log" || stop_step STOP_R16_R08_R01_CORE_MARKER
grep -qx RESULT=PASS_R16_TARGET_POSTCHECK "$R01_STEP_DIR/target-postcheck.log" || stop_step STOP_R16_R08_R01_POSTCHECK_MARKER
grep -qx RESULT=PASS_ROUTER_MACHINE_CLOSE "$R01_STEP_DIR/router-machine-close.log" || stop_step STOP_R16_R08_R01_MACHINE_CLOSE_MARKER
VM101_GIT_COMMIT="$(value_from_log COMMIT "$R01_STEP_DIR/router-machine-close.log")"
VM101_GIT_TREE="$(value_from_log TREE "$R01_STEP_DIR/router-machine-close.log")"
VM101_GIT_FILE_COUNT="$(value_from_log GIT_FILE_COUNT "$R01_STEP_DIR/router-machine-close.log")"
[[ "$VM101_GIT_COMMIT" =~ ^[0-9a-f]{40}$ && "$VM101_GIT_TREE" =~ ^[0-9a-f]{40}$ && "$VM101_GIT_FILE_COUNT" =~ ^[0-9]+$ ]] || stop_step STOP_R16_R08_R01_GIT_FIELDS
SNAPSHOT_NAME="$(value_from_log SNAPSHOT_NAME "$R01_STEP_DIR/report.txt")"
[[ -n "$SNAPSHOT_NAME" && "${#SNAPSHOT_NAME}" -le 40 ]] || stop_step STOP_R16_R08_SNAPSHOT_NAME
R01_EVIDENCE_COMPLETE=true
R02_FAILURE_CLASSIFIED=true
R03_FAILURE_CLASSIFIED=true
R04_FAILURE_CLASSIFIED=true
R05_FAILURE_CLASSIFIED=true
phase_complete evidence_chain

phase_begin lineage_classification
[[ "$(value_from_log RESULT "$R06_STEP_DIR/report.txt")" == STOP_R16_R06_UNEXPECTED_ERROR ]] || stop_step STOP_R16_R08_R06_RESULT
[[ "$(value_from_log HISTORY_COLLISION_REPAIR_COMMITTED "$R06_STEP_DIR/report.txt")" == true ]] || stop_step STOP_R16_R08_R06_HISTORY_NOT_COMMITTED
[[ "$(value_from_log HTTP_VERIFY_PASS "$R06_STEP_DIR/report.txt")" == true ]] || stop_step STOP_R16_R08_R06_HTTP_NOT_COMPLETE
[[ "$(value_from_log CORE_CHANGE_REPEATED "$R06_STEP_DIR/report.txt")" == false ]] || stop_step STOP_R16_R08_R06_CORE_REPEAT
[[ -s "$R06_STEP_DIR/phase-events.log" && -s "$R06_STEP_DIR/http-verify.log" && -s "$R06_STEP_DIR/step-publish.log" && -s "$R06_STEP_DIR/stop-publish.log" ]] || stop_step STOP_R16_R08_R06_LOG_MISSING
grep -F $'final_artifact_sync\tfailed\tphase=final_artifact_sync line=774 rc=1' "$R06_STEP_DIR/phase-events.log" >/dev/null || stop_step STOP_R16_R08_R06_FINAL_SYNC_CLASSIFICATION
grep -F 'HTTP_CODE=403' "$R06_STEP_DIR/http-verify.log" >/dev/null || stop_step STOP_R16_R08_R06_HTTP_403
grep -F '/report.txt' "$R06_STEP_DIR/http-verify.log" >/dev/null || stop_step STOP_R16_R08_R06_REPORT_TXT_403
grep -qx RESULT=PASS_ROUTER_PUBLISH_REPORT "$R06_STEP_DIR/step-publish.log" || stop_step STOP_R16_R08_R06_PASS_PUBLISH
grep -qx RESULT=PASS_ROUTER_PUBLISH_REPORT "$R06_STEP_DIR/stop-publish.log" || stop_step STOP_R16_R08_R06_STOP_PUBLISH
R06_PASS_FOLDER="$(basename "$(value_from_log PUBLISHED_DIR "$R06_STEP_DIR/step-publish.log")")"
R06_STOP_FOLDER="$(basename "$(value_from_log PUBLISHED_DIR "$R06_STEP_DIR/stop-publish.log")")"
TOKEN="$(cat "$BASE/public/.router-public-token")"
PUBLIC_ROOT="$BASE/public/r/$TOKEN"
[[ -d "$PUBLIC_ROOT/old/$R06_PASS_FOLDER" ]] || stop_step STOP_R16_R08_R06_PASS_ARCHIVE_MISSING
if [[ -d "$PUBLIC_ROOT/latest/$R06_STOP_FOLDER" ]]; then
    R06_STOP_LOCATION=latest
elif [[ -d "$PUBLIC_ROOT/old/$R06_STOP_FOLDER" ]]; then
    R06_STOP_LOCATION=old
else
    stop_step STOP_R16_R08_R06_STOP_HISTORY_MISSING
fi
for file in report.txt facts.json verify.txt rollback.sh; do
    [[ -s "$PUBLIC_ROOT/old/$R06_PASS_FOLDER/$file" ]] || stop_step STOP_R16_R08_R06_PASS_FILE_MISSING "$file"
done
[[ "$(value_from_log RESULT "$PUBLIC_ROOT/old/$R06_PASS_FOLDER/report.txt")" == PASS_R16_TRANSACTIONAL_GENERATION_ACTIVATION ]] || stop_step STOP_R16_R08_R06_ARCHIVED_PASS_MARKER
[[ "$(value_from_log HTTP_VERIFY_PASS "$PUBLIC_ROOT/old/$R06_PASS_FOLDER/report.txt")" == true ]] || stop_step STOP_R16_R08_R06_ARCHIVED_HTTP_MARKER
[[ "$(value_from_log RESULT "$PUBLIC_ROOT/$R06_STOP_LOCATION/$R06_STOP_FOLDER/report.txt")" == STOP_R16_R06_UNEXPECTED_ERROR ]] || stop_step STOP_R16_R08_R06_STOP_MARKER

CURRENT_R07_STOP_REPORT_URL="$(value_from_log STEP_REPORT_URL "$R07_STEP_DIR/report.txt")"
CURRENT_R07_STOP_FOLDER="$(basename "${CURRENT_R07_STOP_REPORT_URL%/}")"
[[ "$CURRENT_R07_STOP_FOLDER" =~ ^[0-9]{8}-[0-9]{6}_step050m07r16_r07_finalization_stop$ ]] || stop_step STOP_R16_R08_R07_CURRENT_FOLDER_NAME "$CURRENT_R07_STOP_FOLDER"
[[ -d "$PUBLIC_ROOT/latest/$CURRENT_R07_STOP_FOLDER" ]] || stop_step STOP_R16_R08_R07_CURRENT_STOP_MISSING
[[ "$(value_from_log RESULT "$R07_STEP_DIR/report.txt")" == STOP_R16_R07_R06_CURRENT_STOP_MISSING ]] || stop_step STOP_R16_R08_R07_RESULT
[[ "$(value_from_log STEP_SHA256 "$R07_STEP_DIR/report.txt")" == "$R07_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R07_REPORT_INSTALLER_SHA
[[ "$(value_from_log CORE_CHANGE_REPEATED "$R07_STEP_DIR/report.txt")" == false ]] || stop_step STOP_R16_R08_R07_CORE_REPEAT
[[ "$(value_from_log RUNTIME_IMPACT "$R07_STEP_DIR/report.txt")" == false ]] || stop_step STOP_R16_R08_R07_RUNTIME_IMPACT
[[ "$(value_from_log SNAPSHOT_NAME "$R07_STEP_DIR/report.txt")" == "$SNAPSHOT_NAME" ]] || stop_step STOP_R16_R08_R08_SNAPSHOT_MISMATCH
[[ "$(value_from_log RESULT "$PUBLIC_ROOT/latest/$CURRENT_R07_STOP_FOLDER/report.txt")" == STOP_R16_R07_R06_CURRENT_STOP_MISSING ]] || stop_step STOP_R16_R08_R07_PUBLIC_RESULT
[[ "$(value_from_log STEP_SHA256 "$PUBLIC_ROOT/latest/$CURRENT_R07_STOP_FOLDER/report.txt")" == "$R07_INSTALLER_SHA" ]] || stop_step STOP_R16_R08_R07_PUBLIC_INSTALLER_SHA

HISTORY_FORENSIC_URL="$(value_from_log HISTORY_FORENSIC_URL "$R06_STEP_DIR/report.txt")"
R06_FINAL_PASS_ARCHIVE_URL="https://reports.secret-studio.ru/old/$R06_PASS_FOLDER/"
R06_STOP_REPORT_URL="https://reports.secret-studio.ru/$R06_STOP_LOCATION/$R06_STOP_FOLDER/"
R06_STOP_ARCHIVE_URL="$R06_STOP_REPORT_URL"
R06_DIRECT_FILE_HTTP_403_CLASSIFIED=true
R06_FAILURE_CLASSIFIED=true
R07_LINEAGE_CLASSIFIED=true
cat > "$LINEAGE_CLASSIFICATION_LOG" <<EOF_CLASS
RESULT=PASS_R16_R08_REPORT_LINEAGE_CLASSIFICATION
R06_STEP_DIR=$R06_STEP_DIR
R07_STEP_DIR=$R07_STEP_DIR
R06_PASS_FOLDER=$R06_PASS_FOLDER
R06_STOP_FOLDER=$R06_STOP_FOLDER
R06_STOP_LOCATION=$R06_STOP_LOCATION
CURRENT_R07_STOP_FOLDER=$CURRENT_R07_STOP_FOLDER
FINAL_ARTIFACT_SYNC_LINE=774
DIRECT_CANONICAL_FILE_HTTP_CODE=403
R06_FINAL_PASS_ARCHIVE_URL=$R06_FINAL_PASS_ARCHIVE_URL
R06_STOP_ARCHIVE_URL=$R06_STOP_ARCHIVE_URL
CURRENT_R07_STOP_REPORT_URL=$CURRENT_R07_STOP_REPORT_URL
EOF_CLASS
phase_complete lineage_classification

phase_begin snapshot_direct_verification
set +e
if [[ -n "${R08_SNAPSHOT_LIST_RUNNER:-}" ]]; then
    "$R08_SNAPSHOT_LIST_RUNNER" "$SNAPSHOT_NAME" > "$SNAPSHOT_LIST_LOG" 2>&1
    snapshot_rc=$?
else
    ssh -o BatchMode=yes pve-mgts "qm listsnapshot 101" > "$SNAPSHOT_LIST_LOG" 2>&1
    snapshot_rc=$?
fi
set -e
[[ "$snapshot_rc" -eq 0 ]] || stop_step STOP_R16_R08_SNAPSHOT_LIST_FAILED "rc=$snapshot_rc"
grep -F -- "$SNAPSHOT_NAME" "$SNAPSHOT_LIST_LOG" >/dev/null || stop_step STOP_R16_R08_SNAPSHOT_NOT_FOUND "$SNAPSHOT_NAME"
phase_complete snapshot_direct_verification

phase_begin vm101_authoritative_postcheck
set +e
if [[ -n "${R08_VM101_POSTCHECK_RUNNER:-}" ]]; then
    "$R08_VM101_POSTCHECK_RUNNER" > "$TARGET_POSTCHECK_LOG" 2>&1
    post_rc=$?
else
    ssh -o BatchMode=yes pve-mgts \
      "ssh -o BatchMode=yes -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 'sh -s'" \
      < "$TARGET_POSTCHECK_SCRIPT" > "$TARGET_POSTCHECK_LOG" 2>&1
    post_rc=$?
fi
set -e
cat "$TARGET_POSTCHECK_LOG"
[[ "$post_rc" -eq 0 ]] || stop_step STOP_R16_R08_VM101_POSTCHECK_FAILED "rc=$post_rc"
grep -qx RESULT=PASS_R16_R03_AUTHORITATIVE_POSTCHECK "$TARGET_POSTCHECK_LOG" || stop_step STOP_R16_R08_VM101_POSTCHECK_MARKER
R07_POSTCHECK_COMPLETE=true
phase_complete vm101_authoritative_postcheck

phase_begin exact_repo_verification
REPO="$BASE/state/source-repositories/wg-paid-vm101"
[[ -d "$REPO/.git" ]] || stop_step STOP_R16_R08_EXACT_REPO_MISSING
[[ "$(git -C "$REPO" rev-parse HEAD)" == "$VM101_GIT_COMMIT" ]] || stop_step STOP_R16_R08_EXACT_REPO_COMMIT
[[ "$(git -C "$REPO" rev-parse 'HEAD^{tree}')" == "$VM101_GIT_TREE" ]] || stop_step STOP_R16_R08_EXACT_REPO_TREE
[[ -z "$(git -C "$REPO" status --porcelain=v1 --untracked-files=no)" ]] || stop_step STOP_R16_R08_EXACT_REPO_DIRTY
EXACT_REPO_VERIFIED=true
phase_complete exact_repo_verification

phase_begin existing_publication_verification
for url in "$LOCAL_M07_PLAN_URL" "$PROJECT_SOURCE_POST_URL" "$VM101_PUBLIC_URL" "$VM101_MODEL_URL" "$VM101_METHODS_URL"; do
    dir="$(public_dir_for_url "$url")" || stop_step STOP_R16_R08_PUBLIC_DIR_MISSING "$url"
    [[ -f "$dir/index.html" ]] || stop_step STOP_R16_R08_PUBLIC_INDEX_MISSING "$url"
done
POST_DIR="$(public_dir_for_url "$PROJECT_SOURCE_POST_URL")"
POST_FILE="$POST_DIR/WG_PAID_MGTS_VM101_TRANSACTIONAL_GENERATION_ACTIVATION_R16.md"
[[ -s "$POST_FILE" ]] || stop_step STOP_R16_R08_POST_FILE_MISSING
PROJECT_SOURCE_POST_SHA256="$(sha256sum "$POST_FILE" | awk '{print $1}')"
PLAN_PUBLICATION_COMPLETE=true
PROJECT_SOURCE_POST_PUBLICATION_COMPLETE=true
cat > "$PUBLISHED_ARTIFACT_LOG" <<EOF_PUB
RESULT=PASS_R16_R07_EXISTING_PUBLICATIONS
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
PROJECT_SOURCE_POST_URL=$PROJECT_SOURCE_POST_URL
PROJECT_SOURCE_POST_FILE_URL=$PROJECT_SOURCE_POST_FILE_URL
PROJECT_SOURCE_POST_SHA256=$PROJECT_SOURCE_POST_SHA256
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
EOF_PUB
phase_complete existing_publication_verification

phase_begin step_report_preparation
RESULT=PASS_R16_TRANSACTIONAL_GENERATION_ACTIVATION
STOP_REASON=none
CURRENT_PHASE=step_report_preparation
write_docs
build_html_aliases || stop_step STOP_R16_R08_HTML_ALIAS_BUILD
build_public_payload || stop_step STOP_R16_R08_PUBLIC_SAFE_PAYLOAD_BUILD
phase_complete step_report_preparation

phase_begin step_report_publication
publish_object step050m07r16_transactional_generation_activation_r08_lineage_finalization step-report "$STEP_PUBLISH_LOG" "$STEP_PAYLOAD"/* || stop_step STOP_R16_R08_STEP_REPORT_PUBLICATION
STEP_PUBLISHED_DIR="$RPC_PUBLISHED_DIR"
STEP_REPORT_URL="$RPC_PUBLIC_URL"
PUBLIC_OBJECT_KIND="$RPC_PUBLIC_OBJECT_KIND"
PREVIOUS_MOVED_COUNT="$RPC_PREVIOUS_MOVED_COUNT"
COLLISION_DEDUPLICATED_COUNT="$RPC_COLLISION_DEDUPLICATED_COUNT"
FACTS_URL="${STEP_REPORT_URL}facts-public.html"
VERIFY_URL="${STEP_REPORT_URL}verify-public.html"
ROLLBACK_URL="${STEP_REPORT_URL}rollback-public.html"
STEP_REPORT_PUBLICATION_COMPLETE=true
sync_current_report || stop_step STOP_R16_R08_INITIAL_REPORT_SYNC
phase_complete step_report_publication

phase_begin external_http_verification
RESULT=PASS_R16_TRANSACTIONAL_GENERATION_ACTIVATION
STOP_REASON=none
HTTP_VERIFY_PASS=true
write_docs
build_html_aliases
sync_current_report
: > "$HTTP_LOG"
"$HTTP_VERIFY" --url "$PROJECT_SOURCE_POST_FILE_URL" --output "$STEP_DIR/http-project-source-post.md" --sha256 "$PROJECT_SOURCE_POST_SHA256" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$LOCAL_M07_PLAN_URL" --output "$STEP_DIR/http-plan-index.html" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$VM101_PUBLIC_URL" --output "$STEP_DIR/http-vm101-source-index.html" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$VM101_MODEL_URL" --output "$STEP_DIR/http-model-index.html" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$VM101_METHODS_URL" --output "$STEP_DIR/http-methods-index.html" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$STEP_REPORT_URL" --output "$STEP_DIR/http-step-index.html" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$FACTS_URL" --output "$STEP_DIR/http-facts-public.html" --sha256 "$(sha256sum "$HTML_ALIAS_DIR/facts-public.html" | awk '{print $1}')" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$VERIFY_URL" --output "$STEP_DIR/http-verify-public.html" --sha256 "$(sha256sum "$HTML_ALIAS_DIR/verify-public.html" | awk '{print $1}')" >> "$HTTP_LOG" 2>&1
"$HTTP_VERIFY" --url "$ROLLBACK_URL" --output "$STEP_DIR/http-rollback-public.html" --sha256 "$(sha256sum "$HTML_ALIAS_DIR/rollback-public.html" | awk '{print $1}')" >> "$HTTP_LOG" 2>&1
phase_complete external_http_verification
router_step_workflow_mark_complete
CURRENT_PHASE=complete
RESULT=PASS_R16_TRANSACTIONAL_GENERATION_ACTIVATION
STOP_REASON=none
HTTP_VERIFY_PASS=true
write_docs
build_html_aliases
set +e
sync_current_report
FINAL_SYNC_RC=$?
set -e
if [[ "$FINAL_SYNC_RC" -ne 0 ]]; then
    echo "LATE_FINAL_SYNC_WARNING=true"
    echo "LATE_FINAL_SYNC_RC=$FINAL_SYNC_RC"
fi
print_final