#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"

STEP='STEP_050M07R20QW_R02_READONLY_AUDIT_PUBLICATION_CONTINUATION'
REVISION='R02'
PREVIOUS_STEP='STEP_050M07R20QW_R01_MULTI_PROTOCOL_READONLY_AUDIT'
REAL_PREVIOUS_RUN='/opt/router-ops/state/detached-step-runs/STEP_050M07R20QW_R01_MULTI_PROTOCOL_READONLY_AUDIT/runs/20260802-101459-709766-10154'

WORK="$RUN_DIR/work"
REPORT="$RUN_DIR/report"
PAYLOAD="$RUN_DIR/public-payload"
CURRENT="$RUN_DIR/workflow-current.txt"
EVENTS="$RUN_DIR/workflow-events.tsv"
FINAL_ENV="$RUN_DIR/final-publication.env"
mkdir -p "$WORK" "$REPORT" "$PAYLOAD" "$INCOMING"
chmod 700 "$WORK" "$REPORT" "$PAYLOAD"

source "$BASE/lib/router-step-workflow.sh"
router_step_workflow_init "$CURRENT" "$EVENTS" verify_retained_evidence report_publish archive

LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
PUBLIC_URL=not_published
STOP_HANDLED=false

write_child() {
    local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
    {
        echo "RESULT=$result"
        echo "WORKER_RC=$rc"
        echo "CORE_CHANGE_COMPLETE=false"
        echo "RUNTIME_IMPACT=false"
        echo "DIAGNOSTICS_REPEATED=false"
        echo "ROLLBACK_STATUS=not_applicable_publication_only"
        echo "STEP_REPORT_URL=$PUBLIC_URL"
        echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
        echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
    } >"$tmp"
    chmod 600 "$tmp"
    mv -f "$tmp" "$CHILD_RESULT"
}

archive_latest() {
    local log="$RUN_DIR/archive-latest.log"
    router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
    LATEST_ARCHIVE="$(awk -F= '$1=="LATEST_ARCHIVE"{print substr($0,index($0,"=")+1)}' "$log" | tail -n1)"
    LATEST_ARCHIVE_SHA256="$(awk -F= '$1=="LATEST_ARCHIVE_SHA256"{print $2}' "$log" | tail -n1)"
}

stop_handler() {
    local rc="$1" line="$2" command="$3"
    trap - ERR
    [[ "$STOP_HANDLED" == false ]] || exit "$rc"
    STOP_HANDLED=true
    set +e
    {
        echo 'RESULT=STOP_R20QW_READONLY_AUDIT_PUBLICATION_CONTINUATION'
        echo "REVISION=$REVISION"
        echo "STOP_LINE=$line"
        echo "STOP_RC=$rc"
        printf 'STOP_COMMAND=%q\n' "$command"
        echo 'CORE_CHANGE_COMPLETE=false'
        echo 'RUNTIME_IMPACT=false'
        echo 'DIAGNOSTICS_REPEATED=false'
        echo "PREVIOUS_RUN_DIR=$PREVIOUS_RUN"
    } | tee "$RUN_DIR/stop.txt"
    archive_latest >/dev/null 2>&1 || true
    write_child STOP_R20QW_READONLY_AUDIT_PUBLICATION_CONTINUATION "$rc"
    exit "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"' ERR

if [[ "$SELFTEST" == true ]]; then
    PREVIOUS_RUN="$WORK/previous-run"
    mkdir -p "$PREVIOUS_RUN/evidence" "$PREVIOUS_RUN/report"
    cat >"$PREVIOUS_RUN/evidence/vm121-audit.stdout.txt" <<'EOF'
RESULT=PASS_R20QW_VM121_READONLY_AUDIT
BACKEND_HEALTH=PASS
DB_HEALTH=PASS
EOF
    cat >"$PREVIOUS_RUN/evidence/vm100-audit.stdout.txt" <<'EOF'
RESULT=PASS_R20QW_VM100_READONLY_AUDIT
AMNEZIAWG_CLI_PRESENT=true
EOF
    cat >"$PREVIOUS_RUN/evidence/vm101-audit.stdout.txt" <<'EOF'
RESULT=PASS_R20QW_VM101_READONLY_AUDIT
WG_PAID_DNAT_PRESENT=true
EOF
    cat >"$PREVIOUS_RUN/report/current-state-gap-register.txt" <<'EOF'
Selftest current-state gap register.
EOF
    cat >"$PREVIOUS_RUN/report/facts.json" <<'EOF'
{"result":"PASS_R20QW_MULTI_PROTOCOL_READONLY_AUDIT","runtime_impact":false}
EOF
    cat >"$PREVIOUS_RUN/workflow-current.txt" <<'EOF'
preflight=complete
audit=complete
report_build=complete
report_publish=failed
archive=pending
PUBLICATION_BARRIER=none
WORKFLOW_RESULT=running
EOF
    cat >"$PREVIOUS_RUN/result.env" <<'EOF'
RESULT=STOP_R20QW_MULTI_PROTOCOL_READONLY_AUDIT
CORE_CHANGE_COMPLETE=false
EOF
else
    PREVIOUS_RUN="$REAL_PREVIOUS_RUN"
fi

router_step_phase_begin verify_retained_evidence
[[ -d "$PREVIOUS_RUN" ]]
for pair in \
    'vm121-audit.stdout.txt:PASS_R20QW_VM121_READONLY_AUDIT' \
    'vm100-audit.stdout.txt:PASS_R20QW_VM100_READONLY_AUDIT' \
    'vm101-audit.stdout.txt:PASS_R20QW_VM101_READONLY_AUDIT'
do
    file="${pair%%:*}"
    marker="${pair#*:}"
    grep -Fqx "RESULT=$marker" "$PREVIOUS_RUN/evidence/$file"
done
grep -Fqx 'preflight=complete' "$PREVIOUS_RUN/workflow-current.txt"
grep -Fqx 'audit=complete' "$PREVIOUS_RUN/workflow-current.txt"
grep -Fqx 'report_build=complete' "$PREVIOUS_RUN/workflow-current.txt"
grep -Fqx 'report_publish=failed' "$PREVIOUS_RUN/workflow-current.txt"
grep -Fqx 'CORE_CHANGE_COMPLETE=false' "$PREVIOUS_RUN/result.env"
[[ -f "$PREVIOUS_RUN/report/current-state-gap-register.txt" ]]
[[ -f "$PREVIOUS_RUN/report/facts.json" ]]
tar -tzf "$ROOT/payload/publication-inputs.tar.gz" >/dev/null
rm -rf "$WORK/architecture"
mkdir -p "$WORK/architecture"
tar -xzf "$ROOT/payload/publication-inputs.tar.gz" -C "$WORK/architecture"
router_step_phase_complete verify_retained_evidence previous_pass_evidence_reused_without_diagnostics

cp "$PREVIOUS_RUN/evidence/vm121-audit.stdout.txt" "$REPORT/vm121-audit.txt"
cp "$PREVIOUS_RUN/evidence/vm100-audit.stdout.txt" "$REPORT/vm100-audit.txt"
cp "$PREVIOUS_RUN/evidence/vm101-audit.stdout.txt" "$REPORT/vm101-audit.txt"
cp "$PREVIOUS_RUN/report/current-state-gap-register.txt" "$REPORT/current-state-gap-register.txt"
cp "$PREVIOUS_RUN/report/facts.json" "$REPORT/previous-audit-facts.json"
cp "$PREVIOUS_RUN/workflow-current.txt" "$REPORT/previous-workflow-current.txt"
cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-continuation.sh"

cat >"$REPORT/report.txt" <<EOF
RESULT=PASS_R20QW_MULTI_PROTOCOL_READONLY_AUDIT_PUBLICATION_CONTINUATION
REVISION=R02
CLASSIFICATION=PUBLICATION_CONTINUATION
PREVIOUS_STEP=$PREVIOUS_STEP
PREVIOUS_RUN_DIR=$PREVIOUS_RUN
FIRST_UNFINISHED_PHASE=report_publish
VM121_AUDIT=PASS
VM100_AUDIT=PASS
VM101_AUDIT=PASS
DIAGNOSTICS_REPEATED=false
CORE_CHANGE_COMPLETE=false
RUNTIME_IMPACT=false
ROLLBACK_STATUS=not_applicable_publication_only
PROJECT_SOURCE_PUBLISHED=false
ARCHITECTURE_V2_STATUS=draft_pending_review
NEXT_ACTION=review audit and publish canonical VM121 multi-protocol Project Sources
EOF
cp "$REPORT/report.txt" "$REPORT/verify.txt"
printf 'No runtime change. Rollback is not applicable.\n' >"$REPORT/rollback.txt"

# Flat, policy-safe aliases. No nested output names are used.
cp "$WORK/architecture/README.md" \
   "$REPORT/architecture-v2-readme.md"
cp "$WORK/architecture/WG_PAID_MGTS_VM121_ARCHITECTURE_PLAN_V2.md" \
   "$REPORT/vm121-architecture-plan-v2.md"
cp "$WORK/architecture/WG_PAID_MGTS_MULTI_PROTOCOL_ACCESS_AND_QUOTA_MODEL_V1.md" \
   "$REPORT/multi-protocol-access-quota-model-v1.md"
cp "$WORK/architecture/WG_PAID_MGTS_VM100_VM101_VM121_RESPONSIBILITY_CONTRACT_V2.md" \
   "$REPORT/vm100-vm101-vm121-responsibility-contract-v2.md"
cp "$WORK/architecture/WG_PAID_MGTS_VM121_DOMAIN_MODEL_AND_SECURITY_V2.md" \
   "$REPORT/vm121-domain-model-security-v2.md"
cp "$WORK/architecture/WG_PAID_MGTS_VM121_USER_FLOWS_AND_API_V2.md" \
   "$REPORT/vm121-user-flows-api-v2.md"
cp "$WORK/architecture/WG_PAID_MGTS_VM121_ROADMAP_AND_STEP_MATRIX_V2.md" \
   "$REPORT/vm121-roadmap-step-matrix-v2.md"
cp "$WORK/architecture/WG_PAID_MGTS_MULTI_PROTOCOL_TEST_STANDARD_V1.md" \
   "$REPORT/multi-protocol-test-standard-v1.md"
cp "$WORK/architecture/WG_PAID_MGTS_READONLY_AUDIT_SCOPE_VM121_VM100_VM101_V1.md" \
   "$REPORT/readonly-audit-scope-vm121-vm100-vm101-v1.md"

router_step_phase_begin report_publish
pairs=()
while IFS= read -r file; do
    pairs+=("$file" "$(basename "$file")")
done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)

if [[ "$SELFTEST" == true ]]; then
    "$BASE/bin/router-public-safe-payload" "$PAYLOAD" "${pairs[@]}"
    DEST="${ROUTER_PUBLIC_ROOT:?}/latest/r20qw-r02-publication-continuation-selftest"
    rm -rf "$DEST"
    mkdir -p "$DEST"
    cp -a "$PAYLOAD"/. "$DEST"/
    printf '<html><body>selftest</body></html>\n' >"$DEST/index.html"
    PUBLIC_URL='selftest://r20qw-r02-publication-continuation-selftest/'
else
    router_step_publish_payload \
        step050m07r20qw_r02_readonly_audit_publication_continuation \
        "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" \
        "${pairs[@]}"
    PUBLIC_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$FINAL_ENV" | tail -n1)"
fi
router_step_phase_complete report_publish flat_publication_completed

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_archive_created
router_step_workflow_mark_complete

trap - ERR
write_child PASS_R20QW_MULTI_PROTOCOL_READONLY_AUDIT_PUBLICATION_CONTINUATION 0
cat "$REPORT/report.txt"
echo "STEP_REPORT_URL=$PUBLIC_URL"
echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"