#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
STEP=STEP_050M07R20QZB_R09_VM100_EMPTY_REGISTRY_SEMANTICS_HARDENING_BACKUP_TRANSPORT_FIX
CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$INCOMING"; chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD"
source "$BASE/lib/router-step-workflow.sh"
router_step_workflow_init "$CURRENT" "$EVENTS" preflight backup apply postcheck source_publish report_publish archive
CORE_CHANGE_COMPLETE=false; ROLLBACK_STATUS=not_required; STOP_DETAIL=unknown; STOP_HANDLED=false; BACKUP_READY=false
LATEST_ARCHIVE=not_created; LATEST_ARCHIVE_SHA256=unknown; STEP_REPORT_URL=unknown; VM100_PUBLIC_URL=unknown
SYNTHETIC_ZERO_TO_ONE_TO_ZERO=unknown
BASE_LIB_SHA256=5abd7a0a4d506c6f4187375c5ef6dfd2bf0b6945e7c15ff47d7109345aa2ee94
TS="$(date -u +%Y%m%d-%H%M%S)"; VM100_BACKUP="/root/router-ops-backups/r20qzb-empty-registry-r09-$TS"
write_child(){ local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"; { echo RESULT="$result"; echo WORKER_RC="$rc"; echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"; echo ROLLBACK_STATUS="$ROLLBACK_STATUS"; echo STOP_DETAIL="$STOP_DETAIL"; echo SYNTHETIC_ZERO_TO_ONE_TO_ZERO="$SYNTHETIC_ZERO_TO_ONE_TO_ZERO"; echo VM100_PUBLIC_URL="$VM100_PUBLIC_URL"; echo STEP_REPORT_URL="$STEP_REPORT_URL"; echo LATEST_ARCHIVE="$LATEST_ARCHIVE"; echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"; } > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$CHILD_RESULT"; }
archive_latest(){ local log="$EVIDENCE/archive.log"; router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"; LATEST_ARCHIVE="$(awk -F= '$1=="LATEST_ARCHIVE"{print substr($0,index($0,"=")+1)}' "$log" | tail -n1)"; LATEST_ARCHIVE_SHA256="$(awk -F= '$1=="LATEST_ARCHIVE_SHA256"{print $2}' "$log" | tail -n1)"; }
vm100(){ local cmd="${1:?}"; ssh -T -o BatchMode=yes -o ConnectTimeout=20 pve-mgts "ssh -T -i /root/.ssh/pve_to_openwrt_mgts_ed25519 -o BatchMode=yes -o ConnectTimeout=20 root@10.71.100.1 /bin/sh -s" <<<"$cmd"; }
vm100_stream(){ local action="${1:?}"; case "$action" in backup|restore) ;; *) return 64;; esac; ssh -T -o BatchMode=yes -o ConnectTimeout=20 pve-mgts "ssh -T -i /root/.ssh/pve_to_openwrt_mgts_ed25519 -o BatchMode=yes -o ConnectTimeout=20 root@10.71.100.1 /bin/sh -s -- $action"; }
emit_backup_restore_script(){
  case "$VM100_BACKUP" in ''|*[!A-Za-z0-9_./-]*) return 64;; esac
  printf 'ROUTER_BACKUP_DIR=%s\n' "$VM100_BACKUP"
  printf 'ROUTER_EXPECTED_LIB_SHA256=%s\n' "$BASE_LIB_SHA256"
  printf 'ROUTER_PRE_LIB_MODE=644\n'
  cat "$ROOT/scripts/vm100-backup-restore.sh"
}
vm100_put(){ local src="$1" dst="$2" mode="$3"; ssh -T -o BatchMode=yes -o ConnectTimeout=20 pve-mgts "ssh -T -i /root/.ssh/pve_to_openwrt_mgts_ed25519 -o BatchMode=yes -o ConnectTimeout=20 root@10.71.100.1 'umask 077; cat > ${dst}.r20qzb-new; chmod $mode ${dst}.r20qzb-new; mv ${dst}.r20qzb-new $dst'" < "$src"; }
rollback_now(){
  [ "$BACKUP_READY" = true ] || return 0
  if [[ "$SELFTEST" == true ]]; then ROLLBACK_STATUS=PASS; return 0; fi
  local rc=0
  : > "$EVIDENCE/rollback-verify.txt"
  vm100 "$(cat <<'SH'
set -eu
SYN_IP=10.253.255.254/32
syn=$(wg show wg_paid allowed-ips 2>/dev/null | awk -v ip="$SYN_IP" '$2==ip{print $1; exit}')
[ -z "$syn" ] || wg set wg_paid peer "$syn" remove
SH
)" >> "$EVIDENCE/rollback-verify.txt" 2>&1 || rc=$?
  if [[ "$rc" -eq 0 ]]; then
    emit_backup_restore_script | vm100_stream restore >> "$EVIDENCE/rollback-verify.txt" 2>&1 || rc=$?
  fi
  if [[ "$rc" -eq 0 ]]; then
    vm100 "$(cat <<'SH'
set -eu
/usr/local/sbin/router-wgpay-canary-apply.sh start >/dev/null 2>&1 || true
/usr/local/sbin/router-egress-activity-apply.sh >/dev/null 2>&1 || true
[ "$(stat -c %a /usr/local/lib/router-wgpay-peer-lifecycle-lib.sh)" = 644 ]
[ "$(wg show wg_paid peers 2>/dev/null | awk 'NF{n++} END{print n+0}')" -eq 0 ]
[ "$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/peers.conf 2>/dev/null | wc -l | tr -d ' ')" -eq 0 ]
[ "$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/canonical.conf 2>/dev/null | wc -l | tr -d ' ')" -eq 0 ]
echo RESULT=PASS_R20QZB_R09_ROLLBACK_VERIFIED_PRESTATE
SH
)" >> "$EVIDENCE/rollback-verify.txt" 2>&1 || rc=$?
  fi
  if [[ "$rc" -eq 0 ]] && grep -Fqx 'RESULT=PASS_R20QZB_R09_VM100_RESTORE_FILES' "$EVIDENCE/rollback-verify.txt" && grep -Fqx 'RESULT=PASS_R20QZB_R09_ROLLBACK_VERIFIED_PRESTATE' "$EVIDENCE/rollback-verify.txt"; then ROLLBACK_STATUS=PASS; else ROLLBACK_STATUS=FAILED; fi
}
stop_handler(){ local rc="$1" line="$2" cmd="$3"; trap - ERR; [[ "$STOP_HANDLED" == false ]] || exit "$rc"; STOP_HANDLED=true; if [[ "$CORE_CHANGE_COMPLETE" != true ]]; then rollback_now; else ROLLBACK_STATUS=not_required; fi; { echo RESULT=STOP_R20QZB_VM100_EMPTY_REGISTRY_SEMANTICS_HARDENING; echo STOP_RC="$rc"; echo STOP_LINE="$line"; printf 'STOP_COMMAND=%q\n' "$cmd"; echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"; echo ROLLBACK_STATUS="$ROLLBACK_STATUS"; echo STOP_DETAIL="$STOP_DETAIL"; } | tee "$REPORT/stop.txt" "$EVIDENCE/stop.txt"; set +e; archive_latest >/dev/null 2>&1; set -e; write_child STOP_R20QZB_VM100_EMPTY_REGISTRY_SEMANTICS_HARDENING "$rc"; exit "$rc"; }
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"' ERR

router_step_phase_begin preflight
"$ROOT/scripts/target-apply.sh" "$(awk '{print $1}' "$ROOT/reference/target-package.sha256")" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"
if [[ "$SELFTEST" == true ]]; then
cat > "$EVIDENCE/preflight.txt" <<'EOF'
HEAD=c401f82a64eb31c8b1b5d7746abea33dcab3140a
TREE=7e944b738c77eb9f222300fe6d31e25be910f4f5
HEAD_WORKTREE_DIFF_RC=1
HEAD_WORKTREE_DIFF_NAMES=usr/local/lib/router-wgpay-peer-lifecycle-lib.sh
STATUS_COUNT=1
HEAD_LIB_SHA256=5abd7a0a4d506c6f4187375c5ef6dfd2bf0b6945e7c15ff47d7109345aa2ee94
FS_LIB_SHA256=5abd7a0a4d506c6f4187375c5ef6dfd2bf0b6945e7c15ff47d7109345aa2ee94
FS_LIB_MODE=644
initialized=true
registry_valid=false
profile_count=0
wireguard_count=0
amneziawg_count=0
selector_registry_consistent=false
runtime_peer_count=0
selector_count=0
canonical_count=0
RESULT=PASS_R20QZB_R09_PREFLIGHT
EOF
else
vm100 "$(cat <<'SH'
set -u
G=/root/.vm100-source.git
P=usr/local/lib/router-wgpay-peer-lifecycle-lib.sh
echo HEAD=$(git --git-dir="$G" rev-parse HEAD)
echo TREE=$(git --git-dir="$G" rev-parse HEAD^{tree})
wd=0; git --git-dir="$G" --work-tree=/ diff HEAD --quiet -- || wd=$?
echo HEAD_WORKTREE_DIFF_RC=$wd
echo HEAD_WORKTREE_DIFF_NAMES=$(git --git-dir="$G" --work-tree=/ diff HEAD --name-only -- | awk 'BEGIN{first=1}{if(!first)printf ","; printf "%s",$0; first=0}END{print ""}')
echo STATUS_COUNT=$(git --git-dir="$G" --work-tree=/ status --porcelain --untracked-files=no | wc -l | tr -d ' ')
echo HEAD_LIB_SHA256=$(git --git-dir="$G" show HEAD:"$P" | sha256sum | awk '{print $1}')
echo FS_LIB_SHA256=$(sha256sum /"$P" | awk '{print $1}')
echo FS_LIB_MODE=$(stat -c '%a' /"$P")
/usr/local/sbin/router-wgpay-peer-lifecycle.sh --status
echo runtime_peer_count=$(wg show wg_paid peers 2>/dev/null | awk 'NF{n++} END{print n+0}')
echo selector_count=$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/peers.conf 2>/dev/null | wc -l | tr -d ' ')
echo canonical_count=$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/canonical.conf 2>/dev/null | wc -l | tr -d ' ')
echo RESULT=PASS_R20QZB_R09_PREFLIGHT
SH
)" > "$EVIDENCE/preflight.txt" 2>&1
fi
preflight_require(){
  local key="$1" expected="$2" actual
  actual="$(awk -F= -v k="$key" '$1==k{print substr($0,index($0,"=")+1); exit}' "$EVIDENCE/preflight.txt")"
  if [[ "$actual" == "$expected" ]]; then
    echo "PREFLIGHT_${key}=PASS value=$actual" >> "$EVIDENCE/preflight-checks.txt"
  else
    echo "PREFLIGHT_${key}=FAIL expected=$expected actual=${actual:-missing}" >> "$EVIDENCE/preflight-checks.txt"
    STOP_DETAIL="preflight_${key}"
    false
  fi
}
: > "$EVIDENCE/preflight-checks.txt"
preflight_require HEAD c401f82a64eb31c8b1b5d7746abea33dcab3140a
preflight_require TREE 7e944b738c77eb9f222300fe6d31e25be910f4f5
preflight_require HEAD_WORKTREE_DIFF_RC 1
preflight_require HEAD_WORKTREE_DIFF_NAMES usr/local/lib/router-wgpay-peer-lifecycle-lib.sh
preflight_require STATUS_COUNT 1
preflight_require HEAD_LIB_SHA256 5abd7a0a4d506c6f4187375c5ef6dfd2bf0b6945e7c15ff47d7109345aa2ee94
preflight_require FS_LIB_SHA256 5abd7a0a4d506c6f4187375c5ef6dfd2bf0b6945e7c15ff47d7109345aa2ee94
preflight_require FS_LIB_MODE 644
preflight_require initialized true
preflight_require profile_count 0
preflight_require runtime_peer_count 0
preflight_require selector_count 0
preflight_require canonical_count 0
echo RESULT=PASS_R20QZB_R09_PREFLIGHT_CHECKS >> "$EVIDENCE/preflight-checks.txt"
router_step_phase_complete preflight exact_r01_mode_only_residue_and_empty_runtime_confirmed

router_step_phase_begin backup
if [[ "$SELFTEST" == true ]]; then BACKUP_READY=true; echo RESULT=PASS_R20QZB_R09_BACKUP_SELFTEST > "$EVIDENCE/backup.txt"; else
STOP_DETAIL=backup_remote
emit_backup_restore_script | vm100_stream backup > "$EVIDENCE/backup.txt" 2>&1
grep -Fqx 'RESULT=PASS_R20QZB_R09_VM100_BACKUP' "$EVIDENCE/backup.txt" || { STOP_DETAIL=backup_verify; false; }
BACKUP_READY=true
fi
router_step_phase_complete backup affected_source_and_dynamic_state_backed_up_with_metadata

router_step_phase_begin apply
if [[ "$SELFTEST" == true ]]; then
cat > "$EVIDENCE/after-lib-install.txt" <<'EOF'
registry_valid=true
profile_count=0
selector_registry_consistent=true
RESULT=PASS_PEER_LIFECYCLE_STATUS
EOF
cat > "$EVIDENCE/live-zero-one-zero.txt" <<'EOF'
PROOF_STAGE=workspace_ready
PROOF_STAGE=enable_returned
PROOF_STAGE=mid_status_pass
PROOF_STAGE=disable_returned
registry_valid=true
profile_count=0
selector_registry_consistent=true
runtime_peer_count=0
selector_count=0
canonical_count=0
PROOF_STAGE=final_status
RESULT=PASS_R20QZB_LIVE_ZERO_ONE_ZERO
EOF
SYNTHETIC_ZERO_TO_ONE_TO_ZERO=PASS
else
STOP_DETAIL=vm100_lib_install
vm100_put "$TARGET_DIR/vm100/usr/local/lib/router-wgpay-peer-lifecycle-lib.sh" /usr/local/lib/router-wgpay-peer-lifecycle-lib.sh 775
STOP_DETAIL=post_install_status_remote
vm100 'set -eu; [ "$(stat -c %a /usr/local/lib/router-wgpay-peer-lifecycle-lib.sh)" = 775 ]; sh -n /usr/local/lib/router-wgpay-peer-lifecycle-lib.sh; /usr/local/sbin/router-wgpay-peer-lifecycle.sh --status' > "$EVIDENCE/after-lib-install.txt" 2>&1
grep -Fqx 'registry_valid=true' "$EVIDENCE/after-lib-install.txt" || { STOP_DETAIL=empty_registry_still_invalid; false; }
grep -Fqx 'profile_count=0' "$EVIDENCE/after-lib-install.txt" || { STOP_DETAIL=empty_profile_count; false; }
grep -Fqx 'selector_registry_consistent=true' "$EVIDENCE/after-lib-install.txt" || { STOP_DETAIL=empty_selector_registry; false; }
STOP_DETAIL=live_zero_one_zero_remote
vm100 "$(cat <<'SH'
set -eu
umask 077
W=/tmp/r20qzb-zero-proof.$$
mkdir -p "$W"
trap 'rm -rf "$W"' EXIT INT TERM
echo PROOF_STAGE=workspace_ready
priv=$(wg genkey)
pub=$(printf '%s' "$priv" | wg pubkey)
wg genpsk > "$W/psk"
now=$(date +%s)
cat > "$W/enable.req" <<EOF
operation_id=r20qzb-zero-enable-$now
profile_id=r20qzb-zero-proof
protocol=wireguard
public_key=$pub
tunnel_ip=10.253.255.254
desired_generation=$now
EOF
/usr/local/sbin/router-wgpay-peer-lifecycle.sh --enable "$W/enable.req" "$W/psk" > "$W/enable.out"
echo PROOF_STAGE=enable_returned
grep -Eq '^(RESULT|result)=PASS_PEER_ENABLE$' "$W/enable.out"
wg show wg_paid allowed-ips | grep -F '10.253.255.254/32' >/dev/null
/usr/local/sbin/router-wgpay-peer-lifecycle.sh --status > "$W/mid.status"
grep -Fqx profile_count=1 "$W/mid.status"
echo PROOF_STAGE=mid_status_pass
cat > "$W/disable.req" <<EOF
operation_id=r20qzb-zero-disable-$now
profile_id=r20qzb-zero-proof
desired_generation=$now
EOF
/usr/local/sbin/router-wgpay-peer-lifecycle.sh --disable "$W/disable.req" > "$W/disable.out"
echo PROOF_STAGE=disable_returned
grep -Eq '^(RESULT|result)=PASS_PEER_DISABLE$' "$W/disable.out"
! wg show wg_paid allowed-ips | grep -F '10.253.255.254/32' >/dev/null
rm -f /etc/router-wgpay-peer-state/receipts/r20qzb-zero-enable-$now.kv /etc/router-wgpay-peer-state/receipts/r20qzb-zero-disable-$now.kv
/usr/local/sbin/router-wgpay-peer-lifecycle.sh --status
echo PROOF_STAGE=final_status
echo runtime_peer_count=$(wg show wg_paid peers 2>/dev/null | awk 'NF{n++} END{print n+0}')
echo selector_count=$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/peers.conf | wc -l | tr -d ' ')
echo canonical_count=$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/canonical.conf | wc -l | tr -d ' ')
echo RESULT=PASS_R20QZB_LIVE_ZERO_ONE_ZERO
SH
)" > "$EVIDENCE/live-zero-one-zero.txt" 2>&1
grep -Fqx 'PROOF_STAGE=enable_returned' "$EVIDENCE/live-zero-one-zero.txt" || { STOP_DETAIL=synthetic_enable_not_returned; false; }
grep -Fqx 'PROOF_STAGE=mid_status_pass' "$EVIDENCE/live-zero-one-zero.txt" || { STOP_DETAIL=synthetic_mid_status; false; }
grep -Fqx 'PROOF_STAGE=disable_returned' "$EVIDENCE/live-zero-one-zero.txt" || { STOP_DETAIL=synthetic_disable_not_returned; false; }
for x in 'registry_valid=true' 'profile_count=0' 'selector_registry_consistent=true' 'runtime_peer_count=0' 'selector_count=0' 'canonical_count=0' 'RESULT=PASS_R20QZB_LIVE_ZERO_ONE_ZERO'; do grep -Fqx "$x" "$EVIDENCE/live-zero-one-zero.txt" || { STOP_DETAIL=synthetic_final_invariant; false; }; done
SYNTHETIC_ZERO_TO_ONE_TO_ZERO=PASS
fi
router_step_phase_complete apply empty_registry_semantics_fixed_and_zero_to_one_to_zero_proven

router_step_phase_begin postcheck
STOP_DETAIL=postcheck_remote
if [[ "$SELFTEST" == true ]]; then cat > "$EVIDENCE/postcheck.txt" <<'EOF'
registry_valid=true
profile_count=0
selector_registry_consistent=true
runtime_peer_count=0
selector_count=0
canonical_count=0
RESULT=PASS_R20QZB_R09_POSTCHECK
EOF
else vm100 "$(cat <<'SH'
set -eu
/usr/local/sbin/router-wgpay-peer-lifecycle.sh --status
echo runtime_peer_count=$(wg show wg_paid peers 2>/dev/null | awk 'NF{n++} END{print n+0}')
echo selector_count=$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/peers.conf | wc -l | tr -d ' ')
echo canonical_count=$(grep -Ev '^[[:space:]]*(#|$)' /etc/router-wgpay-peer-state/canonical.conf | wc -l | tr -d ' ')
echo RESULT=PASS_R20QZB_R09_POSTCHECK
SH
)" > "$EVIDENCE/postcheck.txt" 2>&1; fi
for x in 'registry_valid=true' 'profile_count=0' 'selector_registry_consistent=true' 'runtime_peer_count=0' 'selector_count=0' 'canonical_count=0' 'RESULT=PASS_R20QZB_R09_POSTCHECK'; do grep -Fqx "$x" "$EVIDENCE/postcheck.txt" || { STOP_DETAIL=postcheck; false; }; done
CORE_CHANGE_COMPLETE=true; BACKUP_READY=false; ROLLBACK_STATUS=not_required
router_step_phase_complete postcheck empty_state_valid_and_runtime_unchanged

router_step_phase_begin source_publish
STOP_DETAIL=source_publish
if [[ "$SELFTEST" == true ]]; then cat > "$EVIDENCE/vm100-machine-close.txt" <<'EOF'
RESULT=PASS_ROUTER_MACHINE_CLOSE
COMMIT=1111111111111111111111111111111111111111
TREE=2222222222222222222222222222222222222222
GIT_FILE_COUNT=33
VM100_PUBLIC_URL=selftest://vm100-source/
EOF
VM100_PUBLIC_URL=selftest://vm100-source/
else "$BASE/bin/router-machine-close-safe" vm100 'STEP_050M07R20QZB_R09: empty registry semantics; backup transport fix; zero-to-one-to-zero proof' > "$EVIDENCE/vm100-machine-close.txt" 2>&1; grep -Fqx 'RESULT=PASS_ROUTER_MACHINE_CLOSE' "$EVIDENCE/vm100-machine-close.txt" || { STOP_DETAIL=vm100_machine_close; false; }; VM100_PUBLIC_URL="$(awk -F= '$1=="VM100_PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$EVIDENCE/vm100-machine-close.txt" | tail -n1)"; fi
router_step_phase_complete source_publish vm100_machine_git_closed_and_published

cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_R20QZB_VM100_EMPTY_REGISTRY_SEMANTICS_HARDENED
REVISION=R09
CORE_CHANGE_COMPLETE=true
ROLLBACK_STATUS=not_required
SOURCE_CHANGED=true
VM100_BASE_COMMIT=c401f82a64eb31c8b1b5d7746abea33dcab3140a
EMPTY_REGISTRY_VALID=true
ZERO_TO_FIRST_ENABLE_SUPPORTED=true
SYNTHETIC_ZERO_TO_ONE_TO_ZERO=$SYNTHETIC_ZERO_TO_ONE_TO_ZERO
FINAL_PROFILE_COUNT=0
FINAL_RUNTIME_PEER_COUNT=0
FINAL_SELECTOR_COUNT=0
MACHINE_GIT_PREFLIGHT=exact_known_R01_mode_only_residue_on_lifecycle_lib
R01_MODE_RESIDUE_CORRECTED=true
FINAL_LIFECYCLE_LIB_MODE=775
ROLLBACK_VERIFICATION_HARDENED=true
BACKUP_TRANSPORT=stdin_script_no_nested_path_quoting
ROLLBACK_RESTORES_EXACT_PRESTATE_MODE=true
VM121_CHANGED=false
VM101_CHANGED=false
DATABASE_SCHEMA_CHANGED=false
REBOOT_PERFORMED=false
LONG_RECOVERY_TEST_REPEATED=false
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM121_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260808-081225_vm121_git_source_25d1656c1ea0/
VM101_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260801-095331_vm101_git_source_ac678d1b3164/
GLOBAL_PLAN_URL=https://reports.secret-studio.ru/latest/20260802-105248_global_project_plan_wg_paid_after_r20qw/
ACCESS_MAP_URL=https://reports.secret-studio.ru/latest/20260715-210236_access_map_canonical_current/
NEXT_ACTION=P1.4 restart/reconcile proof R02 with empty membership supported
EOF
cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/manifest.sha256" "$REPORT/bundle-manifest.sha256"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"; cp "$EVIDENCE"/*.txt "$REPORT/" 2>/dev/null || true
router_step_phase_begin report_publish
if [[ "$SELFTEST" == true ]]; then DEST="${ROUTER_PUBLIC_ROOT:?}/latest/r20qzb-r09-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL=selftest://r20qzb-r09-selftest/; else args=(); while IFS= read -r file; do args+=("$file" "$(basename "$file")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort); router_step_publish_payload step050m07r20qzb_r09_vm100_empty_registry_semantics_hardening_preflight_oracle_fix "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"; STEP_REPORT_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$FINAL_ENV" | tail -n1)"; fi
router_step_phase_complete report_publish step_report_published
router_step_phase_begin archive; archive_latest; router_step_phase_complete archive latest_created; router_step_workflow_mark_complete
trap - ERR; STOP_DETAIL=none; write_child PASS_R20QZB_VM100_EMPTY_REGISTRY_SEMANTICS_HARDENED 0
cat "$REPORT/report.txt"; echo STEP_REPORT_URL="$STEP_REPORT_URL"; echo LATEST_ARCHIVE="$LATEST_ARCHIVE"; echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"