#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
CASE="${ROUTER_P23A_R02_SELFTEST_CASE:-pass}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
STEP=STEP_050M07P23A_R02_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES_CONTINUATION
R01_STEP=STEP_050M07P23A_R01_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES
EXPECTED_COMMIT=f9cc1cdfa0619ba5d6d28f359462061d97b3a558
EXPECTED_TREE=ea0c9f14684a00a3cb6ffb2c0eb75265a5877558
EXPECTED_COUNT=43
EXPECTED_MIGRATION_SHA=56c1fe6fd85d4d8a7a048ccf4efc807c8f3b20f2c98b24d6f21e4230153a9d8d
EXPECTED_VM121_URL=https://reports.secret-studio.ru/latest/20260810-020947_vm121_git_source_f9cc1cdfa061/
TS="$(date -u +%Y%m%d-%H%M%S)"
RUN_ROOT="${ROUTER_P23A_R02_RUN_ROOT:-$BASE/state/step-runs/$STEP}"
RUN_DIR="$RUN_ROOT/${TS}_$$"
CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"
EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"; RESULT_ENV="$RUN_DIR/result.env"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"; chmod 700 "$RUN_DIR" "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"
source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight retained_evidence postcheck report_publish archive
STOP_DETAIL=unknown; STOP_HANDLED=false; STEP_REPORT_URL=unknown; LATEST_ARCHIVE=not_created; LATEST_ARCHIVE_SHA256=unknown; R01_RUN_DIR=unknown
field(){ awk -F= -v k="$1" '$1==k{print substr($0,index($0,"=")+1); exit}' "$2"; }
write_result(){ local result="$1" rc="$2" tmp="${RESULT_ENV}.tmp.$$"; cat > "$tmp" <<EOF
RESULT=$result
WORKER_RC=$rc
STOP_DETAIL=$STOP_DETAIL
R01_RUN_DIR=$R01_RUN_DIR
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
TARGET_INSTALLER_RERUN=false
TARGET_POSTCHECK_REPEATED=false
ROUTER_MACHINE_CLOSE_RERUN=false
LIVE_DATABASE_WRITTEN=false
LIVE_SCHEMA_ACTIVATED=false
ROLLBACK_STATUS=not_applicable_continuation
STEP_REPORT_URL=$STEP_REPORT_URL
LATEST_ARCHIVE=$LATEST_ARCHIVE
LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256
RUN_DIR=$RUN_DIR
EOF
chmod 600 "$tmp"; mv "$tmp" "$RESULT_ENV"; }
archive_latest(){ local log="$EVIDENCE/archive.log"; router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"; LATEST_ARCHIVE="$(field LATEST_ARCHIVE "$log")"; LATEST_ARCHIVE_SHA256="$(field LATEST_ARCHIVE_SHA256 "$log")"; }
write_stop_report(){ local rc="$1" line="$2" cmd="$3"; cat > "$REPORT/report.txt" <<EOF
RESULT=STOP_P23A_R02_DOMAIN_V2_FIXTURES_CONTINUATION
REVISION=R02
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
TARGET_INSTALLER_RERUN=false
TARGET_POSTCHECK_REPEATED=false
ROUTER_MACHINE_CLOSE_RERUN=false
LIVE_DATABASE_WRITTEN=false
LIVE_SCHEMA_ACTIVATED=false
ROLLBACK_STATUS=not_applicable_continuation
EOF
printf 'STOP_COMMAND=%q
' "$cmd" >> "$REPORT/report.txt"; cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"; }
stop_handler(){ local rc="$1" line="$2" cmd="$3"; trap - ERR; [[ "$STOP_HANDLED" == false ]] || return "$rc"; STOP_HANDLED=true; set +e; write_stop_report "$rc" "$line" "$cmd"; if [[ "$SELFTEST" == true ]]; then DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23a-r02-$CASE-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL="selftest://p23a-r02-$CASE/"; archive_latest >/dev/null 2>&1; else args=(); while IFS= read -r file; do args+=("$file" "$(basename "$file")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort); router_step_publish_payload step050m07p23a_r02_vm121_domain_v2_schema_design_and_migration_fixtures_continuation_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true; [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(field PUBLIC_URL "$FINAL_ENV")"; archive_latest >/dev/null 2>&1; fi; set -e; write_result STOP_P23A_R02_DOMAIN_V2_FIXTURES_CONTINUATION "$rc"; return "$rc"; }
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

find_r01(){
 if [[ "$SELFTEST" == true ]]; then printf '%s
' "${ROUTER_P23A_R01_RETAINED_DIR:?}"; return 0; fi
 local rr="$BASE/state/step-runs/$R01_STEP" d
 [[ -d "$rr" ]] || return 1
 for d in $(find "$rr" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p
' | LC_ALL=C sort -nr | awk '{print $2}'); do
   [[ -f "$d/result.env" ]] || continue
   if grep -Fqx 'RESULT=STOP_P23A_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES' "$d/result.env" && grep -Fqx 'CORE_CHANGE_COMPLETE=true' "$d/result.env" && grep -Fqx 'STOP_DETAIL=machine_close_semantics' "$d/result.env"; then printf '%s
' "$d"; return 0; fi
 done
 return 1
}
write_selftest_state(){ cat <<EOF
MIGRATION_SHA256=$EXPECTED_MIGRATION_SHA
ALEMBIC_VERSION=0002_live_drift_bridge
LIVE_DOMAIN_V2_TABLE_COUNT=0
USER_COUNT=0
PEER_COUNT=0
SUBSCRIPTION_COUNT=0
INVITE_COUNT=0
PROVISIONING_JOB_COUNT=0
PEER_EGRESS_LEASE_COUNT=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
BACKEND_HEALTH=PASS
EOF
}
collect_live_state(){
 if [[ "$SELFTEST" == true ]]; then write_selftest_state; return 0; fi
 ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s <<'VM121'
set -euo pipefail
PG=wgaccess-postgres; BACKEND=wgaccess-backend
PGUSER="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"; PGDB="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"
q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$PGUSER" -d "$PGDB" -Atqc "$1"; }
echo "MIGRATION_SHA256=$(sha256sum /opt/wg-access/backend/alembic/versions/0003_domain_v2_schema.py | awk '{print $1}')"
echo "ALEMBIC_VERSION=$(q 'SELECT version_num FROM alembic_version')"
echo "LIVE_DOMAIN_V2_TABLE_COUNT=$(q "SELECT count(*) FROM information_schema.tables WHERE table_schema='public' AND table_name IN ('plans','access_grants','access_grant_protocol_limits','invites','invite_redemptions','magic_link_tokens','auth_sessions','connection_profiles','peer_credentials','audit_events')")"
echo "USER_COUNT=$(q 'SELECT count(*) FROM users')"
echo "PEER_COUNT=$(q 'SELECT count(*) FROM peers')"
echo "SUBSCRIPTION_COUNT=$(q 'SELECT count(*) FROM subscriptions')"
echo "INVITE_COUNT=$(q 'SELECT count(*) FROM invite_codes')"
echo "PROVISIONING_JOB_COUNT=$(q 'SELECT count(*) FROM provisioning_jobs')"
echo "PEER_EGRESS_LEASE_COUNT=$(q 'SELECT count(*) FROM peer_egress_leases')"
echo "EGRESS_TARGET_COUNT=$(q 'SELECT count(*) FROM egress_targets')"
echo "EGRESS_ALLOCATOR_COUNT=$(q 'SELECT count(*) FROM egress_allocator_settings')"
docker exec -i "$BACKEND" python - <<'PYVM' >/dev/null
import urllib.request
for url in ('http://127.0.0.1:8000/health','http://127.0.0.1:8000/health/db'):
    with urllib.request.urlopen(url,timeout=5) as r: assert r.status==200
PYVM
echo BACKEND_HEALTH=PASS
VM121
}
write_selftest_machine_check(){ cat <<EOF
RESULT=PASS_VM130_VM121_GIT_SOURCE_CHECK
VM121_COMMIT=$EXPECTED_COMMIT
VM130_COMMIT=$EXPECTED_COMMIT
VM130_TREE=$EXPECTED_TREE
VM130_FILE_COUNT=$EXPECTED_COUNT
VM121_PUSH_PERFORMED=false
EOF
}
write_selftest_source_state(){ cat <<EOF
VM121_GIT_SOURCE_COMMIT=$EXPECTED_COMMIT
VM121_GIT_SOURCE_TREE=$EXPECTED_TREE
VM121_GIT_SOURCE_FILE_COUNT=$EXPECTED_COUNT
VM121_GIT_SOURCE_URL=$EXPECTED_VM121_URL
EOF
}

router_step_phase_begin preflight
"$ROOT/scripts/target-apply.sh" "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" "$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH" "$TARGET_DIR" > "$EVIDENCE/target-package.txt"
if [[ "$CASE" == fail-live ]]; then write_selftest_state | sed 's/ALEMBIC_VERSION=0002_live_drift_bridge/ALEMBIC_VERSION=0003_domain_v2_schema/' > "$EVIDENCE/live-pre.txt"; else collect_live_state > "$EVIDENCE/live-pre.txt"; fi
"$ROOT/scripts/current-state-validate.sh" "$EVIDENCE/live-pre.txt" > "$EVIDENCE/live-pre-validation.txt" || { STOP_DETAIL=live_pre_invariants; false; }
router_step_phase_complete preflight current_vm121_live_state_matches_post_r01_expected_state

router_step_phase_begin retained_evidence
R01_RUN_DIR="$(find_r01)" || { STOP_DETAIL=r01_retained_run_not_found; false; }
if [[ "$CASE" == fail-retained ]]; then rm -f "$R01_RUN_DIR/evidence/domain-v2-prepare-validation.txt"; fi
"$ROOT/scripts/retained-r01-validate.sh" "$R01_RUN_DIR" > "$EVIDENCE/r01-retained-validation.txt" || { STOP_DETAIL=r01_retained_evidence; false; }
router_step_phase_complete retained_evidence r01_core_fixture_and_machine_close_evidence_verified_without_repetition

router_step_phase_begin postcheck
if [[ "$SELFTEST" == true ]]; then write_selftest_machine_check > "$EVIDENCE/machine-check.txt"; write_selftest_source_state > "$EVIDENCE/current-vm121-git-source.env"; else
 "$BASE/bin/router-vm121-git-source-publish" --check > "$EVIDENCE/machine-check.txt" 2>&1
 cp "$BASE/state/current-vm121-git-source.env" "$EVIDENCE/current-vm121-git-source.env"
fi
"$ROOT/scripts/machine-check-validate.sh" "$EVIDENCE/machine-check.txt" "$EVIDENCE/current-vm121-git-source.env" > "$EVIDENCE/machine-check-validation.txt" || { STOP_DETAIL=machine_check_semantics; false; }
collect_live_state > "$EVIDENCE/live-post.txt"
"$ROOT/scripts/current-state-validate.sh" "$EVIDENCE/live-post.txt" > "$EVIDENCE/live-post-validation.txt" || { STOP_DETAIL=live_post_invariants; false; }
router_step_phase_complete postcheck authoritative_vm121_source_check_and_live_invariants_passed_no_core_repetition

cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_P23A_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES
REVISION=R02
CONTINUATION=true
PREVIOUS_STEP=$R01_STEP
R01_RESULT=STOP_P23A_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES
R01_STOP_DETAIL=machine_close_semantics
R01_ORACLE_DEFECT=first_RESULT_instead_of_outer_RESULT
R01_CORE_CHANGE_COMPLETE=true
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
TARGET_INSTALLER_RERUN=false
TARGET_POSTCHECK_REPEATED=false
ROUTER_MACHINE_CLOSE_RERUN=false
R01_FIXTURE_EVIDENCE_RETAINED=true
R01_FIXTURE_EVIDENCE_VALIDATED=true
R01_MACHINE_CLOSE_EVIDENCE_VALIDATED=true
MACHINE_CLOSE_ORACLE_CORRECTED=true
VM121_COMMIT=$EXPECTED_COMMIT
VM121_TREE=$EXPECTED_TREE
VM121_FILE_COUNT=$EXPECTED_COUNT
MIGRATION_SHA256=$EXPECTED_MIGRATION_SHA
VM121_PUBLIC_URL=$EXPECTED_VM121_URL
ALEMBIC_VERSION=0002_live_drift_bridge
LIVE_DATABASE_WRITTEN=false
LIVE_SCHEMA_ACTIVATED=false
LIVE_DOMAIN_V2_TABLE_COUNT=0
BACKEND_HEALTH=PASS
RUNTIME_IMPACT=false
ROLLBACK_STATUS=not_applicable_continuation
COPY_VERIFY=PASS
PROJECT_SOURCES_CHECKPOINT=AFTER_P22B
NEXT_ACTION=P23B Class C coordinated activation of 0003_domain_v2_schema with compatible VM121 model/writer update, encrypted backup, proved restore and explicit core boundary
EOF
cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"; cp "$ROOT/reference/continuation-contract.md" "$REPORT/continuation-contract.md"; cp "$EVIDENCE/r01-retained-validation.txt" "$REPORT/r01-retained-validation.txt"; cp "$EVIDENCE/machine-check-validation.txt" "$REPORT/machine-check-validation.txt"; cp "$EVIDENCE/live-pre-validation.txt" "$REPORT/live-pre-validation.txt"; cp "$EVIDENCE/live-post-validation.txt" "$REPORT/live-post-validation.txt"
router_step_phase_begin report_publish
if [[ "$SELFTEST" == true ]]; then DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23a-r02-pass-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL=selftest://p23a-r02-pass/; else args=(); while IFS= read -r file; do args+=("$file" "$(basename "$file")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort); router_step_publish_payload step050m07p23a_r02_vm121_domain_v2_schema_design_and_migration_fixtures_continuation "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"; STEP_REPORT_URL="$(field PUBLIC_URL "$FINAL_ENV")"; fi
router_step_phase_complete report_publish p23a_pass_report_published
router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_created
router_step_workflow_mark_complete
trap - ERR; STOP_DETAIL=none; write_result PASS_P23A_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES 0
echo RESULT=PASS_P23A_VM121_DOMAIN_V2_SCHEMA_DESIGN_AND_MIGRATION_FIXTURES
echo REVISION=R02
echo CORE_CHANGE_REPEATED=false
echo LIVE_DATABASE_WRITTEN=false
echo VM121_PUBLIC_URL="$EXPECTED_VM121_URL"
echo STEP_REPORT_URL="$STEP_REPORT_URL"
echo LATEST_ARCHIVE="$LATEST_ARCHIVE"
echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"