#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
CASE=pass
if [[ "$SELFTEST" == true ]]; then
  case "${ROUTER_PUBLIC_ROOT:-}" in
    */fail-pre/public) CASE=fail-pre ;;
    */fail-core/public) CASE=fail-core ;;
    */fail-post/public) CASE=fail-post ;;
  esac
fi

STEP=STEP_050M07P23C_R03_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
VM121_BASE_COMMIT=e9bfa90773a8cd3c25e0e8d734c4232121272f43
VM121_BASE_TREE=b264b8b1d60510766bdd9775b8d2ffaea4015501
VM121_BASE_COUNT=43
OLD_ADMIN_SHA=afb1dd26942e25b2194cd21a9f3947675994f6b107bc11ffb31adbeec1ea1634
NEW_ADMIN_SHA=9f9dc7dd49613c9a45c27d1895eeb91a19a372a2c9cc8aad96fc755445754f1d
DOMAIN_SHA=79109ed792d0c34794a9e693d95914065515af0e23527ce90e2557ebdbbaf753
CREDENTIAL_SHA=d92bdf6746409fdb9b2fc368597273f7eb7318322bac72f56541e793c07fd35e

CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"
source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight service_foundation machine_close postcheck report_publish archive

CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=not_required
STOP_DETAIL=unknown
STOP_HANDLED=false
STEP_REPORT_URL=unknown
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
REMOTE_STAGE=unknown
REMOTE_PKG=unknown
VM121_NEW_COMMIT=unknown
VM121_NEW_TREE=unknown
VM121_NEW_FILE_COUNT=unknown
VM121_NEW_PUBLIC_URL=unknown

field(){ local k="$1" f="$2"; awk -F= -v k="$k" '$1==k{print substr($0,index($0,"=")+1); exit}' "$f"; }

write_child(){
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo "RESULT=$result"
    echo "WORKER_RC=$rc"
    echo "CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE"
    echo "CORE_CHANGE_REPEATED=$CORE_CHANGE_REPEATED"
    echo "SOURCE_CHANGED=$SOURCE_CHANGED"
    echo "SOURCE_ROLLBACK_STATUS=$SOURCE_ROLLBACK_STATUS"
    echo "BACKEND_RECOVERY_STATUS=$BACKEND_RECOVERY_STATUS"
    echo "STOP_DETAIL=$STOP_DETAIL"
    echo "LIVE_DATABASE_WRITTEN=false"
    echo "DATABASE_SCHEMA_CHANGED=false"
    echo "RUNTIME_PROVISIONING_ACTIVE=false"
    echo "EXTERNAL_ONBOARDING_ACTIVE=false"
    echo "VM121_NEW_COMMIT=$VM121_NEW_COMMIT"
    echo "VM121_NEW_TREE=$VM121_NEW_TREE"
    echo "VM121_NEW_FILE_COUNT=$VM121_NEW_FILE_COUNT"
    echo "VM121_NEW_PUBLIC_URL=$VM121_NEW_PUBLIC_URL"
    echo "STEP_REPORT_URL=$STEP_REPORT_URL"
    echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
    echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"; mv "$tmp" "$CHILD_RESULT"
}

archive_latest(){
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(field LATEST_ARCHIVE "$log")"
  LATEST_ARCHIVE_SHA256="$(field LATEST_ARCHIVE_SHA256 "$log")"
}

cleanup_remote(){
  [[ "$SELFTEST" == false && "$REMOTE_STAGE" != unknown ]] || return 0
  set +e
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE' '$REMOTE_PKG'" >/dev/null 2>&1
  set -e
}

write_stop_report(){
  local rc="$1" line="$2" cmd="$3"
  cat > "$REPORT/report.txt" <<EOF
RESULT=STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
REVISION=R03
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE
CORE_CHANGE_REPEATED=$CORE_CHANGE_REPEATED
SOURCE_CHANGED=$SOURCE_CHANGED
SOURCE_ROLLBACK_STATUS=$SOURCE_ROLLBACK_STATUS
BACKEND_RECOVERY_STATUS=$BACKEND_RECOVERY_STATUS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$VM121_BASE_COMMIT
EOF
  printf 'STOP_COMMAND=%q\n' "$cmd" >> "$REPORT/report.txt"
  cp "$REPORT/report.txt" "$REPORT/verify.txt"
  cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
  cp "$ROOT/release-info.json" "$REPORT/release-info.json"
  cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
}

stop_handler(){
  local rc="$1" line="$2" cmd="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || return "$rc"
  STOP_HANDLED=true
  cleanup_remote
  write_stop_report "$rc" "$line" "$cmd"
  set +e
  if [[ "$SELFTEST" == true ]]; then
    DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23c-r03-$CASE-selftest"
    rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/
    STEP_REPORT_URL="selftest://p23c-r03-$CASE/"
    archive_latest >/dev/null 2>&1
  else
    args=()
    while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
    router_step_publish_payload step050m07p23c_r02_vm121_domain_v2_service_layer_and_credential_foundation_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true
    [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(field PUBLIC_URL "$FINAL_ENV")"
    archive_latest >/dev/null 2>&1
  fi
  set -e
  write_child STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION "$rc"
  return "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

write_selftest_source_pre(){
cat <<EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=$VM121_BASE_COMMIT
REMOTE_HEAD=$VM121_BASE_COMMIT
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=$VM121_BASE_TREE
SIMULATED_TREE_FILE_COUNT=$VM121_BASE_COUNT
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
MACHINE_ID=vm121
GIT_COMMIT=$VM121_BASE_COMMIT
GIT_TREE=$VM121_BASE_TREE
GIT_FILE_COUNT=$VM121_BASE_COUNT
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF
}

collect_source_pre(){
  if [[ "$SELFTEST" == true ]]; then
    write_selftest_source_pre > "$EVIDENCE/pre-vm121-source.txt"
  else
    ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$EVIDENCE/pre-vm121-source.txt" 2>&1 <<'VM121'
set -euo pipefail
/usr/local/sbin/router-vm121-git-publish.sh --check
VM121
  fi
  "$ROOT/scripts/source-check-validate.sh" vm121 "$EVIDENCE/pre-vm121-source.txt" "$VM121_BASE_COMMIT" "$VM121_BASE_TREE" "$VM121_BASE_COUNT" > "$EVIDENCE/pre-vm121-source-validation.txt"
}

write_selftest_target(){
  case "$CASE" in
    fail-pre)
      cat <<EOF
FAILED_STAGE=service_layer_fixture
CORE_SOURCE_CHANGE_COMPLETE=false
SOURCE_CHANGED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=not_required
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
RESULT=STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
EOF
      return 1
      ;;
    fail-core)
      cat <<EOF
FAILED_STAGE=backend_reload_health
CORE_SOURCE_CHANGE_COMPLETE=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=PASS
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
RESULT=STOP_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
EOF
      return 1
      ;;
    *)
      cat <<EOF
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS_BEFORE=0
BUSINESS_ROWS_AFTER=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
ADMIN_SHA256=$NEW_ADMIN_SHA
DOMAIN_V2_SERVICE_SHA256=$DOMAIN_SHA
CREDENTIAL_CRYPTO_SHA256=$CREDENTIAL_SHA
LEGACY_ADMIN_WRITERS_FENCED=true
DOMAIN_V2_SERVICE_FIXTURE=PASS
CORE_SOURCE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
RESULT=PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
EOF
      ;;
  esac
}

write_selftest_machine_close(){
  [[ "$CASE" != fail-post ]] || return 1
  cat <<'EOF'
RESULT=PASS_VM121_GIT_PUBLISH
MACHINE=vm121
COMMIT=1111111111111111111111111111111111111111
TREE=2222222222222222222222222222222222222222
GIT_FILE_COUNT=45
VM121_PUBLIC_URL=https://reports.example/latest/vm121/
RESULT=PASS_ROUTER_MACHINE_CLOSE
EOF
}

write_selftest_post(){
cat <<EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=1111111111111111111111111111111111111111
REMOTE_HEAD=1111111111111111111111111111111111111111
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=2222222222222222222222222222222222222222
SIMULATED_TREE_FILE_COUNT=45
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
MACHINE_ID=vm121
GIT_COMMIT=1111111111111111111111111111111111111111
GIT_TREE=2222222222222222222222222222222222222222
GIT_FILE_COUNT=45
COMMIT_CREATED=false
PUSH_PERFORMED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
ADMIN_SHA256=$NEW_ADMIN_SHA
DOMAIN_V2_SERVICE_SHA256=$DOMAIN_SHA
CREDENTIAL_CRYPTO_SHA256=$CREDENTIAL_SHA
BACKEND_HEALTH=PASS
LEGACY_ADMIN_WRITER_FENCE_SOURCE=true
EOF
}

router_step_phase_begin preflight
collect_source_pre || { STOP_DETAIL=pre_vm121_source; false; }
PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"
"$ROOT/scripts/target-apply.sh" "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" "$PKG" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"
router_step_phase_complete preflight exact_vm121_source_and_target_package_verified

router_step_phase_begin service_foundation
target_rc=0
if [[ "$SELFTEST" == true ]]; then
  if write_selftest_target > "$EVIDENCE/service-foundation.txt"; then target_rc=0; else target_rc=$?; fi
else
  token="$(basename "$RUN_DIR" | tr -cd 'A-Za-z0-9._-')"
  REMOTE_STAGE="/root/router-step-p23c-$token"
  REMOTE_PKG="/root/router-step-p23c-$token.tar.gz"
  if ! ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "umask 077; cat > '$REMOTE_PKG'" < "$PKG"; then STOP_DETAIL=remote_package_transfer; false; fi
  if ! ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE'; install -d -m 0700 '$REMOTE_STAGE'; tar -xzf '$REMOTE_PKG' -C '$REMOTE_STAGE'" > "$EVIDENCE/remote-stage.txt" 2>&1; then STOP_DETAIL=remote_package_extract; false; fi
  if ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "/bin/bash '$REMOTE_STAGE/vm121-p23c-service-foundation.sh' '$REMOTE_STAGE/candidate'" > "$EVIDENCE/service-foundation.txt" 2>&1; then target_rc=0; else target_rc=$?; fi
fi

remote_core="$(field CORE_SOURCE_CHANGE_COMPLETE "$EVIDENCE/service-foundation.txt")"
remote_changed="$(field SOURCE_CHANGED "$EVIDENCE/service-foundation.txt")"
remote_rollback="$(field SOURCE_ROLLBACK_STATUS "$EVIDENCE/service-foundation.txt")"
remote_backend="$(field BACKEND_RECOVERY_STATUS "$EVIDENCE/service-foundation.txt")"
[[ "$remote_core" == true ]] && CORE_CHANGE_COMPLETE=true || CORE_CHANGE_COMPLETE=false
[[ "$remote_changed" == true ]] && SOURCE_CHANGED=true || SOURCE_CHANGED=false
[[ -n "$remote_rollback" ]] && SOURCE_ROLLBACK_STATUS="$remote_rollback"
[[ -n "$remote_backend" ]] && BACKEND_RECOVERY_STATUS="$remote_backend"
if [[ "$target_rc" -ne 0 ]]; then
  STOP_DETAIL="service_foundation_$(field FAILED_STAGE "$EVIDENCE/service-foundation.txt")"
  false
fi
"$ROOT/scripts/service-foundation-validate.sh" "$EVIDENCE/service-foundation.txt" > "$EVIDENCE/service-foundation-validation.txt" || { STOP_DETAIL=service_foundation_semantics; false; }
CORE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
cleanup_remote
router_step_phase_complete service_foundation isolated_fixture_source_install_backend_health_and_legacy_writer_fences_proven

router_step_phase_begin machine_close
close_rc=0
if [[ "$SELFTEST" == true ]]; then
  if write_selftest_machine_close > "$EVIDENCE/vm121-machine-close.txt"; then close_rc=0; else close_rc=$?; fi
else
  if "$BASE/bin/router-machine-close-safe" vm121 "$STEP: add Domain V2 service/credential foundation; fence legacy admin writers" > "$EVIDENCE/vm121-machine-close.txt" 2>&1; then close_rc=0; else close_rc=$?; fi
fi
if [[ "$close_rc" -ne 0 ]]; then STOP_DETAIL=machine_close_after_core; false; fi
"$ROOT/scripts/machine-close-validate.sh" "$EVIDENCE/vm121-machine-close.txt" > "$EVIDENCE/vm121-machine-close-validation.txt" || { STOP_DETAIL=machine_close_semantics; false; }
VM121_NEW_COMMIT="$(field VM121_NEW_COMMIT "$EVIDENCE/vm121-machine-close-validation.txt")"
VM121_NEW_TREE="$(field VM121_NEW_TREE "$EVIDENCE/vm121-machine-close-validation.txt")"
VM121_NEW_FILE_COUNT="$(field VM121_NEW_FILE_COUNT "$EVIDENCE/vm121-machine-close-validation.txt")"
VM121_NEW_PUBLIC_URL="$(field VM121_NEW_PUBLIC_URL "$EVIDENCE/vm121-machine-close-validation.txt")"
router_step_phase_complete machine_close vm121_source_closed_and_published

router_step_phase_begin postcheck
if [[ "$SELFTEST" == true ]]; then
  write_selftest_post > "$EVIDENCE/post-vm121.txt"
else
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$EVIDENCE/post-vm121.txt" 2>&1 <<'VM121POST'
set -euo pipefail
/usr/local/sbin/router-vm121-git-publish.sh --check
PG=wgaccess-postgres
PGUSER="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"
PGDB="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"
q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$PGUSER" -d "$PGDB" -Atqc "$1"; }
echo "ALEMBIC_VERSION=$(q 'SELECT version_num FROM alembic_version')"
echo "BUSINESS_ROWS=$(q "SELECT
 (SELECT count(*) FROM users)+
 (SELECT count(*) FROM plans)+
 (SELECT count(*) FROM access_grants)+
 (SELECT count(*) FROM access_grant_protocol_limits)+
 (SELECT count(*) FROM invites)+
 (SELECT count(*) FROM invite_redemptions)+
 (SELECT count(*) FROM magic_link_tokens)+
 (SELECT count(*) FROM auth_sessions)+
 (SELECT count(*) FROM connection_profiles)+
 (SELECT count(*) FROM peer_credentials)+
 (SELECT count(*) FROM audit_events)+
 (SELECT count(*) FROM invite_codes)+
 (SELECT count(*) FROM orders)+
 (SELECT count(*) FROM subscriptions)+
 (SELECT count(*) FROM peers)+
 (SELECT count(*) FROM provisioning_jobs)+
 (SELECT count(*) FROM peer_egress_leases)")"
echo "EGRESS_TARGET_COUNT=$(q 'SELECT count(*) FROM egress_targets')"
echo "EGRESS_ALLOCATOR_COUNT=$(q 'SELECT count(*) FROM egress_allocator_settings')"
echo "ADMIN_SHA256=$(sha256sum /opt/wg-access/backend/app/api/admin.py | awk '{print $1}')"
echo "DOMAIN_V2_SERVICE_SHA256=$(sha256sum /opt/wg-access/backend/app/services/domain_v2.py | awk '{print $1}')"
echo "CREDENTIAL_CRYPTO_SHA256=$(sha256sum /opt/wg-access/backend/app/services/credential_crypto.py | awk '{print $1}')"
if curl -fsS --max-time 5 http://127.0.0.1:18080/health >/dev/null &&
   curl -fsS --max-time 5 http://127.0.0.1:18080/health/db >/dev/null; then
  echo BACKEND_HEALTH=PASS
else
  echo BACKEND_HEALTH=FAIL
  exit 1
fi
grep -Fq 'require_legacy_domain_v1_writer_retired' /opt/wg-access/backend/app/api/admin.py && echo LEGACY_ADMIN_WRITER_FENCE_SOURCE=true || { echo LEGACY_ADMIN_WRITER_FENCE_SOURCE=false; exit 1; }
VM121POST
fi

"$ROOT/scripts/source-check-validate.sh" vm121 "$EVIDENCE/post-vm121.txt" "$VM121_NEW_COMMIT" "$VM121_NEW_TREE" "$VM121_NEW_FILE_COUNT" > "$EVIDENCE/post-vm121-source-validation.txt" || { STOP_DETAIL=post_source; false; }
[[ "$(field ALEMBIC_VERSION "$EVIDENCE/post-vm121.txt")" == 0003_domain_v2_schema ]] || { STOP_DETAIL=post_alembic; false; }
[[ "$(field BUSINESS_ROWS "$EVIDENCE/post-vm121.txt")" == 0 ]] || { STOP_DETAIL=post_business_rows; false; }
[[ "$(field EGRESS_TARGET_COUNT "$EVIDENCE/post-vm121.txt")" == 5 ]] || { STOP_DETAIL=post_egress_targets; false; }
[[ "$(field EGRESS_ALLOCATOR_COUNT "$EVIDENCE/post-vm121.txt")" == 14 ]] || { STOP_DETAIL=post_egress_allocator; false; }
[[ "$(field ADMIN_SHA256 "$EVIDENCE/post-vm121.txt")" == "$NEW_ADMIN_SHA" ]] || { STOP_DETAIL=post_admin_sha; false; }
[[ "$(field DOMAIN_V2_SERVICE_SHA256 "$EVIDENCE/post-vm121.txt")" == "$DOMAIN_SHA" ]] || { STOP_DETAIL=post_domain_sha; false; }
[[ "$(field CREDENTIAL_CRYPTO_SHA256 "$EVIDENCE/post-vm121.txt")" == "$CREDENTIAL_SHA" ]] || { STOP_DETAIL=post_credential_sha; false; }
[[ "$(field BACKEND_HEALTH "$EVIDENCE/post-vm121.txt")" == PASS ]] || { STOP_DETAIL=post_backend_health; false; }
[[ "$(field LEGACY_ADMIN_WRITER_FENCE_SOURCE "$EVIDENCE/post-vm121.txt")" == true ]] || { STOP_DETAIL=post_legacy_fence; false; }
router_step_phase_complete postcheck published_source_live_0003_clean_baseline_and_backend_health_verified

cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION
REVISION=R03
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
LEGACY_ADMIN_WRITERS_FENCED=true
DOMAIN_V2_SERVICE_FIXTURE=PASS
NORMALIZED_VERIFIED_IDENTITY_PRIMITIVE=true
ACCESS_GRANT_PROTOCOL_QUOTA_PRIMITIVE=true
QUOTA_RACE_SERIALIZATION_PROVED=true
PROVISIONING_JOB_IDEMPOTENCY_PRIMITIVE=true
AUDIT_PRIMITIVE=true
CREDENTIAL_AES256_GCM_VERSIONED_ENVELOPE=true
CREDENTIAL_REVISION_STORAGE_PRIMITIVE=true
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$VM121_BASE_COMMIT
VM121_COMMIT=$VM121_NEW_COMMIT
VM121_TREE=$VM121_NEW_TREE
VM121_FILE_COUNT=$VM121_NEW_FILE_COUNT
VM121_PUBLIC_URL=$VM121_NEW_PUBLIC_URL
PROJECT_SOURCES_CHECKPOINT=AFTER_P22B
RUNTIME_IMPACT=true
COPY_VERIFY=PASS
NEXT_ACTION=P23D production credential master-key deployment/backup/rotation foundation; no external onboarding
EOF

cp "$REPORT/report.txt" "$REPORT/verify.txt"
cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
cp "$ROOT/release-info.json" "$REPORT/release-info.json"
cp "$ROOT/manifest.sha256" "$REPORT/bundle-manifest.sha256"
cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
cp "$EVIDENCE/service-foundation-validation.txt" "$REPORT/"
cp "$EVIDENCE/vm121-machine-close-validation.txt" "$REPORT/"
cp "$EVIDENCE/post-vm121-source-validation.txt" "$REPORT/"

router_step_phase_begin report_publish
if [[ "$SELFTEST" == true ]]; then
  DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23c-r03-selftest"
  rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/
  STEP_REPORT_URL=selftest://p23c-r03/
else
  args=()
  while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
  router_step_publish_payload step050m07p23c_r02_vm121_domain_v2_service_layer_and_credential_foundation "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
  STEP_REPORT_URL="$(field PUBLIC_URL "$FINAL_ENV")"
fi
router_step_phase_complete report_publish step_report_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_created
router_step_workflow_mark_complete
trap - ERR
STOP_DETAIL=none
write_child PASS_P23C_VM121_DOMAIN_V2_SERVICE_LAYER_AND_CREDENTIAL_FOUNDATION 0
cat "$REPORT/report.txt"
echo "STEP_REPORT_URL=$STEP_REPORT_URL"
echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"