#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUNDLE_ROOT="${BUNDLE_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)}";export BUNDLE_ROOT
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}";INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
WORKFLOW_LIB="${ROUTER_STEP_WORKFLOW_LIB:-$BASE/lib/router-step-workflow.sh}"
FINALIZER="${ROUTER_STEP_FINALIZE_BIN:-$BASE/bin/router-step-finalize}"
SAFE_PAYLOAD="${ROUTER_PUBLIC_SAFE_PAYLOAD_BIN:-$BASE/bin/router-public-safe-payload}"
MACHINE_CLOSE="${ROUTER_MACHINE_CLOSE_SAFE:-$BASE/bin/router-machine-close-safe}"
RUN_TARGET="$BUNDLE_ROOT/scripts/run-target.sh"
release_env="$("$BASE/bin/router-release-contract" env --root "$BUNDLE_ROOT")";eval "$release_env"
STEP_ID="$ROUTER_RELEASE_STEP_ID";TARGET_PACKAGE_SHA256="$ROUTER_RELEASE_TARGET_PACKAGE_SHA256"
TARGET_TREE='2089a3611d9d0a5a9d3547f8a15881e5851490e2';TARGET_FILE_COUNT=41
RUN_ID="$(date -u +%Y%m%d-%H%M%S)-$$"
[[ "$RUN_ID" =~ ^[A-Za-z0-9-]+$ ]]
RUN_DIR="$BASE/state/step-runs/$STEP_ID/$RUN_ID";EVIDENCE_DIR="$RUN_DIR/evidence"
REPORT_DIR="$RUN_DIR/report";PUBLIC_PAYLOAD="$RUN_DIR/public-payload"
CURRENT_FILE="$RUN_DIR/workflow-current.txt";EVENTS_FILE="$RUN_DIR/workflow-events.tsv"
FINAL_ENV="$RUN_DIR/finalize.txt"
LOCK_FILE="$BASE/state/locks/${STEP_ID}.lock"
CURRENT_PHASE=preflight
# Live core was repaired and accepted on 2026-10-13; source-only closure MUST NEVER rollback it.
CORE_CHANGE_COMPLETE=true
ROLLBACK_STATUS=prohibited_preserve_accepted_live_core
LATEST_ARCHIVE=not_created
source "$WORKFLOW_LIB"
mkdir -p "$RUN_DIR" "$EVIDENCE_DIR" "$REPORT_DIR" "$(dirname "$LOCK_FILE")"
exec 9>"$LOCK_FILE"
flock -n 9 || { echo RESULT=STOP_B5D_R01_STEP_ALREADY_RUNNING; echo STEP_WAS_NOT_STARTED=true; exit 75; }
router_step_workflow_init "$CURRENT_FILE" "$EVENTS_FILE" preflight source_publish verification report_build finalization latest
build_report(){ python3 "$BUNDLE_ROOT/scripts/build-report.py" --bundle "$BUNDLE_ROOT" --run-dir "$RUN_DIR" --result "$1" --phase "$2" --rc "$3" --line "$4" --core-complete "$CORE_CHANGE_COMPLETE" --rollback-status "$ROLLBACK_STATUS"; }
publish_report(){
 local args=() file
 for file in report.txt facts.json facts-public.html verify-public.html rollback-public.html release-info.json installer.sha256 bundle-manifest.sha256 executed-step.sh executed-worker.sh workflow-current.txt workflow-events.tsv; do [[ ! -f "$REPORT_DIR/$file" ]] || args+=("$REPORT_DIR/$file" "$file");done
 for file in preflight source-publish verification;do [[ ! -f "$REPORT_DIR/$file.txt" ]] || args+=("$REPORT_DIR/$file.txt" "$file.txt");done
 "$SAFE_PAYLOAD" "$PUBLIC_PAYLOAD" "${args[@]}"
 "$FINALIZER" --label step_vm100_b5d_pbr_source_close_r01 --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT_FILE" --workflow-events "$EVENTS_FILE" --output-env "$FINAL_ENV" --expect-kind step-report
}
archive_latest(){
 router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" > "$EVIDENCE_DIR/latest.txt" 2>&1 || return $?
 cat "$EVIDENCE_DIR/latest.txt"
 grep -Fqx RESULT=PASS_ROUTER_STEP_ARCHIVE_LATEST "$EVIDENCE_DIR/latest.txt"
 LATEST_ARCHIVE="$(awk -F= '$1=="LATEST_ARCHIVE"{print substr($0,index($0,"=")+1)}' "$EVIDENCE_DIR/latest.txt" | tail -n1)"
 [[ -n "$LATEST_ARCHIVE" ]]
}
stop(){
 local line="$1" rc="$2" command="$3" phase="$CURRENT_PHASE"
 trap - ERR HUP INT TERM;set +e
 router_step_phase_fail "$phase" "line=$line rc=$rc" >/dev/null 2>&1
 # No historical rollback, checkout/reset, service restart or VM100 source overwrite.
 if router_step_should_publish_stop;then
   if build_report STOP "$phase" "$rc" "$line";then publish_report || echo STOP_REPORT_FINALIZATION=FAILED;else echo STOP_REPORT_BUILD=FAILED;fi
 else echo NO_SECOND_STOP_REPORT=true;fi
 archive_latest || echo STOP_LATEST_ARCHIVE=FAILED
 router_step_emit_stop_evidence STOP_B5D_R01_VM100_PBR_SOURCE_CLOSE "$phase" "$line" "$rc" "$command" VM100 "$CORE_CHANGE_COMPLETE" "$ROLLBACK_STATUS" "$LATEST_ARCHIVE" inspect_phase_and_resume_only_unfinished_source_publication
 echo CONTINUATION_REQUIRED=true
 exit "$rc"
}
trap 'stop "$LINENO" "$?" "$BASH_COMMAND"' ERR
trap 'stop "$LINENO" 129 "signal HUP"' HUP
trap 'stop "$LINENO" 130 "signal INT"' INT
trap 'stop "$LINENO" 143 "signal TERM"' TERM
run_phase(){
 local phase="$1" expect="$2"
 CURRENT_PHASE="$phase";router_step_phase_begin "$phase"
 "$RUN_TARGET" "$phase" "$RUN_ID" "$TARGET_PACKAGE_SHA256" > "$EVIDENCE_DIR/$phase.txt" 2>&1
 cat "$EVIDENCE_DIR/$phase.txt"
 grep -Fqx "RESULT=$expect" "$EVIDENCE_DIR/$phase.txt"
 router_step_phase_complete "$phase" "approved_vm100_41_file_source_identity_verified"
}
run_phase preflight PASS_B5D_R01_PREFLIGHT
CURRENT_PHASE=source_publish;router_step_phase_begin source_publish
"$MACHINE_CLOSE" vm100 "$STEP_ID source-only accepted VM100 PBR include incident repair; 3 fixed hooks and DHCP addnmount reorder; no runtime apply" > "$EVIDENCE_DIR/source-publish.txt" 2>&1
cat "$EVIDENCE_DIR/source-publish.txt"
grep -Fqx RESULT=PASS_ROUTER_MACHINE_CLOSE "$EVIDENCE_DIR/source-publish.txt"
grep -Fqx "TREE=$TARGET_TREE" "$EVIDENCE_DIR/source-publish.txt"
grep -Fqx "GIT_FILE_COUNT=$TARGET_FILE_COUNT" "$EVIDENCE_DIR/source-publish.txt"
router_step_phase_complete source_publish accepted_live_source_committed_to_github_and_published
run_phase verification PASS_B5D_R01_VERIFY
CURRENT_PHASE=report_build;router_step_phase_begin report_build;build_report PASS none 0 0;router_step_phase_complete report_build source_close_report_ready
CURRENT_PHASE=finalization;router_step_phase_begin finalization;publish_report;router_step_phase_complete finalization canonical_report_http_verified
CURRENT_PHASE=latest;router_step_phase_begin latest;archive_latest;router_step_phase_complete latest fresh_latest_archive_verified
router_step_workflow_mark_complete
trap - ERR HUP INT TERM
cat "$FINAL_ENV";cat "$REPORT_DIR/report.txt"
echo RESULT=PASS_B5D_R01_VM100_PBR_SOURCE_CLOSE
echo "RUN_DIR=$RUN_DIR"
echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"