#!/usr/bin/env bash
# Rewrite the golden-272-r3-drive manifest ONCE, at terminal. deployah 2026-09-09.
#
# RULES THIS ENCODES (each one paid for earlier in this milestone):
#  - Paths are REPO-ROOT-RELATIVE, and the script REFUSES to run from anywhere but the repo root,
#    so the manifest cannot be written with paths that only resolve from one session's cwd.
#  - The cwd is RECORDED IN THE MANIFEST, so a later reader knows where it was verified from.
#  - It verifies IMMEDIATELY after writing, from that same root, and reports OK/FAILED counts.
#    A manifest that has never been checked is a claim, not evidence.
#  - It refuses to overwrite while any watcher is still appending: the two logs must be settled.
set -uo pipefail

DIR=.spt/preserved/golden-272-r3-drive
MANIFEST=.spt/preserved/golden-272-r3-drive.MANIFEST.sha256

[ -d .git ] || { echo "REFUSE: not at the repo root (no .git here). cwd=$(pwd)" >&2; exit 2; }
[ -d "$DIR" ] || { echo "REFUSE: $DIR not found from $(pwd)" >&2; exit 2; }

# The watcher appends to r3-a2-watch.log until the run is terminal. Hashing a file that is still
# growing produces a manifest that fails its own verify minutes later.
#
# THE FIRST GUARD HERE WAS `pgrep -f 'watch-a2.ps1'` AND IT WAS INERT. Git Bash's pgrep does not
# see a detached Windows pwsh process, so the check found nothing, reported all-clear, and the
# manifest was written WHILE THE LOG WAS STILL GROWING. It failed toward PERMITTING, which is the
# direction a guard must never fail in, and it did it silently. (Same oracle problem already on
# record: Get-CimInstance Win32_Process is the only reliable process oracle on this box; a bash
# process query returns a confident empty.)
#
# THE FIX IS NOT A BETTER PROCESS QUERY. The real invariant is not "is a watcher alive" but
# "IS THE RUN TERMINAL" - that is authoritative, remote, and cannot be fooled by a process table.
# The mtime check is the belt to that braces: if anything is still appending, refuse.
RUN=${MANIFEST_RUN:-34310511612}
REPO=BigscreenVR/spt-bs-core
st=$(gh run view "$RUN" --repo "$REPO" --json status,attempt --jq '"\(.status)|\(.attempt)"' 2>/dev/null || true)
[ -n "$st" ] || { echo "REFUSE: cannot read run $RUN status - VOID, not permission to proceed" >&2; exit 3; }
run_status=${st%%|*}; run_attempt=${st##*|}
echo "run $RUN: status=$run_status attempt=$run_attempt"
if [ "$run_status" != "completed" ]; then
  echo "REFUSE: run $RUN is $run_status, not terminal. The logs are still being written." >&2
  exit 3
fi
# Belt: nothing under the dir may have been modified in the last 60 seconds.
recent=$(find "$DIR" -type f -newermt '-60 seconds' 2>/dev/null | head -5)
if [ -n "$recent" ]; then
  echo "REFUSE: files modified in the last 60s - something is still writing:" >&2
  printf '  %s\n' $recent >&2
  exit 3
fi

n=$(find "$DIR" -type f | wc -l)
echo "hashing $n files under $DIR (repo root: $(pwd))"

{
  echo "# golden-272-r3-drive preservation manifest"
  echo "# written $(date -u +%Y-%m-%dT%H:%M:%SZ) by deployah"
  echo "# repo root at write time: $(pwd)"
  echo "# paths are REPO-ROOT-RELATIVE; verify with:  sha256sum -c $MANIFEST   (from the repo root)"
  find "$DIR" -type f -print0 | sort -z | xargs -0 sha256sum
} > "$MANIFEST"

lines=$(grep -cv '^#' "$MANIFEST")
echo "manifest written: $lines hash lines for $n files"
[ "$lines" = "$n" ] || { echo "REFUSE: hash line count $lines != file count $n" >&2; exit 4; }

echo "verifying from $(pwd) ..."
out=$(sha256sum -c "$MANIFEST" 2>&1)
ok=$(printf '%s\n' "$out" | grep -c ': OK$' || true)
bad=$(printf '%s\n' "$out" | grep -c ': FAILED' || true)
echo "VERIFY: $ok OK / $bad FAILED  (of $n)"
printf '%s\n' "$out" | grep ': FAILED' || true
[ "$bad" = "0" ] && [ "$ok" = "$n" ] || exit 1
echo "manifest OK - $ok/$n verified from the repo root"
exit 0