#!/usr/bin/env bash
# Post-lane census on kitsubito. Every zero below is preceded by a POSITIVE
# CONTROL through the identical predicate, because a filter that cannot express
# the hunt returns a clean zero.
set -u
OWNER='spt-bootstrap-v1-'
FIXTURE="[ 1] 5470/tcp ALLOW IN Anywhere # ${OWNER}$(printf '0123456789abcdef%.0s' 1 2 3 4)"

echo "== predicate positive control (the same grep, over a fixture that DOES contain an owned rule)"
printf '%s\n' "$FIXTURE" | grep -c -- "$OWNER"

echo "== ufw numbered admissions owned by bootstrap (expect 0)"
sudo ufw status numbered 2>&1 | grep -c -- "$OWNER"
echo "== ufw configured admissions owned by bootstrap (expect 0)"
sudo ufw show added 2>&1 | grep -c -- "$OWNER"
echo "== nft ruleset rules owned by bootstrap (expect 0)"
sudo nft -a list ruleset 2>&1 | grep -c -- "$OWNER"
echo "== firewalld policies (expect: no firewall-cmd on this box)"
command -v firewall-cmd || echo "firewall-cmd absent"

echo "== ufw activity state (context for the numbers above)"
sudo ufw status 2>&1 | head -3

echo "== builder census predicate positive control (a live cargo, seen by the same pgrep)"
( cd ~/spt-core-hertz-linux && source ~/.cargo/env && cargo build -p spt-daemon --lib >/tmp/census-control.log 2>&1 ) &
CONTROL=$!
sleep 4
pgrep -u "$USER" -fa 'cargo|rustc' | grep -v pgrep | wc -l
wait $CONTROL
echo "control cargo exit: $?"

echo "== builder census after the lane (expect 0)"
pgrep -u "$USER" -fa 'cargo|rustc' | grep -v pgrep | wc -l

echo "== worktree state"
cd ~/spt-core-hertz-linux || exit 90
git status --porcelain
git rev-parse HEAD
python3 - <<'PY'
import pathlib, subprocess
text = pathlib.Path("crates/spt-daemon/src/bootstrap_firewall/linux.rs").read_text()
product = text[:text.index("\n#[cfg(test)]\nmod tests {")]
print("product region oid:", subprocess.run(["git","hash-object","--stdin"], input=product,
      capture_output=True, text=True).stdout.strip())
PY