#!/usr/bin/env bash
# twohost-ladder-xbox.sh — the CROSS-BOX twohost LADDER (crates/spt-daemon/tests/twohost.rs) on the real
# hosts, in the GOLDEN's own shape (golden.yml twohost-a / twohost-b): kitsubito = role B (seed-holder /
# server), this box = role A (joiner / driver), `cargo test` NOT nextest (the ladder cell runs ~3 min on A
# and nextest's 60s x 4 terminate-after would sit on it), WAIT 900, the real notify-shell for the toast rung.
# Derived from twohost-web-xbox.sh (doyle, W2). No mutation arms: this leg is a WITNESS for the XFER-retirement
# rewrite of the ladder's side-channel (SID_SIGNAL / SID2_SIGNAL / LADDER_DONE on replicated notif rows,
# ruled doyle 2026-09-08 10:37Z), so the readout greps those three markers on the raws.
#
# usage: twohost-ladder-xbox.sh <local-worktree> <kitsubito-worktree> <label>
# env: PEER_K / PEER_H (LAN defaults; tailnet is one-way, F18), NOTIFY_H / NOTIFY_K (notify-shell paths,
#      REQUIRED — an absent bin makes the toast rung skip, which is the vacuity this rig must not hide),
#      WAIT (default 900 as golden).
# Sequence: (1) kitsubito role B DETACHED (nohup + flock + pid file: a stopped local ssh does NOT stop its
# remote command); (2) local role A; (3) wait for B by remote pid; (4) fetch B's raw/exit; readout.
set -u
LW=$1; KW=$2; LABEL=$3
KHOST=reavus@kitsubito
PEER_K=${PEER_K:-192.168.1.168}   # kitsubito (LAN)
PEER_H=${PEER_H:-192.168.1.81}    # hfenduleam (LAN)
: "${NOTIFY_H:?NOTIFY_H=<hfenduleam notify-shell.exe> required}"; : "${NOTIFY_K:?NOTIFY_K=<kitsubito notify-shell> required}"
OUT=$LW/.spt/twohost-ladder-xbox/$LABEL; mkdir -p "$OUT"
ROUT=/tmp/twohost-ladder-xbox-$LABEL
SECRET=rig-doyle-w3-$LABEL
[ -f "$NOTIFY_H" ] || { echo "REFUSE: NOTIFY_H $NOTIFY_H missing" >&2; exit 8; }

# ── (1) role B on kitsubito, detached + flocked; build first so the lock is not held by a compile
date -u +%FT%TZ > "$OUT/started"
ssh "$KHOST" "export PATH=\$HOME/.cargo/bin:\$HOME/.local/bin:\$PATH; [ -f $NOTIFY_K ] || { echo REFUSE: NOTIFY_K missing; exit 8; }; \
  mkdir -p $ROUT && cd $KW && echo procs-before: \$(pgrep -c -f 'twohost-[0-9a-f]+' || true) > $ROUT/procs-before && \
  unset OWL_SESSION_ID SPT_AGENT_ID SPT_ENDPOINT_ID SPT_HOME; \
  cargo test -p spt-daemon --test twohost --no-run > $ROUT/build.raw 2>&1; echo \$? > $ROUT/build.exit; \
  cargo build -p spt --bin spt >> $ROUT/build.raw 2>&1; \
  SPT_TWO_HOST=1 SPT_TWO_HOST_ROLE=b SPT_TWO_HOST_SECRET=$SECRET SPT_TWO_HOST_PEER_IP=$PEER_H SPT_TWO_HOST_WAIT_SECS=${WAIT:-900} SPT_TWO_HOST_NOTIFY_BIN=$NOTIFY_K \
  nohup flock -n $ROUT/lock cargo test -p spt-daemon --test twohost -- --nocapture > $ROUT/b.raw 2>&1 < /dev/null & \
  echo \$! > $ROUT/b.pid; cat $ROUT/b.pid" | tee "$OUT/b.pid"
sleep 20

# ── (2) role A here
cd "$LW" || exit 9
unset OWL_SESSION_ID SPT_AGENT_ID SPT_ENDPOINT_ID SPT_HOME
echo "procs-before: $(tasklist | grep -ci 'twohost-' || true)" > "$OUT/procs-before"
cargo test -p spt-daemon --test twohost --no-run > "$OUT/build.raw" 2>&1; echo $? > "$OUT/build.exit"
cargo build -p spt --bin spt >> "$OUT/build.raw" 2>&1
SPT_TWO_HOST=1 SPT_TWO_HOST_ROLE=a SPT_TWO_HOST_SECRET=$SECRET SPT_TWO_HOST_PEER_IP=$PEER_K SPT_TWO_HOST_WAIT_SECS=${WAIT:-900} SPT_TWO_HOST_NOTIFY_BIN=$NOTIFY_H \
  cargo test -p spt-daemon --test twohost -- --nocapture > "$OUT/a.raw" 2>&1
echo $? > "$OUT/a.exit"

# ── (3) wait for B by remote pid, (4) fetch
BPID=$(cat "$OUT/b.pid")
ssh "$KHOST" "while kill -0 $BPID 2>/dev/null; do sleep 5; done; echo done" >/dev/null
scp -q "$KHOST:$ROUT/b.raw" "$KHOST:$ROUT/build.exit" "$KHOST:$ROUT/procs-before" "$OUT/" 2>/dev/null
ssh "$KHOST" "grep -E 'test result|test two_host' $ROUT/b.raw; tail -3 $ROUT/b.raw" > "$OUT/b.summary" 2>&1
date -u +%FT%TZ > "$OUT/finished"
# cargo test (libtest) has no Summary line: the RUN COUNT is 'test result: ok. N passed' and the cell line is
# 'test two_host_ladder_role_a ... ok'. A 'filtered out' with 0 run = the env never reached the child.
echo "== $LABEL a.exit=$(cat "$OUT/a.exit") a: $(grep -E 'test result' "$OUT/a.raw" | tr -d '\n') | b: $(grep -E 'test result' "$OUT/b.raw" 2>/dev/null | tr -d '\n')"
# MARKERS are the PRINTED witness lines (the SID_SIGNAL/LADDER_DONE consts are wire BODIES on notif rows and never
# reach stdout — measured 0/0 on a WITNESSED run at ff034bf5 2026-09-08 12:31Z; the un-run rig greps were wrong).
for m in 'role B: drive session .* ready' 'B-2 ticker session .* ready' 'ladder-done sent' 'ladder complete' 'A-3 bare-id wake' 'PUMP_PEER_FAIL'; do
  echo "  marker $m: a=$(grep -cE -- "$m" "$OUT/a.raw") b=$(grep -cE -- "$m" "$OUT/b.raw" 2>/dev/null)"
done
grep -E '^test two_host|panicked at' "$OUT/a.raw" | sed 's/^/A: /'
grep -E '^test two_host|panicked at' "$OUT/b.raw" 2>/dev/null | sed 's/^/B: /'