#!/usr/bin/env bash
# witness.sh <phase> — W3 field arm WITNESS run at the FINAL sha (pins from the 13:0xZ dry run baked in).
# Phases: W0 stop rig A daemon (it runs FROM the exe P0 overwrites) | then pin2b.sh P0, P1, P3 | W4 start rig A from the new exe
# | W5 update apply | W6 serve lan --port 5470 | W7 kitsubito rows | W8 again/stop/stop | W9 rig B swap + refusal arm.
set -u
S=/c/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/b5ea4e68-c96e-4a9a-86d2-59e23427bd1d/scratchpad/pin2b
RIGA=C:/Users/decid/spt-rig-a; RIGA_U=/c/Users/decid/spt-rig-a
OUT=$S/out-witness; mkdir -p "$OUT"; LOG=$OUT/witness.log
unset OWL_SESSION_ID SPT_AGENT_ID SPT_ENDPOINT_ID SPT_HOME SPT_POOL_UNCHECKED SPT_SESSION_NAME SPT_ADAPTER SPT_HOST_PID SPT_DOCS_PORT CARGO_TARGET_DIR
step() { local n=$1; shift; echo "[$(date -u +%H:%M:%SZ)] STEP $n START: $*" >> "$LOG"; "$@" > "$OUT/$n.raw" 2>&1; local e=$?; echo "$e" > "$OUT/$n.exit"; echo "[$(date -u +%H:%M:%SZ)] STEP $n EXIT $e" >> "$LOG"; }
EXE=$S/spt-win-head.exe
case "$1" in
 W0) # stop rig A daemon via its OWN exe under the rig home; prove by pid gone
   PID=$(cat "$RIGA_U/daemon.pid" 2>/dev/null); echo "rigA daemon.pid=$PID exe-before=$(powershell -NoProfile -Command "(Get-Process -Id $PID -ErrorAction SilentlyContinue).Path")" >> "$LOG"
   SPT_HOME=$RIGA step w0-stop "$EXE" daemon stop
   sleep 2; echo "pid $PID alive after stop: $(powershell -NoProfile -Command "if (Get-Process -Id $PID -ErrorAction SilentlyContinue) {1} else {0}")" >> "$LOG"
   echo "old releases dir: $(ls "$RIGA_U/releases" 2>&1 | tr '\n' ' ')" >> "$LOG"; rm -rf "$RIGA_U/releases"; echo "releases removed: $(ls -d "$RIGA_U/releases" 2>&1)" >> "$LOG" ;;
 W4) # start rig A from the NEW head exe (scrubbed env, read back)
   echo "exe sha=$(sha256sum "$EXE" | cut -c1-16) win-artifact=$(cut -c1-16 "$S/out/win-artifact.sha")" >> "$LOG"
   step w4-start python "$S/start-rig-a.py" "$EXE" "$OUT/riga-daemon.log"; cat "$OUT/w4-start.raw" >> "$LOG"
   SPT_HOME=$RIGA step w4-status "$EXE" daemon status; head -2 "$OUT/w4-status.raw" >> "$LOG" ;;
 W5) # apply the staged set; witness = exe path sha CHANGES to the staged windows artifact + applied-state phase
   PRE=$(sha256sum "$EXE" | cut -c1-16); echo "pre-apply exe sha=$PRE daemon.pid=$(cat "$RIGA_U/daemon.pid")" >> "$LOG"
   SPT_HOME=$RIGA step w5-apply "$EXE" update apply --finish; cat "$OUT/w5-apply.raw" >> "$LOG"
   sleep 3; NP=$(cat "$RIGA_U/daemon.pid"); echo "post-apply daemon.pid=$NP exe=$(powershell -NoProfile -Command "(Get-Process -Id $NP -ErrorAction SilentlyContinue).Path") exe-sha=$(sha256sum "$EXE" | cut -c1-16) applied-state=$(tr -d '\n ' < "$RIGA_U/releases/applied-state.json" | cut -c1-120)" >> "$LOG"
   ls -la "$S" | grep -E 'spt-win-head' >> "$LOG" ;;
 W6) SPT_HOME=$RIGA step w6-bootstrap "$EXE" serve lan --bootstrap --port 5470; cat "$OUT/w6-bootstrap.raw" >> "$LOG"
   echo "netstat 5470: $(netstat -ano | grep -c ':5470 .*LISTENING')" >> "$LOG"
   NP=$(cat "$RIGA_U/daemon.pid"); echo "daemon $NP listeners: $(netstat -ano | grep LISTENING | grep " $NP\$" | awk '{print $2}' | tr '\n' ' ')" >> "$LOG" ;;
 W7) WSHA=$(cut -c1-64 "$S/out/win-artifact.sha"); LSHA=$(cut -c1-64 "$S/out/linux-artifact.sha"); LSIZE=$(stat -c %s "$S/spt-linux-head")
   step w7-kitsubito ssh reavus@kitsubito "bash -lc 'set -u; U=http://192.168.1.81:5470; cd /tmp; \
     curl -s -m 30 -o sc-linux.json -w \"sidecar-linux HTTP %{http_code} %{size_download}\n\" \$U/bin/x86_64-unknown-linux-gnu/spt.release.json; \
     curl -s -m 30 -o sc-win.json -w \"sidecar-win HTTP %{http_code} %{size_download}\n\" \$U/bin/x86_64-pc-windows-msvc/spt.exe.release.json; \
     cmp -s sc-linux.json sc-win.json && echo SIDECARS_IDENTICAL || echo SIDECARS_DIFFER; head -c 400 sc-linux.json; echo; \
     curl -s -m 30 -o /dev/null -w \"install HTTP %{http_code}\n\" \$U/install; \
     curl -s --max-time 300 -o spt-w3.bin -w \"bin HTTP %{http_code} %{size_download} bytes in %{time_total}s\n\" \$U/bin/x86_64-unknown-linux-gnu/spt; echo rc=\$?; \
     echo expected-size=$LSIZE expected-sha=$LSHA; echo bin-sha=\$(sha256sum spt-w3.bin | cut -c1-64); \
     curl -s -m 8 -o /dev/null -w \"docs-5474 HTTP %{http_code}\n\" http://192.168.1.81:5474/ ; echo docs-rc=\$?'"
   cat "$OUT/w7-kitsubito.raw" >> "$LOG" ;;
 W8) SPT_HOME=$RIGA step w8a-again "$EXE" serve lan --bootstrap --port 5470; head -1 "$OUT/w8a-again.raw" >> "$LOG"
   SPT_HOME=$RIGA step w8b-stop "$EXE" serve lan --stop; cat "$OUT/w8b-stop.raw" >> "$LOG"; echo "netstat 5470 after stop: $(netstat -ano | grep -c ':5470 .*LISTENING')" >> "$LOG"
   step w8c-kpost ssh reavus@kitsubito "curl -s -m 8 -o /dev/null -w 'install-post-stop HTTP %{http_code}\n' http://192.168.1.81:5470/install; echo rc=\$?"; cat "$OUT/w8c-kpost.raw" >> "$LOG"
   SPT_HOME=$RIGA step w8d-stop2 "$EXE" serve lan --stop; cat "$OUT/w8d-stop2.raw" >> "$LOG" ;;
 W9) # rig B: swap daemon to the FINAL kitsubito bin, then the refusal arm
   step w9-rigb ssh reavus@kitsubito "bash -lc 'set -u; export SPT_HOME=/home/reavus/spt-rig-b; unset OWL_SESSION_ID SPT_AGENT_ID SPT_ENDPOINT_ID; B=/home/reavus/spt-core-gate-w2/target/debug/spt; \
     P=\$(cat \$SPT_HOME/daemon.pid); echo before: pid \$P exe=\$(readlink /proc/\$P/exe); \$B daemon stop --force; echo stop rc=\$?; sleep 2; \
     \$B daemon run --detached >/dev/null 2>&1 & sleep 6; N=\$(cat \$SPT_HOME/daemon.pid); echo after: pid \$N exe=\$(readlink /proc/\$N/exe) sha=\$(sha256sum \$B | cut -c1-16) home=\$(tr \"\0\" \"\n\" < /proc/\$N/environ | grep ^SPT_HOME=); \
     \$B serve lan --bootstrap --port 5470; echo rigB-bootstrap-exit=\$?; echo ss-5470-listeners=\$(ss -ltn | grep -c :5470)'"
   cat "$OUT/w9-rigb.raw" >> "$LOG" ;;
 *) echo "W0|W4|W5|W6|W7|W8|W9 (P0/P1/P3 via pin2b.sh)"; exit 2 ;;
esac
tail -6 "$LOG"