#!/usr/bin/env bash

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
FIXTURE_ROOT="$REPO_ROOT/tests/conformance/issue-tracker-runtime/app-packs-fixture"
FIXTURE_MODULE="github.com/nexuscrm/app-packs-conformance/issue-tracker"
HARNESS_FILES=(
  "selected_root_capacity_evidence_test.go"
  "selected_root_m2d_a_evidence_test.go"
)
REVISION_FILE="$REPO_ROOT/tests/performance/selected-root-read/revisions.env"
# shellcheck source=../../tests/performance/selected-root-read/revisions.env
source "$REVISION_FILE"

bash -n \
  "$REPO_ROOT/scripts/performance/run-selected-root-capacity-evidence.sh" \
  "$REPO_ROOT/scripts/performance/run-selected-root-m2d-a-evidence.sh" \
  "$REPO_ROOT/scripts/ci/verify-sha256-manifest.sh"

default_files="$(GOWORK=off go -C "$REPO_ROOT/nexuscrm-records" list -f '{{join .GoFiles " "}} {{join .TestGoFiles " "}} {{join .XTestGoFiles " "}}' .)"
for harness_file in "${HARNESS_FILES[@]}"; do
  if grep -Fq "$harness_file" <<<"$default_files"; then
    echo "capacity harness $harness_file entered the default records build/test file set" >&2
    exit 1
  fi
done

production_deps="$(GOWORK=off go -C "$REPO_ROOT/nexuscrm-records" list -deps ./...)"
if grep -Fq "$FIXTURE_MODULE" <<<"$production_deps"; then
  echo "records production dependency closure contains $FIXTURE_MODULE" >&2
  exit 1
fi

records_mod="$(mktemp "$REPO_ROOT/nexuscrm-records/.p1c-m1-ci.XXXXXX.mod")"
records_sum="${records_mod%.mod}.sum"
cleanup() {
  rm -f "$records_mod" "$records_sum"
}
trap cleanup EXIT
cp "$REPO_ROOT/nexuscrm-records/go.mod" "$records_mod"
if [[ -f "$REPO_ROOT/nexuscrm-records/go.sum" ]]; then
  cp "$REPO_ROOT/nexuscrm-records/go.sum" "$records_sum"
fi
(
  cd "$REPO_ROOT/nexuscrm-records"
  go mod edit -modfile="$records_mod" \
    -require="$FIXTURE_MODULE@v0.0.0" \
    -replace="$FIXTURE_MODULE=$FIXTURE_ROOT"
  tagged_files="$(GOWORK=off GOFLAGS="-modfile=$records_mod -mod=mod" go list -tags selected_root_capacity_evidence -f '{{join .TestGoFiles " "}}' .)"
  for harness_file in "${HARNESS_FILES[@]}"; do
    grep -Fq "$harness_file" <<<"$tagged_files" || { echo "tagged capacity harness $harness_file is not selected" >&2; exit 1; }
  done
  GOWORK=off GOFLAGS="-modfile=$records_mod -mod=mod" \
    go test -tags selected_root_capacity_evidence . -run '^$' -count=1
  GOWORK=off GOFLAGS="-modfile=$records_mod -mod=mod" \
    go test -tags selected_root_capacity_evidence . \
      -run '^(TestP1cM1DBStatsPreservesConnectionClosureCounters|TestP1cM2dAStartupConvergence|TestP1cM2dACellWarmupCoversDeclaredConcurrency|TestP1cM2dAEvidenceMode|TestP1cM2dASQLTailModeSelectsOnlyOriginalAnomaly|TestP1cM2dASQLTailHypothesisUsesFocusedCell)$' -count=1

  set +e
  guard_output="$(
    env \
      P1C_M1_OUT_DIR=/tmp/must-not-be-created \
      P1C_M1_CRM_OBJECT_SPEC=/does/not-matter \
      P1C_M1_RUN_ID=unguarded-ci-negative \
      P1C_M1_NEXUSCRM_REVISION=0000000000000000000000000000000000000000 \
      P1C_M1_APP_PACKS_REVISION="$P1C_M1_APP_PACKS_REVISION" \
      P1C_M1_FIXTURE_REVISION="$P1C_M1_FIXTURE_REVISION" \
      GOWORK=off GOFLAGS="-modfile=$records_mod -mod=mod" \
      go test -tags selected_root_capacity_evidence . \
        -run '^TestSelectedRootCapacityEvidence$' -count=1 2>&1
  )"
  guard_rc=$?
  set -e
  if [[ "$guard_rc" == 0 ]]; then
    echo "unguarded tagged capacity invocation unexpectedly succeeded" >&2
    exit 1
  fi
  grep -Fq "P1C_M1_SCRATCH_DATABASE is required" <<<"$guard_output" || {
    echo "unguarded invocation did not fail at the in-harness scratch ownership gate" >&2
    printf '%s\n' "$guard_output" >&2
    exit 1
  }

  set +e
  guard_output="$(
    env \
      P1C_M1_OUT_DIR=/tmp/must-not-be-created \
      P1C_M1_CRM_OBJECT_SPEC=/does/not-matter \
      P1C_M1_RUN_ID=unguarded-m2d-a-ci-negative \
      P1C_M1_NEXUSCRM_REVISION=0000000000000000000000000000000000000000 \
      P1C_M1_APP_PACKS_REVISION="$P1C_M1_APP_PACKS_REVISION" \
      P1C_M1_FIXTURE_REVISION="$P1C_M1_FIXTURE_REVISION" \
      GOWORK=off GOFLAGS="-modfile=$records_mod -mod=mod" \
      go test -tags selected_root_capacity_evidence . \
        -run '^TestSelectedRootM2dAEvidence$' -count=1 2>&1
  )"
  guard_rc=$?
  set -e
  if [[ "$guard_rc" == 0 ]]; then
    echo "unguarded tagged M2d-A invocation unexpectedly succeeded" >&2
    exit 1
  fi
  grep -Fq "P1C_M1_SCRATCH_DATABASE is required" <<<"$guard_output" || {
    echo "unguarded M2d-A invocation did not fail at the in-harness scratch ownership gate" >&2
    printf '%s\n' "$guard_output" >&2
    exit 1
  }
)

echo "selected-root capacity harness compiles only in its explicit test closure and rejects unguarded execution"