#!/usr/bin/env bash
# pin2b.sh <phase> — W3 field arm (GATE-W3-272-PLAN.md §4), phased so each phase is read before the next.
# Every step writes $OUT/<step>.raw + .exit; a pipe tail decides nothing. Witness = (raw)#(line).
set -u
S=/c/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/b5ea4e68-c96e-4a9a-86d2-59e23427bd1d/scratchpad/pin2b
GW=/c/Users/decid/Documents/projects/spt-core/.worktrees/gate-w2-401a19ad
POOL='C:\Users\decid\Documents\projects\spt-core\.worktrees\ws272-w3\target'
POOL_U=/c/Users/decid/Documents/projects/spt-core/.worktrees/ws272-w3/target
KW=/home/reavus/spt-core-gate-w2
RIGA=C:/Users/decid/spt-rig-a
RIGA_U=/c/Users/decid/spt-rig-a
XT=$S/xtask.exe
OUT=$S/out; mkdir -p "$OUT"; LOG=$OUT/pin2b.log
unset OWL_SESSION_ID SPT_AGENT_ID SPT_ENDPOINT_ID SPT_HOME SPT_POOL_UNCHECKED SPT_SESSION_NAME SPT_ADAPTER SPT_HOST_PID
step() { local n=$1; shift; echo "[$(date -u +%H:%M:%SZ)] STEP $n START: $*" >> "$LOG"; "$@" > "$OUT/$n.raw" 2>&1; local e=$?; echo "$e" > "$OUT/$n.exit"; echo "[$(date -u +%H:%M:%SZ)] STEP $n EXIT $e" >> "$LOG"; }
case "$1" in
 P0) # rebuild spt at the CLEAN head in the gate pool (the pool exe after the M3 leg is the MUTATED build)
   cd "$GW" || exit 9; echo "P0 gate HEAD=$(git rev-parse --short HEAD) dirty_tracked=$(git status --short -uno | wc -l) diff_lines=$(git diff | wc -l)" >> "$LOG"
   echo "pre-rebuild pool spt.exe sha=$(sha256sum "$POOL_U/debug/spt.exe" | cut -c1-16)" >> "$LOG"
   CARGO_TARGET_DIR="$POOL" step p0-build cargo build -p spt --bins
   echo "p0 compiled: $(grep -cE 'Compiling (spt-daemon|spt-store|spt) ' "$OUT/p0-build.raw") post-rebuild sha=$(sha256sum "$POOL_U/debug/spt.exe" | cut -c1-16)" >> "$LOG"
   cp "$POOL_U/debug/spt.exe" "$S/spt-win-head.exe"; sha256sum "$S/spt-win-head.exe" > "$OUT/win-artifact.sha"; cat "$OUT/win-artifact.sha" >> "$LOG" ;;
 P1) # linux artifact built at the head on kitsubito, scp'd
   step p1-kbuild ssh reavus@kitsubito "bash -lc 'cd $KW && git rev-parse --short HEAD && git status --porcelain -uno | wc -l && cargo build -p spt --bins 2>&1 | tail -2 && sha256sum target/debug/spt'"
   step p1-scp scp reavus@kitsubito:$KW/target/debug/spt "$S/spt-linux-head"
   sha256sum "$S/spt-linux-head" > "$OUT/linux-artifact.sha"; echo "linux: $(tail -1 "$OUT/p1-kbuild.raw") local=$(cut -c1-16 "$OUT/linux-artifact.sha")" >> "$LOG" ;;
 P2) # pin the rig home to the debug key (never the fleet home)
   PUB=$(grep '^public_hex:' "$S/keygen.txt" | awk '{print $2}')
   step p2-pin "$XT" debug-pin --key-id w3-rig-2026-09-08 --public-key "$PUB" --home "$RIGA"
   echo "release-keys: $(cat "$RIGA_U/identity/release-keys.json" | tr -d '\n ' | cut -c1-200)" >> "$LOG" ;;
 P3) # sign + stage the set INTO the rig home's releases dir; seed only in this step's env
   SEED=$(grep '^seed_hex:' "$S/keygen.txt" | awk '{print $2}')
   cd "$GW" || exit 9
   SPT_DEBUG_RELEASE_SEED="$SEED" step p3-rollout "$XT" debug-rollout --key-id w3-rig-2026-09-08 --artifact "x86_64-pc-windows-msvc=$S/spt-win-head.exe" --artifact "x86_64-unknown-linux-gnu=$S/spt-linux-head" --stage-dir "$RIGA/releases" --state "$S/rollout-state.json"
   grep -E 'DEBUG_ROLLOUT_STAGED|version=|sha' "$OUT/p3-rollout.raw" | head -5 >> "$LOG"; ls -la "$RIGA_U/releases" >> "$LOG" 2>&1 ;;
 *) echo "phase P0|P1|P2|P3 (P4+ are run by hand with the daemon steps)"; exit 2 ;;
esac
tail -4 "$LOG"