#Requires -Version 5.1

<#
.SYNOPSIS
    Git-based incremental deployment for gongxiangp2.

.DESCRIPTION
    Source of truth is the Git repository. The build server fetches only Git
    deltas, builds a Docker image with cache, pushes commit-tagged images to the
    internal registry, and the production server pulls the selected image.

    This script intentionally does not upload a source tarball from the local
    workstation and does not build on the production server.
#>

param(
    [ValidateSet('production', 'shadow')]
    [string]$Target = 'production',

    [string]$RepoUrl = 'http://git.1080p.hk/WuYongJie/gongxiangp2.git',
    [string]$Branch = 'main',
    [string]$Commit = '',

    [string]$GitUsername = $env:GIT_DEPLOY_USERNAME,
    [string]$GitPassword = $env:GIT_DEPLOY_PASSWORD,
    [string]$GitAuthHeader = $env:GIT_AUTH_HEADER,

    [string]$BuildServerIP = '192.168.40.206',
    [string]$BuildServerUser = 'root',
    [string]$BuildServerPassword = $env:BUILD_SERVER_PASSWORD,
    [string]$BuildServerProxyCommand = $env:BUILD_SERVER_PROXY_COMMAND,
    [string]$BuildServerHostKey = $env:BUILD_SERVER_HOST_KEY,
    [string]$BuildServerKnownHostsFile = $env:BUILD_SERVER_KNOWN_HOSTS_FILE,
    [string]$RemoteBuildDir = '/root/youyidian-3d-git-build',

    [string]$ProdServerIP = '192.168.58.20',
    [string]$ProdServerUser = 'root',
    [string]$ProdServerHostKey = $env:PROD_SERVER_HOST_KEY,
    [string]$ProdServerKnownHostsFile = $env:PROD_SERVER_KNOWN_HOSTS_FILE,

    [int]$RegistryPort = 5000,
    [string]$ImageName = 'youyidian-3d-material',

    [string]$UploadsMount = $env:GONGXIANGP2_UPLOADS_MOUNT,

    [string]$MigrationAuditFile = $env:GONGXIANGP2_MIGRATION_AUDIT_FILE,
    [string]$MigrationAuditSha256 = $env:GONGXIANGP2_MIGRATION_AUDIT_SHA256,
    [string]$MigrationAuditSourceCommit = $env:GONGXIANGP2_MIGRATION_AUDIT_SOURCE_COMMIT,
    # Normal application releases do not run the database migration workflow.
    # This explicit switch is only for a migration batch that already has an
    # independently created and verified audit receipt.
    [switch]$RequireMigrationAudit,

    [string]$DownloadTokenSecret = $env:DOWNLOAD_TOKEN_SECRET,

    [switch]$DryRun,
    [switch]$NoCache,
    [switch]$SkipBuild,
    [switch]$SkipPush,
    # Deploy a previously built, immutable exact-SHA image only after the
    # build server and registry both prove its identity. This is intended for
    # a script-only rollout or a retry; it never falls back to an image tag
    # that has not been verified for the requested commit.
    [switch]$ReuseVerifiedImage,
    [switch]$SkipDeploy,
    [switch]$KeepOldImages,
    [switch]$AggressiveBuildCacheCleanup,
    [switch]$NoRollback,

    # Production returns to the original single-slot replacement workflow:
    # stop the active slot, start the same slot with the new exact image, and
    # roll it back to the previous image if health fails.  Keep the old
    # blue/green implementation below only as historical code while existing
    # runtime artefacts are gradually retired; it is not a release path.
    [ValidateSet('direct')]
    [string]$DeploymentStrategy = 'direct'
)

$ErrorActionPreference = 'Stop'

# Shadow still shares production uploads, transcode runtime markers, and Redis,
# while its separate database lease cannot serialize FFmpeg across environments.
# Keep this entry fail-closed until a dedicated shadow topology is verified.
if ($Target -eq 'shadow') {
    throw 'Target=shadow is disabled fail-closed: use the dedicated shadow deployment entry after uploads/runtime/Redis isolation is configured and verified.'
}

if ($ReuseVerifiedImage -and ($SkipBuild -or $SkipPush -or $SkipDeploy -or $NoCache)) {
    throw '-ReuseVerifiedImage cannot be combined with -SkipBuild, -SkipPush, -SkipDeploy, or -NoCache.'
}

if (-not $SkipDeploy -and ($SkipBuild -or $SkipPush) -and -not $ReuseVerifiedImage) {
    throw 'Production deployment requires a freshly built and pushed exact-SHA image; -SkipBuild and -SkipPush are only allowed together with -SkipDeploy.'
}

if (-not $DryRun -and $Commit -cnotmatch '^[0-9a-f]{40}$') {
    throw 'HTTP Git transport requires -Commit with the exact 40-character lowercase SHA selected on the trusted workstation.'
}

if ($RequireMigrationAudit -and [string]::IsNullOrWhiteSpace($MigrationAuditSourceCommit)) {
    $MigrationAuditSourceCommit = $Commit
}

if ($RequireMigrationAudit -and -not $DryRun -and -not $SkipDeploy) {
    if ($MigrationAuditFile -cnotmatch '^/root/gongxiangp2-migration-audit/[A-Za-z0-9._-]+/applied-[0-9]{8}T[0-9]{6}Z\.json$') {
        throw 'Production deployment requires the immutable apply audit file under /root/gongxiangp2-migration-audit/<batch>/applied-<UTC>.json.'
    }
    if ($MigrationAuditSha256 -cnotmatch '^[0-9a-f]{64}$') {
        throw 'Production deployment requires the exact lowercase SHA-256 of the immutable apply audit file.'
    }
    if ($MigrationAuditSourceCommit -cnotmatch '^[0-9a-f]{40}$') {
        throw 'Production deployment requires the exact lowercase source commit recorded by the approved migration audit.'
    }
}

$trustedRemoteBuildDir = '/root/youyidian-3d-git-build'
if ($RemoteBuildDir -cne $trustedRemoteBuildDir) {
    throw "RemoteBuildDir is fixed to the dedicated build worktree $trustedRemoteBuildDir; arbitrary cleanup targets are forbidden."
}

if (
    -not [string]::IsNullOrWhiteSpace($GitUsername) -or
    -not [string]::IsNullOrWhiteSpace($GitPassword) -or
    -not [string]::IsNullOrWhiteSpace($GitAuthHeader)
) {
    throw 'Inline Git credentials are forbidden. Configure a read-only credential helper on the workstation and build server instead.'
}

$trustedRepoUrl = 'http://git.1080p.hk/WuYongJie/gongxiangp2.git'
$localDryRunRepository = $false
if ($DryRun -and [System.IO.Path]::IsPathRooted($RepoUrl)) {
    $localDryRunRepository = Test-Path -LiteralPath $RepoUrl -PathType Container
}
if (-not $localDryRunRepository -and $RepoUrl -cne $trustedRepoUrl) {
    throw "Production Git repository must be the exact pinned HTTP repository $trustedRepoUrl. URL credentials and arbitrary repositories are forbidden."
}

# Production evidence from 2026-08-02 identifies the dedicated ZFS dataset as
# the current source of truth. The older application-directory path remains an
# explicit, controlled compatibility choice only; never infer a path from an
# existing container because that would preserve a bad mount automatically.
$defaultUploadsMount = '/mnt/PoolOne/youyidian-uploads'
$trustedUploadsMounts = @(
    $defaultUploadsMount,
    '/mnt/PoolOne/apps/youyidian-3d/uploads'
)
if ([string]::IsNullOrWhiteSpace($UploadsMount)) {
    $UploadsMount = $defaultUploadsMount
}
if ($trustedUploadsMounts -cnotcontains $UploadsMount) {
    throw "UploadsMount must be one of the explicitly trusted production paths: $($trustedUploadsMounts -join ', ')"
}

$targetConfig = @{
    production = @{
        Port                   = 4320
        ContainerName          = 'youyidian-3d-material'
        EnvFile                = '.env'
        PublicAppUrl           = 'https://sc.jiansun.vip'
        CorsAllowedOrigins     = 'https://sc.jiansun.vip,http://192.168.58.20:4320'
        DingtalkCallbackOrigin = 'https://sc.jiansun.vip'
        DingtalkInternalReturnOrigins = 'http://192.168.58.20:4320'
        S3PublicDomain         = 'https://s3.jiansun.vip/gongxiangpan'
    }
    shadow = @{
        Port                   = 5320
        ContainerName          = 'youyidian-3d-shadow'
        EnvFile                = '.env.shadow'
        PublicAppUrl           = 'http://192.168.58.20:5320'
        CorsAllowedOrigins     = 'http://192.168.58.20:5320'
        DingtalkCallbackOrigin = 'http://192.168.58.20:5320'
        DingtalkInternalReturnOrigins = 'http://192.168.58.20:5320'
        S3PublicDomain         = 'https://s3.jiansun.vip/gongxiangpan'
    }
}

function Write-Info {
    param([string]$Message)
    Write-Host "[INFO] $Message" -ForegroundColor Cyan
}

function Write-Success {
    param([string]$Message)
    Write-Host "[OK] $Message" -ForegroundColor Green
}

function Write-Warning-Custom {
    param([string]$Message)
    Write-Host "[WARN] $Message" -ForegroundColor Yellow
}

function Write-Error-Custom {
    param([string]$Message)
    Write-Host "[ERR] $Message" -ForegroundColor Red
}

function Write-Step {
    param([string]$Message)
    Write-Host ""
    Write-Host "==================================================" -ForegroundColor Cyan
    Write-Host $Message -ForegroundColor Magenta
    Write-Host "==================================================" -ForegroundColor Cyan
}

function Invoke-PreflightGit {
    param(
        [Parameter(Mandatory = $true)][string]$GitExecutable,
        [Parameter(Mandatory = $true)][string[]]$Arguments,
        [switch]$CaptureOutput
    )

    $previousErrorAction = $ErrorActionPreference
    $previousGitPrompt = $env:GIT_TERMINAL_PROMPT
    $ErrorActionPreference = 'Continue'
    $env:GIT_TERMINAL_PROMPT = '0'
    try {
        $output = & $GitExecutable `
            -c 'http.lowSpeedLimit=1' `
            -c 'http.lowSpeedTime=30' `
            @Arguments 2>&1
        $exitCode = $LASTEXITCODE
    }
    finally {
        $ErrorActionPreference = $previousErrorAction
        $env:GIT_TERMINAL_PROMPT = $previousGitPrompt
    }

    if ($exitCode -ne 0) {
        $detail = Protect-LogLine -Line ((@($output) | ForEach-Object { $_.ToString() }) -join [Environment]::NewLine)
        if ([string]::IsNullOrWhiteSpace($detail)) {
            $detail = 'no diagnostic output'
        }
        throw "Git target preflight failed with exit code ${exitCode}: $detail"
    }

    if ($CaptureOutput) {
        return ((@($output) | ForEach-Object { $_.ToString() }) -join "`n").Trim()
    }
}

function Invoke-LegacyStorageBoundaryPreflight {
    param(
        [Parameter(Mandatory = $true)][string]$RepositoryUrl,
        [Parameter(Mandatory = $true)][string]$TargetBranch,
        [AllowEmptyString()][string]$RequestedCommit
    )

    $scannerPath = Join-Path $PSScriptRoot 'check-legacy-storage-boundaries.mjs'
    if (-not (Test-Path -LiteralPath $scannerPath -PathType Leaf)) {
        throw "Legacy storage boundary scanner is missing: $scannerPath"
    }

    $nodeCommand = Get-Command node -ErrorAction SilentlyContinue
    if (-not $nodeCommand) {
        throw 'Node.js is required for the legacy storage boundary preflight.'
    }

    $gitCommand = Get-Command git -ErrorAction SilentlyContinue
    if (-not $gitCommand) {
        throw 'Git is required to resolve and inspect the exact deployment target.'
    }
    if ([string]::IsNullOrWhiteSpace($RepositoryUrl) -or $RepositoryUrl.StartsWith('-')) {
        throw 'Repository URL is invalid for exact-target preflight.'
    }

    $tempBase = [System.IO.Path]::GetFullPath([System.IO.Path]::GetTempPath()).TrimEnd([char[]]@('\', '/'))
    $tempRoot = Join-Path $tempBase ("gongxiangp2-deploy-preflight-{0}" -f [Guid]::NewGuid().ToString('N'))
    $bareRepository = Join-Path $tempRoot 'target.git'
    $targetCheckout = Join-Path $tempRoot 'target-tree'

    try {
        New-Item -ItemType Directory -Path $tempRoot -Force | Out-Null
        Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
            'check-ref-format', '--branch', $TargetBranch
        )

        $remoteHeadOutput = Invoke-PreflightGit -GitExecutable $gitCommand.Source -CaptureOutput -Arguments @(
            'ls-remote', '--heads', $RepositoryUrl, "refs/heads/$TargetBranch"
        )
        $remoteHeadLines = @($remoteHeadOutput -split "`r?`n" | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
        if ($remoteHeadLines.Count -ne 1) {
            throw "Remote branch $TargetBranch did not resolve to exactly one ref."
        }
        $remoteHeadParts = @($remoteHeadLines[0].Trim() -split '\s+')
        if (
            $remoteHeadParts.Count -ne 2 -or
            $remoteHeadParts[0] -cnotmatch '^[0-9a-f]{40}$' -or
            $remoteHeadParts[1] -cne "refs/heads/$TargetBranch"
        ) {
            throw 'Remote branch did not resolve to one exact commit SHA.'
        }
        $branchCommit = $remoteHeadParts[0]

        $targetCommit = $branchCommit
        if (-not [string]::IsNullOrWhiteSpace($RequestedCommit)) {
            if ($RequestedCommit -cnotmatch '^[0-9a-f]{40}$') {
                throw 'Commit override must be the exact 40-character lowercase Git commit SHA.'
            }
            $targetCommit = $RequestedCommit
        }

        $localRepository = $null
        try {
            $localRepositoryCandidate = Invoke-PreflightGit -GitExecutable $gitCommand.Source -CaptureOutput -Arguments @(
                '-C', $PSScriptRoot, 'rev-parse', '--show-toplevel'
            )
            if (Test-Path -LiteralPath $localRepositoryCandidate -PathType Container) {
                $localRepository = [System.IO.Path]::GetFullPath($localRepositoryCandidate)
            }
        }
        catch {
            $localRepository = $null
        }

        $useLocalObjects = $false
        if ($localRepository) {
            try {
                $resolvedBranchCommit = Invoke-PreflightGit -GitExecutable $gitCommand.Source -CaptureOutput -Arguments @(
                    '-C', $localRepository, 'rev-parse', '--verify', "${branchCommit}^{commit}"
                )
                $resolvedTargetCommit = Invoke-PreflightGit -GitExecutable $gitCommand.Source -CaptureOutput -Arguments @(
                    '-C', $localRepository, 'rev-parse', '--verify', "${targetCommit}^{commit}"
                )
                if ($resolvedBranchCommit -cne $branchCommit -or $resolvedTargetCommit -cne $targetCommit) {
                    throw 'Local Git objects did not resolve to the exact remote commits.'
                }
                Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
                    '-C', $localRepository, 'merge-base', '--is-ancestor', $targetCommit, $branchCommit
                )
                $useLocalObjects = $true
            }
            catch {
                $useLocalObjects = $false
            }
        }

        if ($useLocalObjects) {
            Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
                'clone', '--no-checkout', '--shared', $localRepository, $targetCheckout
            )
            Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
                '-C', $targetCheckout, 'checkout', '--detach', '--force', $targetCommit
            )
        }
        else {
            Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @('init', '--bare', $bareRepository)
            Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
                "--git-dir=$bareRepository",
                'fetch', '--no-tags', '--force',
                $RepositoryUrl,
                "+refs/heads/${TargetBranch}:refs/preflight/branch"
            )
            $fetchedBranchCommit = Invoke-PreflightGit -GitExecutable $gitCommand.Source -CaptureOutput -Arguments @(
                "--git-dir=$bareRepository", 'rev-parse', '--verify', 'refs/preflight/branch^{commit}'
            )
            if ($fetchedBranchCommit -cne $branchCommit) {
                throw 'Fetched branch changed after the exact remote ref was resolved; retry the deployment.'
            }
            $resolvedTargetCommit = Invoke-PreflightGit -GitExecutable $gitCommand.Source -CaptureOutput -Arguments @(
                "--git-dir=$bareRepository", 'rev-parse', '--verify', "${targetCommit}^{commit}"
            )
            if ($resolvedTargetCommit -cne $targetCommit) {
                throw 'Commit override did not resolve to one exact commit SHA.'
            }
            try {
                Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
                    "--git-dir=$bareRepository", 'merge-base', '--is-ancestor', $targetCommit, $branchCommit
                )
            }
            catch {
                throw "Commit override $targetCommit is not reachable from fetched branch $TargetBranch."
            }
            Invoke-PreflightGit -GitExecutable $gitCommand.Source -Arguments @(
                "--git-dir=$bareRepository", 'worktree', 'add', '--detach', $targetCheckout, $targetCommit
            )
        }

        Push-Location $targetCheckout
        try {
            $previousErrorAction = $ErrorActionPreference
            $ErrorActionPreference = 'Continue'
            try {
                $scannerOutput = & $nodeCommand.Source $scannerPath 2>&1
                $scannerExitCode = $LASTEXITCODE
            }
            finally {
                $ErrorActionPreference = $previousErrorAction
            }
        }
        finally {
            Pop-Location
        }

        foreach ($line in @($scannerOutput)) {
            Write-Host (Protect-LogLine -Line $line.ToString())
        }
        if ($scannerExitCode -ne 0) {
            throw "Legacy storage boundary preflight failed for target $targetCommit with exit code $scannerExitCode"
        }

        return $targetCommit
    }
    finally {
        $resolvedTempRoot = [System.IO.Path]::GetFullPath($tempRoot)
        $expectedPrefix = "$tempBase$([System.IO.Path]::DirectorySeparatorChar)gongxiangp2-deploy-preflight-"
        if ($resolvedTempRoot.StartsWith($expectedPrefix, [StringComparison]::OrdinalIgnoreCase)) {
            Remove-Item -LiteralPath $resolvedTempRoot -Recurse -Force -ErrorAction SilentlyContinue
        }
        else {
            Write-Warning-Custom "Skipped unexpected preflight cleanup path: $resolvedTempRoot"
        }
    }
}

function ConvertTo-ShellSingleQuoted {
    param([AllowNull()][string]$Value)
    if ($null -eq $Value) {
        return "''"
    }
    return "'" + $Value.Replace("'", "'\''") + "'"
}

function Get-PlinkPath {
    $candidates = @(
        'C:\Program Files\PuTTY\plink.exe',
        'C:\Program Files (x86)\PuTTY\plink.exe'
    )

    foreach ($candidate in $candidates) {
        if (Test-Path $candidate) {
            return $candidate
        }
    }

    $fromPath = Get-Command plink.exe -ErrorAction SilentlyContinue
    if ($fromPath) {
        return $fromPath.Source
    }

    throw 'Cannot find plink.exe. Please install PuTTY or add plink.exe to PATH.'
}

function Get-PscpPath {
    $candidates = @(
        'C:\Program Files\PuTTY\pscp.exe',
        'C:\Program Files (x86)\PuTTY\pscp.exe'
    )

    foreach ($candidate in $candidates) {
        if (Test-Path $candidate) {
            return $candidate
        }
    }

    $fromPath = Get-Command pscp.exe -ErrorAction SilentlyContinue
    if ($fromPath) {
        return $fromPath.Source
    }

    throw 'Cannot find pscp.exe. Please install PuTTY or add pscp.exe to PATH.'
}

function Assert-Sha256HostFingerprint {
    param(
        [Parameter(Mandatory = $true)][string]$Fingerprint,
        [Parameter(Mandatory = $true)][string]$Label
    )

    if ($Fingerprint -notmatch '^SHA256:[A-Za-z0-9+/]{20,}={0,2}$') {
        throw "$Label must be an explicit SHA256 host fingerprint."
    }
}

function Assert-LocalKnownHostFingerprint {
    param(
        [Parameter(Mandatory = $true)][string]$KnownHostsFile,
        [Parameter(Mandatory = $true)][string]$HostName,
        [Parameter(Mandatory = $true)][string]$ExpectedFingerprint
    )

    if ([string]::IsNullOrWhiteSpace($KnownHostsFile) -or -not (Test-Path -LiteralPath $KnownHostsFile -PathType Leaf)) {
        throw 'BuildServerKnownHostsFile must be a pre-provisioned regular file.'
    }
    $knownHostsItem = Get-Item -LiteralPath $KnownHostsFile -Force
    if (($knownHostsItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) {
        throw 'BuildServerKnownHostsFile must not be a symbolic link or reparse point.'
    }

    $sshKeygen = Get-Command ssh-keygen.exe -ErrorAction SilentlyContinue
    if (-not $sshKeygen) {
        throw 'ssh-keygen.exe is required to verify the pinned build-server host fingerprint.'
    }

    $lookup = & $sshKeygen.Source -F $HostName -f $KnownHostsFile 2>$null
    if ($LASTEXITCODE -ne 0) {
        throw "Build server $HostName is absent from the pinned known_hosts file."
    }

    $fingerprints = @()
    foreach ($line in @($lookup)) {
        $keyLine = $line.ToString().Trim()
        if (-not $keyLine -or $keyLine.StartsWith('#')) {
            continue
        }
        $fingerprintOutput = $keyLine | & $sshKeygen.Source -l -f - -E sha256 2>$null
        if ($LASTEXITCODE -ne 0) {
            throw 'Could not calculate the build-server key fingerprint from known_hosts.'
        }
        foreach ($fingerprintLine in @($fingerprintOutput)) {
            if ($fingerprintLine.ToString() -match '(SHA256:[A-Za-z0-9+/]{20,}={0,2})') {
                $fingerprints += $Matches[1]
            }
        }
    }

    $uniqueFingerprints = @($fingerprints | Sort-Object -Unique)
    if ($uniqueFingerprints.Count -ne 1 -or $uniqueFingerprints[0] -cne $ExpectedFingerprint) {
        throw 'Build-server known_hosts fingerprint does not match BuildServerHostKey exactly.'
    }
}

function Protect-LogLine {
    param([string]$Line)
    $masked = $Line
    foreach ($secret in @($GitPassword, $BuildServerPassword, $DownloadTokenSecret, $GitAuthHeader)) {
        if (-not [string]::IsNullOrEmpty($secret)) {
            $masked = $masked.Replace($secret, '***')
        }
    }
    return $masked
}

function Invoke-BuildServerScript {
    param([string]$ScriptText)

    $usePasswordAuth = -not [string]::IsNullOrWhiteSpace($BuildServerPassword)
    $plinkPath = $null
    $pscpPath = $null
    $sshPath = $null
    $scpPath = $null
    $sshCommonArgs = @()
    $scpCommonArgs = @()

    Assert-Sha256HostFingerprint -Fingerprint $BuildServerHostKey -Label 'BuildServerHostKey'
    Assert-Sha256HostFingerprint -Fingerprint $ProdServerHostKey -Label 'ProdServerHostKey'
    if ([string]::IsNullOrWhiteSpace($ProdServerKnownHostsFile)) {
        throw 'ProdServerKnownHostsFile is required on the build server for the production SSH hop.'
    }

    if ($usePasswordAuth) {
        if (-not [string]::IsNullOrWhiteSpace($BuildServerProxyCommand)) {
            throw 'BuildServerProxyCommand is supported only with OpenSSH key authentication.'
        }
        $plinkPath = Get-PlinkPath
        $pscpPath = Get-PscpPath
    }
    else {
        Assert-LocalKnownHostFingerprint `
            -KnownHostsFile $BuildServerKnownHostsFile `
            -HostName $BuildServerIP `
            -ExpectedFingerprint $BuildServerHostKey
        $sshCommand = Get-Command ssh.exe -ErrorAction SilentlyContinue
        $scpCommand = Get-Command scp.exe -ErrorAction SilentlyContinue
        if (-not $sshCommand -or -not $scpCommand) {
            throw 'Build server password is empty, and OpenSSH ssh.exe/scp.exe were not found for key-based deployment.'
        }
        $sshPath = $sshCommand.Source
        $scpPath = $scpCommand.Source
        $sshCommonArgs = @('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', '-o', "UserKnownHostsFile=$BuildServerKnownHostsFile", '-o', 'ConnectTimeout=10')
        $scpCommonArgs = @('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', '-o', "UserKnownHostsFile=$BuildServerKnownHostsFile", '-o', 'ConnectTimeout=10')
        if (-not [string]::IsNullOrWhiteSpace($BuildServerProxyCommand)) {
            $sshCommonArgs += @('-o', "ProxyCommand=$BuildServerProxyCommand")
            $scpCommonArgs += @('-o', "ProxyCommand=$BuildServerProxyCommand")
        }
    }

    $scriptId = [guid]::NewGuid().ToString('N')
    $localTemp = Join-Path ([System.IO.Path]::GetTempPath()) "git-incremental-deploy-$scriptId.sh"
    $remoteTempDir = "/tmp/gongxiangp2-deploy-$scriptId"
    $remoteTemp = "$remoteTempDir/payload.sh"
    $remotePrepared = $false
    # PowerShell here-string 在 Windows 下使用 CRLF；远端 Bash 会把行尾的
    # `\r` 当作参数内容，导致 `set -euo pipefail` 在脚本第一行就失败。
    # 上传前统一为 LF，保证脚本在 Linux 构建机上可直接执行。
    $normalizedScriptText = $ScriptText.Replace("`r`n", "`n").Replace("`r", "`n")
    [System.IO.File]::WriteAllText($localTemp, $normalizedScriptText, [System.Text.UTF8Encoding]::new($false))

    $authLabel = if ($usePasswordAuth) {
        'password auth'
    }
    elseif (-not [string]::IsNullOrWhiteSpace($BuildServerProxyCommand)) {
        'SSH key auth via proxy command'
    }
    else {
        'SSH key auth'
    }
    Write-Info "Connecting to build server $BuildServerUser@$BuildServerIP ($authLabel)"

    # 原生程序（plink/pscp）会把 git 等子进程的提示信息写到 stderr。
    # 在 ErrorActionPreference=Stop 下，PowerShell 会把这些非致命的 stderr
    # 当成 NativeCommandError 抛出，导致部署在 Git Sync 等阶段误中断。
    # 这里在调用原生程序的局部作用域内改为 Continue，让 stderr 通过 2>&1
    # 合并进管道正常显示；真实失败仍由 $LASTEXITCODE 捕获，不会掩盖错误。
    $previousErrorAction = $ErrorActionPreference
    $ErrorActionPreference = 'Continue'

    try {
        $prepareCommand = "set -eu; umask 077; test ! -e '$remoteTempDir'; mkdir -m 700 '$remoteTempDir'; test -d '$remoteTempDir'; test ! -L '$remoteTempDir'; test -O '$remoteTempDir'; test `"`$(stat -c %a '$remoteTempDir')`" = '700'"
        if ($usePasswordAuth) {
            $prepareOutput = & $plinkPath -batch -hostkey $BuildServerHostKey -pw $BuildServerPassword "$BuildServerUser@$BuildServerIP" $prepareCommand 2>&1
        }
        else {
            $prepareOutput = & $sshPath @sshCommonArgs "$BuildServerUser@$BuildServerIP" $prepareCommand 2>&1
        }
        $prepareExitCode = $LASTEXITCODE
        $prepareOutput |
            ForEach-Object {
                $line = Protect-LogLine -Line ($_.ToString())
                if ($line.Trim()) {
                    Write-Host $line -ForegroundColor Gray
                }
            }
        if ($prepareExitCode -ne 0) {
            return $prepareExitCode
        }
        $remotePrepared = $true

        $remoteSpec = "${BuildServerUser}@${BuildServerIP}:$remoteTemp"
        $copyOutput = $null
        if ($usePasswordAuth) {
            $copyOutput = & $pscpPath -batch -hostkey $BuildServerHostKey -pw $BuildServerPassword $localTemp $remoteSpec 2>&1
        }
        else {
            $copyOutput = & $scpPath @scpCommonArgs $localTemp $remoteSpec 2>&1
        }
        $copyOutput |
            ForEach-Object {
                $line = Protect-LogLine -Line ($_.ToString())
                if ($line.Trim()) {
                    Write-Host $line -ForegroundColor Gray
                }
            }

        if ($LASTEXITCODE -ne 0) {
            return $LASTEXITCODE
        }

        $command = "set -eu; umask 077; test -f '$remoteTemp'; test ! -L '$remoteTemp'; test -O '$remoteTemp'; chmod 600 '$remoteTemp'; test `"`$(stat -c %a '$remoteTemp')`" = '600'; set +e; bash '$remoteTemp'; rc=`$?; set -e; rm -f '$remoteTemp'; rmdir '$remoteTempDir'; exit `$rc"
        $runOutput = $null
        if ($usePasswordAuth) {
            $runOutput = & $plinkPath -batch -hostkey $BuildServerHostKey -pw $BuildServerPassword "$BuildServerUser@$BuildServerIP" $command 2>&1
        }
        else {
            $runOutput = & $sshPath @sshCommonArgs "$BuildServerUser@$BuildServerIP" $command 2>&1
        }
        $runOutput |
            ForEach-Object {
                $line = Protect-LogLine -Line ($_.ToString())
                if ($line -match '^\[OK\]') {
                    Write-Host $line -ForegroundColor Green
                }
                elseif ($line -match '^\[WARN\]') {
                    Write-Host $line -ForegroundColor Yellow
                }
                elseif ($line -match '^\[ERR\]|error|failed|fatal' ) {
                    Write-Host $line -ForegroundColor Red
                }
                else {
                    Write-Host $line -ForegroundColor Gray
                }
            }

        return $LASTEXITCODE
    }
    finally {
        if ($remotePrepared) {
            $cleanupCommand = "rm -f '$remoteTemp'; rmdir '$remoteTempDir' >/dev/null 2>&1 || true"
            if ($usePasswordAuth) {
                $null = & $plinkPath -batch -hostkey $BuildServerHostKey -pw $BuildServerPassword "$BuildServerUser@$BuildServerIP" $cleanupCommand 2>$null
            }
            elseif ($sshPath) {
                $null = & $sshPath @sshCommonArgs "$BuildServerUser@$BuildServerIP" $cleanupCommand 2>$null
            }
        }
        $ErrorActionPreference = $previousErrorAction
        Remove-Item $localTemp -Force -ErrorAction SilentlyContinue
    }
}

$cfg = $targetConfig[$Target]
$rollbackFlag = if ($NoRollback) { '0' } else { '1' }
$proxyReconcilerPath = Join-Path $PSScriptRoot 'local-proxy-reconcile.sh'
if (-not (Test-Path -LiteralPath $proxyReconcilerPath)) {
    throw "Local proxy reconciler is missing: $proxyReconcilerPath"
}
$proxyReconcilerText = [System.IO.File]::ReadAllText($proxyReconcilerPath)
$proxyReconcilerText = $proxyReconcilerText.Replace("`r`n", "`n").Replace("`r", "`n")
$proxyReconcilerBytes = [System.Text.UTF8Encoding]::new($false).GetBytes($proxyReconcilerText)
$proxyReconcilerBase64 = [Convert]::ToBase64String($proxyReconcilerBytes)

$tokens = @{
    '__REPO_URL__'                 = ConvertTo-ShellSingleQuoted $RepoUrl
    '__BRANCH__'                   = ConvertTo-ShellSingleQuoted $Branch
    '__COMMIT__'                   = ConvertTo-ShellSingleQuoted ''
    '__REMOTE_BUILD_DIR__'         = ConvertTo-ShellSingleQuoted $RemoteBuildDir
    '__TARGET__'                   = ConvertTo-ShellSingleQuoted $Target
    '__BUILD_SERVER_IP__'          = ConvertTo-ShellSingleQuoted $BuildServerIP
    '__PROD_SERVER_IP__'           = ConvertTo-ShellSingleQuoted $ProdServerIP
    '__PROD_SERVER_USER__'         = ConvertTo-ShellSingleQuoted $ProdServerUser
    '__PROD_SERVER_HOST_KEY__'     = ConvertTo-ShellSingleQuoted $ProdServerHostKey
    '__PROD_KNOWN_HOSTS_FILE__'    = ConvertTo-ShellSingleQuoted $ProdServerKnownHostsFile
    '__REGISTRY_PORT__'            = ConvertTo-ShellSingleQuoted ([string]$RegistryPort)
    '__IMAGE_NAME__'               = ConvertTo-ShellSingleQuoted $ImageName
    '__UPLOADS_MOUNT__'            = ConvertTo-ShellSingleQuoted $UploadsMount
    '__MIGRATION_AUDIT_FILE__'     = ConvertTo-ShellSingleQuoted $MigrationAuditFile
    '__MIGRATION_AUDIT_SHA256__'   = ConvertTo-ShellSingleQuoted $MigrationAuditSha256
    '__MIGRATION_AUDIT_SOURCE_COMMIT__' = ConvertTo-ShellSingleQuoted $MigrationAuditSourceCommit
    '__REQUIRE_MIGRATION_AUDIT__'  = ConvertTo-ShellSingleQuoted ($(if ($RequireMigrationAudit) { '1' } else { '0' }))
    '__CONTAINER_NAME__'           = ConvertTo-ShellSingleQuoted $cfg.ContainerName
    '__PORT__'                     = ConvertTo-ShellSingleQuoted ([string]$cfg.Port)
    '__ENV_FILE__'                 = ConvertTo-ShellSingleQuoted $cfg.EnvFile
    '__PUBLIC_APP_URL__'           = ConvertTo-ShellSingleQuoted $cfg.PublicAppUrl
    '__CORS_ALLOWED_ORIGINS__'      = ConvertTo-ShellSingleQuoted $cfg.CorsAllowedOrigins
    '__DINGTALK_CALLBACK_ORIGIN__' = ConvertTo-ShellSingleQuoted $cfg.DingtalkCallbackOrigin
    '__DINGTALK_INTERNAL_RETURN_ORIGINS__' = ConvertTo-ShellSingleQuoted $cfg.DingtalkInternalReturnOrigins
    '__S3_PUBLIC_DOMAIN__'         = ConvertTo-ShellSingleQuoted $cfg.S3PublicDomain
    '__DOWNLOAD_TOKEN_SECRET__'    = ConvertTo-ShellSingleQuoted $DownloadTokenSecret
    '__PROXY_RECONCILE_SCRIPT_B64__' = ConvertTo-ShellSingleQuoted $proxyReconcilerBase64
    '__DRY_RUN__'                  = ConvertTo-ShellSingleQuoted ($(if ($DryRun) { '1' } else { '0' }))
    '__NO_CACHE__'                 = ConvertTo-ShellSingleQuoted ($(if ($NoCache) { '1' } else { '0' }))
    '__SKIP_BUILD__'               = ConvertTo-ShellSingleQuoted ($(if ($SkipBuild) { '1' } else { '0' }))
    '__SKIP_PUSH__'                = ConvertTo-ShellSingleQuoted ($(if ($SkipPush) { '1' } else { '0' }))
    '__REUSE_VERIFIED_IMAGE__'     = ConvertTo-ShellSingleQuoted ($(if ($ReuseVerifiedImage) { '1' } else { '0' }))
    '__SKIP_DEPLOY__'              = ConvertTo-ShellSingleQuoted ($(if ($SkipDeploy) { '1' } else { '0' }))
    '__KEEP_OLD_IMAGES__'          = ConvertTo-ShellSingleQuoted ($(if ($KeepOldImages) { '1' } else { '0' }))
    '__AGGRESSIVE_CLEANUP__'       = ConvertTo-ShellSingleQuoted ($(if ($AggressiveBuildCacheCleanup) { '1' } else { '0' }))
    '__ROLLBACK_ON_FAILURE__'      = ConvertTo-ShellSingleQuoted $rollbackFlag
    '__DEPLOYMENT_STRATEGY__'       = ConvertTo-ShellSingleQuoted $DeploymentStrategy
}

$remoteTemplate = @'
set -Eeuo pipefail

REPO_URL=__REPO_URL__
BRANCH=__BRANCH__
COMMIT_INPUT=__COMMIT__
REMOTE_BUILD_DIR=__REMOTE_BUILD_DIR__
TARGET=__TARGET__
BUILD_SERVER_IP=__BUILD_SERVER_IP__
PROD_SERVER_IP=__PROD_SERVER_IP__
PROD_SERVER_USER=__PROD_SERVER_USER__
PROD_SERVER_HOST_KEY=__PROD_SERVER_HOST_KEY__
PROD_KNOWN_HOSTS_FILE=__PROD_KNOWN_HOSTS_FILE__
REGISTRY_PORT=__REGISTRY_PORT__
IMAGE_NAME=__IMAGE_NAME__
UPLOADS_MOUNT=__UPLOADS_MOUNT__
MIGRATION_AUDIT_FILE=__MIGRATION_AUDIT_FILE__
MIGRATION_AUDIT_SHA256=__MIGRATION_AUDIT_SHA256__
MIGRATION_AUDIT_SOURCE_COMMIT=__MIGRATION_AUDIT_SOURCE_COMMIT__
REQUIRE_MIGRATION_AUDIT=__REQUIRE_MIGRATION_AUDIT__
CONTAINER_NAME=__CONTAINER_NAME__
PORT=__PORT__
ENV_FILE=__ENV_FILE__
PUBLIC_APP_URL=__PUBLIC_APP_URL__
CORS_ALLOWED_ORIGINS=__CORS_ALLOWED_ORIGINS__
DINGTALK_CALLBACK_ORIGIN=__DINGTALK_CALLBACK_ORIGIN__
DINGTALK_INTERNAL_RETURN_ORIGINS=__DINGTALK_INTERNAL_RETURN_ORIGINS__
S3_PUBLIC_DOMAIN=__S3_PUBLIC_DOMAIN__
DOWNLOAD_TOKEN_SECRET=__DOWNLOAD_TOKEN_SECRET__
PROXY_RECONCILE_SCRIPT_B64=__PROXY_RECONCILE_SCRIPT_B64__
DRY_RUN=__DRY_RUN__
NO_CACHE=__NO_CACHE__
SKIP_BUILD=__SKIP_BUILD__
SKIP_PUSH=__SKIP_PUSH__
REUSE_VERIFIED_IMAGE=__REUSE_VERIFIED_IMAGE__
SKIP_DEPLOY=__SKIP_DEPLOY__
KEEP_OLD_IMAGES=__KEEP_OLD_IMAGES__
AGGRESSIVE_CLEANUP=__AGGRESSIVE_CLEANUP__
ROLLBACK_ON_FAILURE=__ROLLBACK_ON_FAILURE__
DEPLOYMENT_STRATEGY=__DEPLOYMENT_STRATEGY__

log() { printf '[INFO] %s\n' "$*"; }
ok() { printf '[OK] %s\n' "$*"; }
warn() { printf '[WARN] %s\n' "$*"; }
fail() { printf '[ERR] %s\n' "$*" >&2; exit 1; }

git_cmd() {
  GIT_TERMINAL_PROMPT=0 git \
    -c http.lowSpeedLimit=1 \
    -c http.lowSpeedTime=30 \
    "$@"
}

require_cmd() {
  command -v "$1" >/dev/null 2>&1 || fail "Missing command on build server: $1"
}

start_remote_step() {
  printf '\n==================================================\n'
  printf '%s\n' "$1"
  printf '==================================================\n'
}

start_remote_step "Preflight"
require_cmd git
require_cmd docker
require_cmd curl
require_cmd node
require_cmd ssh
require_cmd ssh-keygen
[ "$REPO_URL" = 'http://git.1080p.hk/WuYongJie/gongxiangp2.git' ] || fail "Build server received an untrusted Git repository URL"
[ "$REMOTE_BUILD_DIR" = '/root/youyidian-3d-git-build' ] || fail "Build directory is not the pinned dedicated worktree"
test -f "$PROD_KNOWN_HOSTS_FILE" || fail "Pinned production known_hosts file is missing on build server"
test ! -L "$PROD_KNOWN_HOSTS_FILE" || fail "Pinned production known_hosts file must not be a symlink"
ssh-keygen -F "$PROD_SERVER_IP" -f "$PROD_KNOWN_HOSTS_FILE" >/dev/null 2>&1 || fail "Pinned production host is absent from known_hosts"
actual_prod_host_key="$(ssh-keygen -F "$PROD_SERVER_IP" -f "$PROD_KNOWN_HOSTS_FILE" 2>/dev/null | awk '!/^#/ { print $2 " " $3 }' | ssh-keygen -lf - -E sha256 2>/dev/null | awk '{print $2}' | sort -u)"
[ "$(printf '%s\n' "$actual_prod_host_key" | sed '/^$/d' | wc -l | tr -d ' ')" = "1" ] || fail "Production known_hosts must resolve to exactly one SHA256 fingerprint"
[ "$actual_prod_host_key" = "$PROD_SERVER_HOST_KEY" ] || fail "Production host key fingerprint does not match the pinned value"
ok "Build server tools are available"

prod_ssh() {
  ssh -o BatchMode=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$PROD_KNOWN_HOSTS_FILE" \
    -o ConnectTimeout=8 -o ServerAliveInterval=3 -o ServerAliveCountMax=10 -o TCPKeepAlive=yes \
    "$PROD_SERVER_USER@$PROD_SERVER_IP" "$@"
}

prod_ssh_script() {
  local remote_command='bash -s --'
  local argument=''
  local quoted_argument=''
  for argument in "$@"; do
    printf -v quoted_argument '%q' "$argument"
    remote_command+=" $quoted_argument"
  done
  prod_ssh "$remote_command"
}

ssh_prod_command() {
  local log_file="$1"
  shift
  prod_ssh "$@" >"$log_file" 2>&1
}

retry_prod_ssh() {
  local log_file="$1"
  shift
  local max_attempts=5
  local attempt

  for attempt in $(seq 1 "$max_attempts"); do
    if ssh_prod_command "$log_file" "$@"; then
      return 0
    fi

    warn "Production SSH check failed, retrying (${attempt}/${max_attempts})"
    cat "$log_file" >&2 || true
    sleep $((attempt * 2))
  done

  return 1
}

REMOTE_HEAD="$(git_cmd ls-remote --heads "$REPO_URL" "$BRANCH" | awk '{print $1}' | head -n 1 || true)"
if [ -z "$REMOTE_HEAD" ]; then
  fail "Cannot read Git branch $BRANCH from $REPO_URL"
fi
ok "Git branch $BRANCH is reachable: ${REMOTE_HEAD:0:12}"
[ -n "$COMMIT_INPUT" ] || fail "Exact preflighted deployment commit is missing"

retry_prod_ssh /tmp/git-deploy-prod-check.log "echo OK" || {
  cat /tmp/git-deploy-prod-check.log >&2 || true
  fail "Cannot reach production server from build server"
}
ok "Production server is reachable from build server"

curl -fsS "http://localhost:${REGISTRY_PORT}/v2/" >/dev/null 2>&1 || {
  fail "Docker registry is not reachable on build server port ${REGISTRY_PORT}"
}
ok "Docker registry is reachable"

if [ "$DRY_RUN" = "1" ]; then
  log "Dry run completed. No code, image, or container was changed."
  exit 0
fi

start_remote_step "Git Sync"
test ! -L "$REMOTE_BUILD_DIR" || fail "Pinned build directory must not be a symbolic link"
if [ -e "$REMOTE_BUILD_DIR" ]; then
  test -d "$REMOTE_BUILD_DIR" || fail "Pinned build path exists but is not a directory; refusing destructive cleanup"
  test -d "$REMOTE_BUILD_DIR/.git" || fail "Pinned build directory is not the expected Git worktree; refusing destructive cleanup"
  test ! -L "$REMOTE_BUILD_DIR/.git" || fail "Pinned build worktree metadata must not be a symbolic link"
  [ "$(realpath -e "$REMOTE_BUILD_DIR")" = "$REMOTE_BUILD_DIR" ] || fail "Pinned build directory resolves to an unexpected path"
  existing_origin="$(git -C "$REMOTE_BUILD_DIR" remote get-url origin 2>/dev/null || true)"
  [ "$existing_origin" = "$REPO_URL" ] || fail "Pinned build worktree origin does not match the trusted repository"
  log "Using verified dedicated Git worktree: $REMOTE_BUILD_DIR"
else
  [ "$(dirname "$REMOTE_BUILD_DIR")" = '/root' ] || fail "Pinned build directory parent is not trusted"
  test -d /root && test ! -L /root || fail "Pinned build directory parent is not a trusted physical directory"
  log "Creating a fresh trusted clone at $REMOTE_BUILD_DIR"
  git_cmd clone --origin origin "$REPO_URL" "$REMOTE_BUILD_DIR"
fi

cd "$REMOTE_BUILD_DIR"
git_cmd fetch --prune origin "$BRANCH"

TARGET_REF="$COMMIT_INPUT"

git checkout -B "$BRANCH" "origin/$BRANCH" >/dev/null 2>&1 || git checkout "$BRANCH"
git reset --hard "$TARGET_REF"
git clean -fdx

COMMIT_SHA="$(git rev-parse HEAD)"
[ "$COMMIT_SHA" = "$COMMIT_INPUT" ] || fail "Git sync did not land on the exact preflighted commit"
if [ "$REQUIRE_MIGRATION_AUDIT" = "1" ] && [ "$SKIP_DEPLOY" != "1" ]; then
  git cat-file -e "${MIGRATION_AUDIT_SOURCE_COMMIT}^{commit}" 2>/dev/null || \
    fail "Migration audit source commit is unavailable in the trusted build worktree"
  git merge-base --is-ancestor "$MIGRATION_AUDIT_SOURCE_COMMIT" "$COMMIT_SHA" || \
    fail "Migration audit source commit is not an ancestor of the deployment commit"
  if [ "$MIGRATION_AUDIT_SOURCE_COMMIT" != "$COMMIT_SHA" ]; then
    git diff --quiet "$MIGRATION_AUDIT_SOURCE_COMMIT" "$COMMIT_SHA" -- prisma/schema.prisma prisma/migrations || \
      fail "Database schema or migrations changed after the approved audit; create a fresh verified migration audit"
    ok "Reusing verified migration audit because Prisma schema and migrations are unchanged"
  fi
fi
SHORT_SHA="$(git rev-parse --short=12 HEAD)"
COMMIT_TAG="${TARGET}-${SHORT_SHA}"
MOVING_TAG="${TARGET}-latest"
REGISTRY_TAG="${BUILD_SERVER_IP}:${REGISTRY_PORT}/${IMAGE_NAME}:${COMMIT_TAG}"
REGISTRY_COMMIT="$REGISTRY_TAG"
REGISTRY_MOVING="${BUILD_SERVER_IP}:${REGISTRY_PORT}/${IMAGE_NAME}:${MOVING_TAG}"
LOCAL_REGISTRY_COMMIT="localhost:${REGISTRY_PORT}/${IMAGE_NAME}:${COMMIT_TAG}"
LOCAL_REGISTRY_MOVING="localhost:${REGISTRY_PORT}/${IMAGE_NAME}:${MOVING_TAG}"

test -f Dockerfile || fail "Dockerfile missing after Git sync"
test -f package.json || fail "package.json missing after Git sync"
test -f "app/api/uploads/[...path]/route.ts" || fail "app/api/uploads fallback route missing"
test -f "app/uploads/[...path]/route.ts" || fail "app/uploads fallback route missing"

ok "Synced to commit $COMMIT_SHA"
log "Image tag: $COMMIT_TAG"

if [ "$REUSE_VERIFIED_IMAGE" = "1" ]; then
  start_remote_step "Verify Existing Image"
  docker pull "$LOCAL_REGISTRY_COMMIT"
  [ "$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$LOCAL_REGISTRY_COMMIT" 2>/dev/null || true)" = "$COMMIT_SHA" ] || \
    fail "Existing exact-SHA image does not contain the requested Git revision"
  docker tag "$LOCAL_REGISTRY_COMMIT" "$REGISTRY_TAG"
  ok "Reusing verified exact-SHA image without rebuilding: $LOCAL_REGISTRY_COMMIT"
elif [ "$SKIP_BUILD" != "1" ]; then
  start_remote_step "Docker Build"
  docker pull "$LOCAL_REGISTRY_MOVING" >/dev/null 2>&1 || true

  build_args=()
  if [ "$NO_CACHE" = "1" ]; then
    build_args+=(--no-cache)
  elif docker image inspect "$LOCAL_REGISTRY_MOVING" >/dev/null 2>&1; then
    build_args+=(--cache-from "$LOCAL_REGISTRY_MOVING")
  fi

  DOCKER_BUILDKIT=1 docker build "${build_args[@]}" \
    --build-arg "VCS_REF=$COMMIT_SHA" \
    -t "$IMAGE_NAME:$COMMIT_TAG" \
    -t "$IMAGE_NAME:$MOVING_TAG" \
    -t "$LOCAL_REGISTRY_COMMIT" \
    -t "$LOCAL_REGISTRY_MOVING" \
    -t "$REGISTRY_COMMIT" \
    -t "$REGISTRY_MOVING" \
    .

  ok "Docker image built: $REGISTRY_COMMIT"
else
  warn "Skipping Docker build by request"
fi

if [ "$REUSE_VERIFIED_IMAGE" = "1" ]; then
  ok "Reusing immutable registry image; no image push is required"
elif [ "$SKIP_PUSH" != "1" ]; then
  start_remote_step "Push Image"
  docker push "$LOCAL_REGISTRY_COMMIT"
  docker push "$LOCAL_REGISTRY_MOVING"
  ok "Pushed image tags: $COMMIT_TAG, $MOVING_TAG"
else
  warn "Skipping image push by request"
fi

resolve_published_image_identity() {
  EXPECTED_MANIFEST_DIGEST="$(curl -fsSI \
    -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
    "http://localhost:${REGISTRY_PORT}/v2/${IMAGE_NAME}/manifests/${COMMIT_TAG}" \
    | tr -d '\r' \
    | awk 'tolower($1) == "docker-content-digest:" { print $2 }' \
    | tail -n 1)"
  [[ "$EXPECTED_MANIFEST_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]] || fail "Registry did not return one immutable manifest digest for the exact commit tag"
  REGISTRY_MANIFEST_JSON="$(curl -fsS \
    -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
    "http://localhost:${REGISTRY_PORT}/v2/${IMAGE_NAME}/manifests/${COMMIT_TAG}")"
  EXPECTED_PLATFORM_MANIFEST_DIGEST="$(printf '%s' "$REGISTRY_MANIFEST_JSON" | node -e '
    const document = JSON.parse(require("node:fs").readFileSync(0, "utf8"))
    if (!Array.isArray(document.manifests)) {
      if (!document.config || typeof document.config.digest !== "string") process.exit(2)
      process.stdout.write("self")
      process.exit(0)
    }
    const matches = document.manifests.filter((entry) =>
      entry && entry.platform && entry.platform.os === "linux" && entry.platform.architecture === "amd64"
    )
    if (matches.length !== 1 || typeof matches[0].digest !== "string") process.exit(3)
    process.stdout.write(matches[0].digest)
  ')"
  if [ "$EXPECTED_PLATFORM_MANIFEST_DIGEST" = "self" ]; then
    REGISTRY_PLATFORM_MANIFEST_JSON="$REGISTRY_MANIFEST_JSON"
  else
    [[ "$EXPECTED_PLATFORM_MANIFEST_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]] || fail "Registry index did not contain exactly one linux/amd64 manifest"
    REGISTRY_PLATFORM_MANIFEST_JSON="$(curl -fsS \
      -H 'Accept: application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
      "http://localhost:${REGISTRY_PORT}/v2/${IMAGE_NAME}/manifests/${EXPECTED_PLATFORM_MANIFEST_DIGEST}")"
  fi
  EXPECTED_IMAGE_ID="$(printf '%s' "$REGISTRY_PLATFORM_MANIFEST_JSON" | node -e '
    const document = JSON.parse(require("node:fs").readFileSync(0, "utf8"))
    const digest = document && document.config && document.config.digest
    if (typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest)) process.exit(2)
    process.stdout.write(digest)
  ')"
  [[ "$EXPECTED_IMAGE_ID" =~ ^sha256:[0-9a-f]{64}$ ]] || fail "Registry platform manifest did not contain one exact config digest"
  REGISTRY_COMMIT="${BUILD_SERVER_IP}:${REGISTRY_PORT}/${IMAGE_NAME}@${EXPECTED_MANIFEST_DIGEST}"
}

if [ "$SKIP_DEPLOY" != "1" ]; then
  resolve_published_image_identity
  ok "Pinned production image: $REGISTRY_COMMIT ($EXPECTED_IMAGE_ID)"
  start_remote_step "Deploy on Production Server"
  log "Ensuring production server can access image $REGISTRY_COMMIT"
  if prod_ssh "docker pull '$REGISTRY_COMMIT'" >/tmp/git-deploy-prod-pull.log 2>&1; then
    ok "Production server pulled image from registry"
  else
    warn "Production server could not pull image directly; streaming image from build server"
    cat /tmp/git-deploy-prod-pull.log >&2 || true
    docker save "$REGISTRY_TAG" | prod_ssh "docker load"
    REGISTRY_COMMIT="$REGISTRY_TAG"
    ok "Image loaded on production server via SSH stream"
  fi

  ACTUAL_PROD_IMAGE_ID="$(prod_ssh "docker image inspect --format '{{.Id}}' '$REGISTRY_COMMIT' 2>/dev/null" | tr -d '\r\n' || true)"
  if [ "$ACTUAL_PROD_IMAGE_ID" != "$EXPECTED_IMAGE_ID" ]; then
    fail "Production image ID differs from the image built on the pinned build server"
  fi
  ok "Production image ID matches the trusted build result: $EXPECTED_IMAGE_ID"

  if ! prod_ssh \
    "test \"\$(docker image inspect --format '{{ index .Config.Labels \"org.opencontainers.image.revision\" }}' '$REGISTRY_COMMIT' 2>/dev/null)\" = '$COMMIT_SHA'"; then
    fail "Production image revision label does not match the exact preflighted Git commit"
  fi
  ok "Production image revision label matches $COMMIT_SHA"

  IFS= read -r -d '' PROD_PAYLOAD <<'PROD_SCRIPT' || true
set -Eeuo pipefail

TARGET="$1"
CONTAINER_NAME="$2"
PORT="$3"
REGISTRY_COMMIT="$4"
EXPECTED_IMAGE_ID="$5"
COMMIT_SHA="$6"
ENV_FILE_PATH="$7"
PUBLIC_APP_URL="$8"
CORS_ALLOWED_ORIGINS="$9"
shift 9
DINGTALK_CALLBACK_ORIGIN="$1"
DINGTALK_INTERNAL_RETURN_ORIGINS="$2"
S3_PUBLIC_DOMAIN="$3"
DOWNLOAD_TOKEN_SECRET="$4"
PROXY_RECONCILE_SCRIPT_B64="$5"
NETWORK_NAME="$6"
UPLOADS_MOUNT="$7"
ROLLBACK_ON_FAILURE="$8"
MIGRATION_AUDIT_FILE="$9"
shift 9
MIGRATION_AUDIT_SHA256="$1"
MIGRATION_AUDIT_SOURCE_COMMIT="$2"
REQUIRE_MIGRATION_AUDIT="$3"
DEPLOYMENT_STRATEGY="${4:-direct}"

log() { printf '[INFO] %s\n' "$*"; }
ok() { printf '[OK] %s\n' "$*"; }
warn() { printf '[WARN] %s\n' "$*"; }
fail() { printf '[ERR] %s\n' "$*" >&2; exit 1; }

create_container() {
  local name="$1"
  local image="$2"
  local publish_host_port="${3:-0}"
  local deploy_version
  local transcode_instance_id
  local sanitized_env_file
  local create_status
  deploy_version="$(date +%s)"
  transcode_instance_id="${name}-${COMMIT_SHA}-${deploy_version}-$$"
  sanitized_env_file="$(mktemp "/run/${CONTAINER_NAME}.env.XXXXXX")" || return 1
  chmod 600 "$sanitized_env_file"
  if ! awk '!/^UPLOAD_DIR=/' "$ENV_FILE_PATH" >"$sanitized_env_file"; then
    rm -f "$sanitized_env_file"
    return 1
  fi

  run_args=(
    docker create
    --name "$name"
    --network "$NETWORK_NAME"
    -v "${UPLOADS_MOUNT}:/app/uploads"
    -v "/mnt/PoolOne/apps/youyidian-3d/public-traffic-logs:/var/log/nginx:ro"
    --env-file "$sanitized_env_file"
    -e "UPLOAD_DIR=/app/uploads"
    -e "USE_REDIS=true"
    -e "REDIS_URL=redis://gongxiangpan-redis:6379"
    -e "NEXTAUTH_URL=$PUBLIC_APP_URL"
    -e "APP_PUBLIC_URL=$PUBLIC_APP_URL"
    -e "CORS_ALLOWED_ORIGINS=$CORS_ALLOWED_ORIGINS"
    -e "NEXT_PUBLIC_DINGTALK_CALLBACK_ORIGIN=$DINGTALK_CALLBACK_ORIGIN"
    -e "DINGTALK_INTERNAL_RETURN_ORIGINS=$DINGTALK_INTERNAL_RETURN_ORIGINS"
    -e "S3_PUBLIC_DOMAIN=$S3_PUBLIC_DOMAIN"
    -e "DISABLE_CACHE=true"
    -e "DEPLOYMENT_VERSION=$deploy_version"
    -e "VIDEO_TRANSCODE_WORKER_ID=$name"
    -e "VIDEO_TRANSCODE_INSTANCE_ID=$transcode_instance_id"
    -e "VIDEO_TRANSCODE_RUNTIME_DIR=/app/uploads/.video-transcode-runtime"
    -e "TASK_DETAIL_UPLOAD_WORKER_ID=$name"
    -e "TASK_DETAIL_UPLOAD_INSTANCE_ID=$transcode_instance_id"
    -e "TASK_DETAIL_UPLOAD_RUNTIME_DIR=/app/uploads/.task-detail-upload-runtime"
    --memory=6g
    --memory-reservation=512m
    --restart=unless-stopped
  )

  if [ "$publish_host_port" = "1" ]; then
    run_args+=(-p "${PORT}:3000")
  fi

  if [ -n "$DOWNLOAD_TOKEN_SECRET" ]; then
    run_args+=(-e "DOWNLOAD_TOKEN_SECRET=$DOWNLOAD_TOKEN_SECRET")
  fi

  if [ -n "${PUBLIC_TRAFFIC_ROLLUP_TOKEN:-}" ]; then
    run_args+=(-e "PUBLIC_TRAFFIC_ROLLUP_TOKEN=$PUBLIC_TRAFFIC_ROLLUP_TOKEN")
  fi

  if "${run_args[@]}" "$image"; then
    rm -f "$sanitized_env_file"
    return 0
  fi
  create_status=$?
  rm -f "$sanitized_env_file"
  return "$create_status"
}

verify_image_revision_label() {
  local image="$1"
  local expected_commit="$2"
  local revision=""
  local image_id=""
  revision="$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$image" 2>/dev/null || true)"
  image_id="$(docker image inspect --format '{{.Id}}' "$image" 2>/dev/null || true)"
  [ "$revision" = "$expected_commit" ] && [ "$image_id" = "$EXPECTED_IMAGE_ID" ]
}

verify_container_baked_revision() {
  local name="$1"
  local expected_commit="$2"
  local revision=""
  local baked=""
  local image_id=""
  revision="$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$name" 2>/dev/null || true)"
  image_id="$(docker inspect --format '{{.Image}}' "$name" 2>/dev/null || true)"
  baked="$(docker exec "$name" sh -c 'cat /app/DEPLOYMENT_COMMIT 2>/dev/null' 2>/dev/null | tr -d '\r\n' || true)"
  [ "$revision" = "$expected_commit" ] && [ "$baked" = "$expected_commit" ] && [ "$image_id" = "$EXPECTED_IMAGE_ID" ]
}

require_file() {
  [ -f "$1" ] || fail "Missing required file: $1"
}

command -v docker >/dev/null 2>&1 || fail "Missing docker on production server"
command -v curl >/dev/null 2>&1 || fail "Missing curl on production server"
command -v flock >/dev/null 2>&1 || fail "Missing flock on production server"
command -v ss >/dev/null 2>&1 || fail "Missing ss on production server; safe connection draining cannot be verified"
command -v base64 >/dev/null 2>&1 || fail "Missing base64 on production server"
command -v findmnt >/dev/null 2>&1 || fail "Missing findmnt on production server; uploads storage identity cannot be verified"
command -v stat >/dev/null 2>&1 || fail "Missing stat on production server; uploads storage identity cannot be verified"
command -v nginx >/dev/null 2>&1 || fail "Missing nginx on production server"
command -v systemctl >/dev/null 2>&1 || fail "Missing systemctl on production server"
command -v sha256sum >/dev/null 2>&1 || fail "Missing sha256sum on production server"
command -v timeout >/dev/null 2>&1 || fail "Missing timeout on production server"

require_file "$ENV_FILE_PATH"

uploads_findmnt_metadata_is_trusted() {
  local mount_path="$1"
  local mount_line="$2"
  local root_line="$3"
  local mount_target=""
  local mount_source=""
  local mount_fstype=""
  local mount_extra=""
  local root_target=""
  local root_source=""
  local root_fstype=""
  local root_extra=""

  [ -n "$mount_line" ] || return 1
  [ -n "$root_line" ] || return 1
  case "$mount_line" in *$'\n'*|*$'\r'*) return 1 ;; esac
  case "$root_line" in *$'\n'*|*$'\r'*) return 1 ;; esac

  read -r mount_target mount_source mount_fstype mount_extra <<< "$mount_line"
  read -r root_target root_source root_fstype root_extra <<< "$root_line"
  [ -n "$mount_target" ] && [ -n "$mount_source" ] && [ -n "$mount_fstype" ] && [ -z "$mount_extra" ] || return 1
  [ "$root_target" = "/" ] && [ -n "$root_source" ] && [ -n "$root_fstype" ] && [ -z "$root_extra" ] || return 1

  case "${mount_path}|${mount_target}|${mount_source}|${mount_fstype}" in
    '/mnt/PoolOne/youyidian-uploads|/mnt/PoolOne/youyidian-uploads|PoolOne/youyidian-uploads|zfs') ;;
    '/mnt/PoolOne/apps/youyidian-3d/uploads|/mnt/PoolOne|PoolOne|zfs') ;;
    *) return 1 ;;
  esac

  [ "$mount_target" != "$root_target" ] || return 1
  [ "$mount_source" != "$root_source" ] || return 1
  UPLOADS_MOUNT_TARGET="$mount_target"
  UPLOADS_MOUNT_SOURCE="$mount_source"
  UPLOADS_MOUNT_FSTYPE="$mount_fstype"
}

host_statfs_signature_is_trusted() {
  local uploads_signature="$1"
  local root_signature="$2"

  case "$uploads_signature" in ''|*$'\n'*|*$'\r'*|*[!0-9a-fA-F:]*) return 1 ;; esac
  case "$root_signature" in ''|*$'\n'*|*$'\r'*|*[!0-9a-fA-F:]*) return 1 ;; esac
  [ "$uploads_signature" != "$root_signature" ]
}

statfs_signatures_match() {
  local host_signature="$1"
  local container_signature="$2"

  case "$host_signature" in ''|*$'\n'*|*$'\r'*|*[!0-9a-fA-F:]*) return 1 ;; esac
  case "$container_signature" in ''|*$'\n'*|*$'\r'*|*[!0-9a-fA-F:]*) return 1 ;; esac
  [ "$host_signature" = "$container_signature" ]
}

uploads_container_mount_metadata_is_trusted() {
  local expected_source="$1"
  local metadata="$2"
  local allow_resolved_source_alias="${3:-0}"
  local matching_metadata=""
  local matching_count=""
  local destination=""
  local mount_type=""
  local source=""
  local read_write=""
  local extra=""
  local resolved_source=""
  local resolved_expected_source=""

  [ -n "$metadata" ] || return 1
  case "$metadata" in *$'\r'*) return 1 ;; esac
  matching_metadata="$(printf '%s\n' "$metadata" | awk -F '\t' '$1 == "/app/uploads" { print }')"
  matching_count="$(printf '%s\n' "$matching_metadata" | awk 'NF { count++ } END { print count + 0 }')"
  [ "$matching_count" = "1" ] || return 1

  IFS=$'\t' read -r destination mount_type source read_write extra <<< "$matching_metadata"
  [ "$destination" = "/app/uploads" ] || return 1
  [ "$mount_type" = "bind" ] || return 1
  if [ "$source" != "$expected_source" ]; then
    # Old production containers were created before UPLOADS_MOUNT was
    # canonicalised.  They may retain the former path spelling in Docker
    # metadata, while resolving to exactly the same verified ZFS dataset.
    # This compatibility is for draining an existing container only; newly
    # created candidates always use the canonical string above.
    [ "$allow_resolved_source_alias" = "1" ] || return 1
    resolved_source="$(readlink -f -- "$source")" || return 1
    resolved_expected_source="$(readlink -f -- "$expected_source")" || return 1
    [ "$resolved_source" = "$resolved_expected_source" ] || return 1
  fi
  [ "$read_write" = "true" ] || return 1
  [ -z "$extra" ]
}

verify_host_uploads_mount() {
  local mount_line=""
  local root_line=""
  local uploads_signature=""
  local root_signature=""

  [ -d "$UPLOADS_MOUNT" ] || {
    warn "Uploads mount path does not exist: $UPLOADS_MOUNT"
    return 1
  }
  if ! mount_line="$(findmnt -rn -o TARGET,SOURCE,FSTYPE -T "$UPLOADS_MOUNT")"; then
    warn "findmnt failed for the configured uploads path"
    return 1
  fi
  if ! root_line="$(findmnt -rn -o TARGET,SOURCE,FSTYPE -T /)"; then
    warn "findmnt failed for the host root filesystem"
    return 1
  fi
  if ! uploads_findmnt_metadata_is_trusted "$UPLOADS_MOUNT" "$mount_line" "$root_line"; then
    warn "Uploads findmnt identity is not an explicitly trusted production tuple"
    return 1
  fi
  if ! uploads_signature="$(stat -f -c '%i:%t' -- "$UPLOADS_MOUNT")"; then
    warn "Cannot read uploads statfs identity"
    return 1
  fi
  if ! root_signature="$(stat -f -c '%i:%t' -- /)"; then
    warn "Cannot read root statfs identity"
    return 1
  fi
  if ! host_statfs_signature_is_trusted "$uploads_signature" "$root_signature"; then
    warn "Uploads path resolves to the root filesystem or has an invalid statfs identity"
    return 1
  fi

  HOST_UPLOADS_STATFS_SIGNATURE="$uploads_signature"
  ok "Uploads mount verified: TARGET=${UPLOADS_MOUNT_TARGET} SOURCE=${UPLOADS_MOUNT_SOURCE} FSTYPE=${UPLOADS_MOUNT_FSTYPE}"
}

container_uploads_mount_metadata() {
  local name="$1"
  docker inspect --format '{{range .Mounts}}{{printf "%s\t%s\t%s\t%t\n" .Destination .Type .Source .RW}}{{end}}' "$name"
}

verify_container_uploads_mount_metadata() {
  local name="$1"
  local allow_resolved_source_alias="${2:-0}"
  local metadata=""

  if ! metadata="$(container_uploads_mount_metadata "$name")"; then
    warn "Cannot inspect uploads mount metadata for container ${name}"
    return 1
  fi
  if ! uploads_container_mount_metadata_is_trusted "$UPLOADS_MOUNT" "$metadata" "$allow_resolved_source_alias"; then
    warn "Container ${name} does not have exactly one trusted RW bind mount at /app/uploads"
    return 1
  fi
}

verify_container_upload_dir_config() {
  local name="$1"
  local require_exact="${2:-0}"
  local env_lines=""
  local count="0"
  local value=""

  if ! env_lines="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$name")"; then
    warn "Cannot inspect UPLOAD_DIR for container ${name}"
    return 1
  fi
  count="$(printf '%s\n' "$env_lines" | awk '/^UPLOAD_DIR=/{count++} END{print count+0}')"
  value="$(printf '%s\n' "$env_lines" | awk -F= '/^UPLOAD_DIR=/{sub(/^UPLOAD_DIR=/, ""); print}')"
  if [ "$require_exact" = "1" ]; then
    if [ "$count" != "1" ] || [ "$value" != "/app/uploads" ]; then
      warn "Container ${name} must declare exactly UPLOAD_DIR=/app/uploads"
      return 1
    fi
    return 0
  fi
  if [ "$count" = "0" ]; then
    return 0
  fi
  if [ "$count" = "1" ] && { [ "$value" = "/app/uploads" ] || [ "$value" = "./uploads" ]; }; then
    return 0
  fi
  warn "Existing container ${name} has an unsafe UPLOAD_DIR override"
  return 1
}

verify_container_upload_dir_runtime() {
  local name="$1"
  local require_exact="${2:-0}"
  verify_container_upload_dir_config "$name" "$require_exact" || return 1
  docker exec "$name" node -e '
const path = require("path");
const configured = String(process.env.UPLOAD_DIR || "").trim();
const resolved = configured ? path.resolve(configured) : path.join(process.cwd(), "uploads");
if (resolved !== "/app/uploads") process.exit(1);
' >/dev/null 2>&1 || {
    warn "Container ${name} application upload root does not resolve to /app/uploads"
    return 1
  }
}

verify_container_uploads_statfs() {
  local name="$1"
  local container_signature=""

  if ! container_signature="$(docker exec "$name" stat -f -c '%i:%t' -- /app/uploads)"; then
    warn "Cannot read /app/uploads statfs identity from container ${name}"
    return 1
  fi
  if ! statfs_signatures_match "$HOST_UPLOADS_STATFS_SIGNATURE" "$container_signature"; then
    warn "Container ${name} /app/uploads statfs identity differs from the verified host data disk"
    return 1
  fi
}

verify_container_uploads_storage() {
  local name="$1"
  local require_exact="${2:-0}"
  local allow_resolved_source_alias="0"
  [ "$require_exact" = "1" ] || allow_resolved_source_alias="1"
  verify_container_uploads_mount_metadata "$name" "$allow_resolved_source_alias" || return 1
  verify_container_uploads_statfs "$name" || return 1
  verify_container_upload_dir_runtime "$name" "$require_exact"
}

# This gate is intentionally before every container discovery, drain, start,
# stop, or proxy mutation below. A directory shell on the root disk must never
# be allowed to seed a second uploads/runtime universe.
if ! verify_host_uploads_mount; then
  fail "Production uploads data disk could not be proven; no container or traffic was changed"
fi
docker network inspect "$NETWORK_NAME" >/dev/null 2>&1 || fail "Docker network missing: $NETWORK_NAME"

log "Checking image $REGISTRY_COMMIT"
if docker image inspect "$REGISTRY_COMMIT" >/dev/null 2>&1; then
  ok "Image already available on production server"
else
  docker pull "$REGISTRY_COMMIT"
fi
[[ "$EXPECTED_IMAGE_ID" =~ ^sha256:[0-9a-f]{64}$ ]] || fail "Trusted build image ID is missing or malformed"
ACTUAL_IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$REGISTRY_COMMIT" 2>/dev/null || true)"
[ "$ACTUAL_IMAGE_ID" = "$EXPECTED_IMAGE_ID" ] || fail "Production image differs from the exact artifact built on the pinned build server"
ok "Production image identity is pinned to $EXPECTED_IMAGE_ID"

PROXY_ROOT="/mnt/PoolOne/apps/youyidian-3d/local-proxy/${CONTAINER_NAME}"
PROXY_CONF="${PROXY_ROOT}/nginx.conf"
PROXY_PID="${PROXY_ROOT}/nginx.pid"
PROXY_SERVICE="${CONTAINER_NAME}-local-proxy.service"
CURRENT_FILE="${PROXY_ROOT}/current-container"
PROXY_RECONCILE_SCRIPT="${PROXY_ROOT}/reconcile-upstream.sh"
PROXY_RECONCILE_SERVICE="${CONTAINER_NAME}-local-proxy-reconcile.service"
PROXY_RECONCILE_TIMER="${CONTAINER_NAME}-local-proxy-reconcile.timer"
PROXY_RECONCILE_LOCK="/run/${CONTAINER_NAME}-local-proxy-reconcile.lock"
DEPLOY_LOCK="/run/${CONTAINER_NAME}-production-deploy.lock"
BOOTSTRAP_ROOT="${PROXY_ROOT}/legacy-bootstrap"
PROXY_CONFIG_REPLACED=0
PROXY_CONFIG_BACKUP=""
BLUE_CONTAINER="${CONTAINER_NAME}-blue"
GREEN_CONTAINER="${CONTAINER_NAME}-green"
PUBLIC_TRAFFIC_SYNC_ROOT="/mnt/PoolOne/apps/youyidian-3d/public-traffic-sync"
PUBLIC_TRAFFIC_ROLLUP_TOKEN_FILE="${PUBLIC_TRAFFIC_SYNC_ROOT}/rollup.token"
PUBLIC_TRAFFIC_LOG_SYNC_SCRIPT="${PUBLIC_TRAFFIC_SYNC_ROOT}/public-traffic-log-sync.sh"
PUBLIC_TRAFFIC_ROLLUP_SCRIPT="${PUBLIC_TRAFFIC_SYNC_ROOT}/public-traffic-rollup-sync.sh"
PUBLIC_TRAFFIC_ROLLUP_SERVICE="public-traffic-rollup-sync.service"
PUBLIC_TRAFFIC_ROLLUP_TIMER="public-traffic-rollup-sync.timer"
PUBLIC_TRAFFIC_ROLLUP_TOKEN=""
READY_BOOTSTRAP_HANDOFF=""

exec 9>"$DEPLOY_LOCK"
flock -w 30 9 || fail "Another production deployment or legacy bootstrap transition is already running"

verify_migration_audit_evidence() {
  if [ "$REQUIRE_MIGRATION_AUDIT" != "1" ]; then
    ok "Migration audit is not required for this normal application release"
    return 0
  fi
  [ "$TARGET" = "production" ] || return 0
  case "$MIGRATION_AUDIT_FILE" in
    /root/gongxiangp2-migration-audit/*/applied-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z.json) ;;
    *) fail "Migration apply audit path is outside the immutable production audit tree" ;;
  esac
  [ -f "$MIGRATION_AUDIT_FILE" ] && [ ! -L "$MIGRATION_AUDIT_FILE" ] || fail "Migration apply audit file is missing or not a regular file"
  [ "$(stat -c '%a' "$MIGRATION_AUDIT_FILE")" = "600" ] || fail "Migration apply audit file permissions must be 0600"
  [ "$(sha256sum "$MIGRATION_AUDIT_FILE" | awk '{print $1}')" = "$MIGRATION_AUDIT_SHA256" ] || fail "Migration apply audit SHA-256 does not match approved evidence"
  docker run --rm -i --network none --read-only --user 0:0 --cap-drop ALL --security-opt no-new-privileges --cap-add DAC_READ_SEARCH \
    -e MIGRATION_AUDIT_SOURCE_COMMIT="$MIGRATION_AUDIT_SOURCE_COMMIT" \
    -v "$MIGRATION_AUDIT_FILE:/approved-migration-audit.json:ro" \
    -v "$ENV_FILE_PATH:/approved-production.env:ro" \
    --entrypoint node "$REGISTRY_COMMIT" <<'NODE'
const fs = require('fs');
const audit = JSON.parse(fs.readFileSync('/approved-migration-audit.json', 'utf8'));
if (audit.mode !== 'apply' || audit.verified !== true || audit.sourceCommit !== process.env.MIGRATION_AUDIT_SOURCE_COMMIT) process.exit(1);
const env = Object.fromEntries(fs.readFileSync('/approved-production.env', 'utf8').split(/\r?\n/)
  .filter((line) => line && !line.trimStart().startsWith('#') && line.includes('='))
  .map((line) => { const index = line.indexOf('='); return [line.slice(0, index), line.slice(index + 1)]; }));
const url = new URL(env.DATABASE_URL || '');
const database = audit.database || {};
const expected = {
  configuredHost: url.hostname,
  configuredPort: url.port || '5432',
  configuredDatabase: decodeURIComponent(url.pathname.replace(/^\//, '')),
  configuredUser: decodeURIComponent(url.username),
};
if (Object.entries(expected).some(([key, value]) => String(database[key] || '') !== value)) process.exit(1);
const migrations = Array.isArray(audit.targetMigrations) ? audit.targetMigrations : [];
const expectedMigrationNames = new Set([
  '20260811_add_video_transcode_lease',
  '20260811_update_brand_logo_defaults',
  '20260812_add_product_package_upload_job_lease',
  '20260812_align_material_upload_idempotency_index',
  '20260813_add_material_custody_department',
  '20260813_add_organization_units_and_employment_state',
  '20260813_add_user_employee_binding',
  '20260817_add_material_is_incomplete_shell',
  '20260820_add_ding_workflow_snapshots',
  '20260824_expand_ding_workflow_insights',
  '20260826_add_ding_workflow_demand_type',
  '20260827_add_ding_workflow_detail_fields',
  '20260826_add_pack_video_early_access',
  '20260828_add_pack_item_can_edit_assets',
  '20260828_add_task_detail_change_approvals',
  '20260829_add_recoverable_api_key_secret',
  '20260831_add_private_task_detail',
  '20260902_add_employee_roster_history',
  '20260903_add_work_review_brand',
  '20260908_add_brand_knowledge',
  '20260909_expand_brand_knowledge_upload',
  '20260914_add_brand_knowledge_engagement',
  '20260914_expand_brand_knowledge_download_count',
  '20260914_expand_brand_knowledge_preview_slices',
  '20260915_add_brand_knowledge_soft_delete',
  '20260918_add_performance_conversion_sync',
]);
if (migrations.length !== expectedMigrationNames.size
  || migrations.some((item) => !expectedMigrationNames.has(item && item.name)
    || item.completed !== true
    || item.sourceChecksum !== item.databaseChecksum)
  || new Set(migrations.map((item) => item.name)).size !== expectedMigrationNames.size) process.exit(1);
if (!database.actualDatabase || !database.actualUser || !database.serverAddress || !database.serverPort) process.exit(1);
NODE
}

verify_migration_audit_evidence

verify_candidate_database_identity() {
  [ "$REQUIRE_MIGRATION_AUDIT" = "1" ] || return 0
  local name="$1"
  docker exec -i "$name" node -e '
const { PrismaClient } = require("@prisma/client");
(async () => {
  const chunks = [];
  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
  const input = Buffer.concat(chunks).toString("utf8");
  const audit = JSON.parse(input);
  const expected = audit.database || {};
  const url = new URL(process.env.DATABASE_URL || "");
  const configured = {
    configuredHost: url.hostname,
    configuredPort: url.port || "5432",
    configuredDatabase: decodeURIComponent(url.pathname.replace(/^\//, "")),
    configuredUser: decodeURIComponent(url.username),
  };
  const prisma = new PrismaClient();
  try {
    const rows = await prisma.$queryRawUnsafe(`SELECT current_database() AS database, current_user AS user, inet_server_addr()::text AS server_address, inet_server_port()::text AS server_port`);
    const actual = rows[0] || {};
    const ok = Object.entries(configured).every(([key, value]) => String(expected[key] || "") === value)
      && String(actual.database || "") === String(expected.actualDatabase || "")
      && String(actual.user || "") === String(expected.actualUser || "")
      && String(actual.server_address || "") === String(expected.serverAddress || "")
      && String(actual.server_port || "") === String(expected.serverPort || "");
    if (!ok) process.exitCode = 1;
  } finally {
    await prisma.$disconnect();
  }
})().catch((error) => { process.stderr.write(String(error && error.message || error)); process.exitCode = 1; });
' < "$MIGRATION_AUDIT_FILE"
}

verify_candidate_authenticated_s3() {
  local name="$1"
  docker exec "$name" node -e '
const { S3Client, HeadBucketCommand } = require("@aws-sdk/client-s3");
const required = ["S3_ENDPOINT", "S3_BUCKET", "S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY"];
if (required.some((name) => !String(process.env[name] || "").trim())) process.exit(1);
const endpoint = String(process.env.S3_ENDPOINT).split("#")[0].trim();
const client = new S3Client({
  endpoint,
  region: process.env.S3_REGION || "us-east-1",
  credentials: { accessKeyId: process.env.S3_ACCESS_KEY_ID, secretAccessKey: process.env.S3_SECRET_ACCESS_KEY },
  forcePathStyle: true,
  maxAttempts: 2,
});
(async () => {
  try {
    await client.send(new HeadBucketCommand({ Bucket: process.env.S3_BUCKET }), { abortSignal: AbortSignal.timeout(12000) });
  } finally {
    client.destroy();
  }
})().catch((error) => { process.stderr.write(String(error && error.message || error)); process.exitCode = 1; });
'
}

decode_image_stream_with_candidate() {
  local name="$1"
  docker exec -i "$name" node -e '
const sharp = require("sharp");
(async () => {
  const chunks = [];
  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
  const input = Buffer.concat(chunks);
  if (!input.length) throw new Error("image input is empty");
  await sharp(input, { failOn: "error", limitInputPixels: 25000000, animated: false }).rotate().toBuffer();
})().catch((error) => { process.stderr.write(String(error && error.message || error)); process.exitCode = 1; });
'
}

verify_candidate_baked_brand_assets() {
  local name="$1"
  docker exec "$name" node -e '
const sharp = require("sharp");
Promise.all(["header-logo.png", "login-logo.png", "favicon.png"].map((name) =>
  sharp(`/app/public/brand/${name}`, { failOn: "error", limitInputPixels: 25000000, animated: false }).rotate().toBuffer()
)).catch((error) => { process.stderr.write(String(error && error.message || error)); process.exitCode = 1; });
'
}

verify_candidate_configured_brand_assets() {
  local name="$1"
  local candidate_ip="$2"
  local prefix="/tmp/git-deploy-candidate-brand"
  local logo_index=0
  local logo_url=""
  local resolved_logo_url=""
  local logo_content_type=""

  curl -fsS --max-time 12 "http://${candidate_ip}:3000/api/system-settings" > "${prefix}-settings.json" || return 1
  docker exec -i -e PUBLIC_APP_URL="$PUBLIC_APP_URL" "$name" node -e '
(async () => {
  const chunks = [];
  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
  const settings = JSON.parse(Buffer.concat(chunks).toString("utf8"));
  const origin = new URL(process.env.PUBLIC_APP_URL);
  const values = [settings.headerLogoUrl, settings.loginLogoUrl];
  if (!values.every((value) => typeof value === "string" && value.length > 0)) process.exit(1);
  const normalized = values.map((value) => {
    const parsed = new URL(value, origin);
    const local = parsed.origin === origin.origin && /^\/brand\/[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(parsed.pathname)
      && !parsed.search && !parsed.hash;
    const s3 = parsed.protocol === "https:" && parsed.hostname === "s3.jiansun.vip"
      && parsed.port === "" && parsed.pathname.startsWith("/gongxiangpan/") && !parsed.search && !parsed.hash;
    if (!local && !s3) process.exit(1);
    return local ? parsed.pathname : parsed.href;
  });
  process.stdout.write(normalized.join("\n") + "\n");
})().catch((error) => { process.stderr.write(String(error && error.message || error)); process.exitCode = 1; });
' < "${prefix}-settings.json" > "${prefix}-urls.txt" || return 1

  while IFS= read -r logo_url; do
    [ -n "$logo_url" ] || return 1
    logo_index=$((logo_index + 1))
    case "$logo_url" in
      /brand/*) resolved_logo_url="http://${candidate_ip}:3000${logo_url}" ;;
      https://s3.jiansun.vip/gongxiangpan/*) resolved_logo_url="$logo_url" ;;
      *) return 1 ;;
    esac
    curl -fsS --max-time 12 -D "${prefix}-${logo_index}.headers" \
      -o "${prefix}-${logo_index}.body" "$resolved_logo_url" || return 1
    logo_content_type="$(tr -d '\r' <"${prefix}-${logo_index}.headers" | sed -nE 's/^Content-Type:[[:space:]]*([^;[:space:]]+).*$/\1/Ip' | tail -n 1 | tr 'A-Z' 'a-z')"
    case "$logo_content_type" in image/*) ;; *) return 1 ;; esac
    decode_image_stream_with_candidate "$name" < "${prefix}-${logo_index}.body" || return 1
  done < "${prefix}-urls.txt"

  [ "$logo_index" -eq 2 ]
}

verify_candidate_brand_and_storage_dependencies() {
  local name="$1"
  local candidate_ip="$2"
  verify_candidate_authenticated_s3 "$name" || return 1
  verify_candidate_baked_brand_assets "$name" || return 1
  verify_candidate_configured_brand_assets "$name" "$candidate_ip" || return 1
}

verify_ready_bootstrap_handoff_evidence() {
  local handoff="$1"
  local evidence_name=""
  local legacy_container_id=""
  local legacy_image_id=""
  local legacy_image_repo_digest=""
  local legacy_upstream=""
  local legacy_ip=""
  local uploads_signature=""
  local preserved_container=""
  local expected_preserved_container=""
  local preserved_identity=""
  local expected_identity=""
  local repo_digests=""
  local mount_metadata=""
  local published_endpoints=""
  local octet=""
  local -a legacy_octets=()

  [ -d "$handoff" ] && [ ! -L "$handoff" ] || fail "Bootstrap handoff evidence is not a physical directory"
  [ "$(stat -c '%a' "$handoff")" = "700" ] || fail "Bootstrap handoff directory permissions must be 0700"
  for evidence_name in target-commit legacy-container-id legacy-image-id legacy-image-repo-digest legacy-upstream uploads-statfs-signature preserved-container handoff.ready; do
    [ -f "$handoff/$evidence_name" ] && [ ! -L "$handoff/$evidence_name" ] || fail "Bootstrap handoff evidence is missing or not a regular file: $evidence_name"
    [ "$(stat -c '%a' "$handoff/$evidence_name")" = "600" ] || fail "Bootstrap handoff evidence permissions must be 0600: $evidence_name"
  done

  [ "$(tr -d '\r\n' < "$handoff/target-commit")" = "$COMMIT_SHA" ] || fail "Bootstrap handoff targets a different Git commit"
  [ "$(tr -d '\r\n' < "$handoff/handoff.ready")" = "ready" ] || fail "Bootstrap handoff ready marker is invalid"
  legacy_container_id="$(tr -d '\r\n' < "$handoff/legacy-container-id")"
  legacy_image_id="$(tr -d '\r\n' < "$handoff/legacy-image-id")"
  legacy_image_repo_digest="$(tr -d '\r\n' < "$handoff/legacy-image-repo-digest")"
  legacy_upstream="$(tr -d '\r\n' < "$handoff/legacy-upstream")"
  uploads_signature="$(tr 'A-F' 'a-f' < "$handoff/uploads-statfs-signature" | tr -d '\r\n')"
  preserved_container="$(tr -d '\r\n' < "$handoff/preserved-container")"

  [[ "$legacy_container_id" =~ ^[0-9a-f]{64}$ ]] || fail "Bootstrap handoff legacy container ID is malformed"
  [[ "$legacy_image_id" =~ ^sha256:[0-9a-f]{64}$ ]] || fail "Bootstrap handoff legacy image ID is malformed"
  [[ "$legacy_image_repo_digest" =~ ^[A-Za-z0-9._:/-]+@sha256:[0-9a-f]{64}$ ]] || fail "Bootstrap handoff legacy RepoDigest is malformed"
  [[ "$legacy_upstream" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}:3000$ ]] || fail "Bootstrap handoff legacy upstream is malformed"
  legacy_ip="${legacy_upstream%:3000}"
  IFS='.' read -r -a legacy_octets <<< "$legacy_ip"
  [ "${#legacy_octets[@]}" = "4" ] || fail "Bootstrap handoff legacy IPv4 address is malformed"
  for octet in "${legacy_octets[@]}"; do
    (( 10#$octet <= 255 )) || fail "Bootstrap handoff legacy IPv4 address is out of range"
  done
  [ "$uploads_signature" = "$(printf '%s' "$HOST_UPLOADS_STATFS_SIGNATURE" | tr 'A-F' 'a-f')" ] || fail "Bootstrap handoff uploads statfs identity changed"

  expected_preserved_container="${CONTAINER_NAME}-legacy-${COMMIT_SHA:0:12}-${legacy_container_id:0:12}"
  [ "$preserved_container" = "$expected_preserved_container" ] || fail "Bootstrap handoff preserved container name is not deterministic"
  if ! preserved_identity="$(docker inspect --format '{{printf "%s\t%s\t%s\t%t\t%t" .Id .Image .State.Status .State.Running .State.Paused}}' "$preserved_container")"; then
    fail "Preserved legacy container is missing"
  fi
  expected_identity="${legacy_container_id}"$'\t'"${legacy_image_id}"$'\t'exited$'\t'false$'\t'false
  [ "$preserved_identity" = "$expected_identity" ] || fail "Preserved legacy container is not the exact stopped handoff identity"

  if ! repo_digests="$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$legacy_image_id")"; then
    fail "Preserved legacy image is missing"
  fi
  [ "$(printf '%s\n' "$repo_digests" | grep -Fxc -- "$legacy_image_repo_digest")" = "1" ] || fail "Preserved legacy image RepoDigest changed"
  if ! mount_metadata="$(container_uploads_mount_metadata "$preserved_container")"; then
    fail "Preserved legacy uploads mount metadata is unavailable"
  fi
  uploads_container_mount_metadata_is_trusted "$UPLOADS_MOUNT" "$mount_metadata" || fail "Preserved legacy uploads bind changed"
  if ! published_endpoints="$(docker port "$preserved_container" 3000/tcp 2>/dev/null | tr -d '\r' | sort -u | paste -sd, -)"; then
    fail "Preserved legacy published endpoints are unavailable"
  fi
  [ "$published_endpoints" = "0.0.0.0:${PORT},[::]:${PORT}" ] || fail "Preserved legacy published endpoints changed"
}

verify_bootstrap_handoff_if_present() {
  [ "$TARGET" = "production" ] || return 0
  local handoff=""
  local ready_count=0
  local runtime_target=""
  while IFS= read -r handoff; do
    [ -n "$handoff" ] || continue
    [ ! -e "$handoff/consumed" ] || continue
    ready_count=$((ready_count + 1))
    READY_BOOTSTRAP_HANDOFF="$handoff"
  done < <(find "$BOOTSTRAP_ROOT" -mindepth 2 -maxdepth 2 -type f -name handoff.ready -printf '%h\n' 2>/dev/null)
  [ "$ready_count" -le 1 ] || fail "Multiple ready bootstrap handoffs are ambiguous"
  runtime_target="$(runtime_proxy_container)"
  if [ -n "$runtime_target" ]; then
    [ "$ready_count" -eq 0 ] || fail "A normal blue-green entry cannot consume a stale bootstrap handoff"
  elif is_proxy_running; then
    [ "$ready_count" -eq 1 ] || fail "The maintenance entry requires exactly one unconsumed bootstrap handoff for this Git commit"
    verify_ready_bootstrap_handoff_evidence "$READY_BOOTSTRAP_HANDOFF"
    maintenance_entry_is_ready_after_restore || fail "Bootstrap maintenance entry is not an exact dual-stack 503 handoff"
  elif [ "$ready_count" -ne 0 ]; then
    fail "Bootstrap handoff evidence exists but its maintenance proxy is not running"
  fi
}

ensure_public_traffic_rollup_token() {
  if [ "$TARGET" != "production" ]; then
    return 0
  fi

  mkdir -p "$PUBLIC_TRAFFIC_SYNC_ROOT"
  chmod 700 "$PUBLIC_TRAFFIC_SYNC_ROOT"

  if [ ! -s "$PUBLIC_TRAFFIC_ROLLUP_TOKEN_FILE" ]; then
    if command -v openssl >/dev/null 2>&1; then
      openssl rand -hex 32 > "$PUBLIC_TRAFFIC_ROLLUP_TOKEN_FILE"
    else
      tr -dc 'A-Za-z0-9' </dev/urandom | head -c 64 > "$PUBLIC_TRAFFIC_ROLLUP_TOKEN_FILE"
    fi
  fi

  chmod 600 "$PUBLIC_TRAFFIC_ROLLUP_TOKEN_FILE"
  PUBLIC_TRAFFIC_ROLLUP_TOKEN="$(tr -d '\r\n' < "$PUBLIC_TRAFFIC_ROLLUP_TOKEN_FILE")"
}

install_public_traffic_rollup_timers() {
  if [ "$TARGET" != "production" ]; then
    return 0
  fi

  mkdir -p "$PUBLIC_TRAFFIC_SYNC_ROOT"
  cat > "$PUBLIC_TRAFFIC_LOG_SYNC_SCRIPT" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
remote='trafficlog@218.93.9.38'
key='/root/.ssh/public_traffic_log_sync_ed25519'
dest='/mnt/PoolOne/apps/youyidian-3d/public-traffic-logs'
ssh_opts="ssh -i ${key} -o BatchMode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=10"
domains=(
  sc.jiansun.vip
  s3.jiansun.vip
  cp.jiansun.vip
)
mkdir -p "$dest"
chmod 755 "$dest"
status=0
for domain in "${domains[@]}"; do
  if ! rsync -rtz --timeout=45 --chmod=F644,D755 -e "$ssh_opts" "${remote}:/var/log/nginx/${domain}.access.log*" "$dest/"; then
    echo "WARN: failed to sync ${domain}.access.log*" >&2
    status=1
  fi
done
find "$dest" -maxdepth 1 -type f -name '*.access.log*' -exec chmod 0644 {} +
exit "$status"
EOF
  chmod 700 "$PUBLIC_TRAFFIC_LOG_SYNC_SCRIPT"

  cat > "/etc/systemd/system/public-traffic-log-sync.service" <<EOF
[Unit]
Description=Sync public traffic nginx logs from tunnel server
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=${PUBLIC_TRAFFIC_LOG_SYNC_SCRIPT}
TimeoutStartSec=180
EOF

  cat > "/etc/systemd/system/public-traffic-log-sync.timer" <<EOF
[Unit]
Description=Run public traffic log sync every 5 minutes

[Timer]
OnBootSec=1min
OnUnitActiveSec=5min
Persistent=true

[Install]
WantedBy=timers.target
EOF

  cat > "$PUBLIC_TRAFFIC_ROLLUP_SCRIPT" <<EOF
#!/usr/bin/env bash
set -euo pipefail
current_file='${CURRENT_FILE}'
container="\$(cat "\$current_file" 2>/dev/null || true)"
if [ -z "\$container" ] || ! docker inspect "\$container" >/dev/null 2>&1; then
  echo "No active material container found" >&2
  exit 1
fi
systemctl start public-traffic-log-sync.service >/dev/null 2>&1 || true
docker exec "\$container" python3 /app/scripts/public-traffic-rollup-from-nginx.py --granularity 5m
yesterday="\$(TZ=Asia/Shanghai date -d 'yesterday' +%F)"
docker exec "\$container" python3 /app/scripts/public-traffic-rollup-from-nginx.py --granularity day --start-date "\$yesterday" --end-date "\$yesterday"
EOF
  chmod 700 "$PUBLIC_TRAFFIC_ROLLUP_SCRIPT"

  cat > "/etc/systemd/system/${PUBLIC_TRAFFIC_ROLLUP_SERVICE}" <<EOF
[Unit]
Description=Sync public traffic statistics rollups
After=network-online.target ${PROXY_SERVICE}
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=${PUBLIC_TRAFFIC_ROLLUP_SCRIPT}
TimeoutStartSec=360
EOF

  cat > "/etc/systemd/system/${PUBLIC_TRAFFIC_ROLLUP_TIMER}" <<EOF
[Unit]
Description=Run public traffic statistics rollup sync

[Timer]
OnBootSec=2min
OnUnitActiveSec=5min
RandomizedDelaySec=30s
Persistent=true

[Install]
WantedBy=timers.target
EOF

  systemctl daemon-reload
  systemctl enable public-traffic-log-sync.timer >/dev/null 2>&1 || true
  systemctl enable "$PUBLIC_TRAFFIC_ROLLUP_TIMER" >/dev/null 2>&1 || true
  systemctl restart public-traffic-log-sync.timer >/dev/null 2>&1 || true
  systemctl restart "$PUBLIC_TRAFFIC_ROLLUP_TIMER" >/dev/null 2>&1 || true
}

is_proxy_running() {
  systemctl is-active --quiet "$PROXY_SERVICE" 2>/dev/null || {
    [ -f "$PROXY_PID" ] && kill -0 "$(cat "$PROXY_PID")" >/dev/null 2>&1
  }
}

container_ip() {
  docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1" 2>/dev/null || true
}

write_proxy_config() {
  local upstream="$1"
  local target_container="$2"
  local temp_conf=""
  local backup_conf=""

  PROXY_CONFIG_REPLACED=0
  PROXY_CONFIG_BACKUP=""

  case "$target_container" in
    "$BLUE_CONTAINER"|"$GREEN_CONTAINER") ;;
    *)
      warn "Refusing to write proxy config for invalid container: ${target_container}"
      return 1
      ;;
  esac

  mkdir -p "$PROXY_ROOT"
  if ! temp_conf="$(mktemp "${PROXY_CONF}.tmp.XXXXXX")"; then
    return 1
  fi
  cat > "$temp_conf" <<EOF
worker_processes 1;
pid ${PROXY_PID};

events {
  worker_connections 2048;
}

http {
  access_log off;
  error_log ${PROXY_ROOT}/error.log warn;
  # Unknown routes must never inherit a gigabyte-scale request allowance.
  # Every supported large upload path below declares its own explicit limit.
  client_max_body_size 16m;

  map \$http_upgrade \$connection_upgrade {
    default upgrade;
    '' close;
  }

  map \$http_x_forwarded_proto \$forwarded_proto {
    default \$http_x_forwarded_proto;
    '' \$scheme;
  }

  upstream app_backend {
    server ${upstream} max_fails=3 fail_timeout=5s;
    keepalive 64;
  }

  server {
    listen 0.0.0.0:${PORT};
    listen [::]:${PORT} ipv6only=on;
    server_name _;

    # Public pre-auth endpoint: only a short DingTalk authorization code is
    # accepted. Keep the proxy and application limits aligned so anonymous
    # requests can never make Node parse a large form body.
    location = /api/dingtalk/h5-login {
      client_max_body_size 64k;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_connect_timeout 10s;
      proxy_read_timeout 60s;
      proxy_send_timeout 60s;
    }

    location ~ "^/api/(?:user/avatar|system-settings/upload-logo)\$" {
      client_max_body_size 7m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location = /api/upload/preview {
      client_max_body_size 53m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    # Brand knowledge finalization only carries metadata and a bounded preview;
    # the 1 GiB source file uses the shared 20 MiB chunk upload routes below.
    location = /api/department-dashboard/brand-knowledge {
      client_max_body_size 53m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location ~ "^/api/upload/s3(?:-original)?\$" {
      client_max_body_size 103m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location ~ "^/(?:api/upload/psd|api/materials/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/skus/upload)\$" {
      client_max_body_size 131m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location ~ "^/(?:api/materials/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/white-background|api/external/standard-model-white-background/(?:by-spu|by-barcode))\$" {
      client_max_body_size 106m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location = /api/materials/update {
      client_max_body_size 11m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location ~ "^/api/materials/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\$" {
      client_max_body_size 11m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    # Streaming request bodies keeps each upstream connection visible to the
    # blue-green drain gate for the full client upload instead of only after
    # nginx has buffered the complete request. Keep the 128 MiB legacy upload,
    # 20 MiB raw chunk, and remaining sub-routes separate so multipart framing
    # has explicit headroom without changing the existing general-route ceiling.
    location = /api/materials/upload {
      client_max_body_size 129m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_set_header Upgrade \$http_upgrade;
      proxy_set_header Connection \$connection_upgrade;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location = /api/materials/upload/chunk {
      client_max_body_size 21m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_set_header Upgrade \$http_upgrade;
      proxy_set_header Connection \$connection_upgrade;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location ^~ /api/materials/upload/ {
      client_max_body_size 2m;
      proxy_request_buffering off;
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_set_header Upgrade \$http_upgrade;
      proxy_set_header Connection \$connection_upgrade;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }

    location / {
      proxy_pass http://app_backend;
      proxy_hide_header X-Material-Proxy-Target;
      add_header X-Material-Proxy-Target ${target_container} always;
      proxy_http_version 1.1;
      proxy_set_header Host \$http_host;
      # Preserve the incoming LAN host and port for same-origin auth handoff.
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto \$forwarded_proto;
      proxy_set_header Upgrade \$http_upgrade;
      proxy_set_header Connection \$connection_upgrade;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_connect_timeout 10s;
      proxy_buffering off;
    }
  }
}
EOF
  if [ "$?" -ne 0 ]; then
    rm -f "$temp_conf"
    return 1
  fi

  if ! nginx -p "${PROXY_ROOT}/" -c "$temp_conf" -t; then
    rm -f "$temp_conf"
    return 1
  fi

  if [ -f "$PROXY_CONF" ]; then
    backup_conf="${PROXY_CONF}.bak.deploy.$(date +%Y%m%d-%H%M%S)"
    if ! cp -a "$PROXY_CONF" "$backup_conf"; then
      rm -f "$temp_conf"
      return 1
    fi
    PROXY_CONFIG_BACKUP="$backup_conf"
  fi

  if ! mv "$temp_conf" "$PROXY_CONF"; then
    rm -f "$temp_conf"
    return 1
  fi
  PROXY_CONFIG_REPLACED=1
}

ensure_proxy_service() {
  local service_file="/etc/systemd/system/${PROXY_SERVICE}"
  local service_temp=""

  mkdir -p "$PROXY_ROOT" || return 1
  if ! service_temp="$(mktemp "${service_file}.tmp.XXXXXX")"; then
    return 1
  fi
  cat > "$service_temp" <<EOF
[Unit]
Description=Youyidian material local entry proxy (${CONTAINER_NAME})
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
ExecStartPre=/usr/sbin/nginx -p ${PROXY_ROOT}/ -c ${PROXY_CONF} -t
ExecStart=/usr/sbin/nginx -p ${PROXY_ROOT}/ -c ${PROXY_CONF} -g 'daemon off;'
ExecReload=/usr/sbin/nginx -p ${PROXY_ROOT}/ -c ${PROXY_CONF} -s reload
ExecStop=/usr/sbin/nginx -p ${PROXY_ROOT}/ -c ${PROXY_CONF} -s quit
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
EOF
  if [ "$?" -ne 0 ]; then
    rm -f "$service_temp"
    return 1
  fi
  chmod 0644 "$service_temp" || return 1
  mv "$service_temp" "$service_file" || return 1

  systemctl daemon-reload || return 1
  systemctl enable "$PROXY_SERVICE" >/dev/null 2>&1 || return 1
}

switch_proxy() {
  ensure_proxy_service || return 1
  if is_proxy_running; then
    systemctl reload "$PROXY_SERVICE"
  else
    systemctl start "$PROXY_SERVICE"
  fi
}

runtime_proxy_container_at_url() {
  local url="$1"
  local target=""

  target="$(
    curl --noproxy '*' -g -sS --max-time 5 -D - -o /dev/null "$url" 2>/dev/null |
      tr -d '\r' |
      sed -nE 's/^X-Material-Proxy-Target:[[:space:]]*(.*)$/\1/Ip' |
      tail -n 1 || true
  )"

  case "$target" in
    "$BLUE_CONTAINER"|"$GREEN_CONTAINER") printf '%s\n' "$target" ;;
    *) printf '\n' ;;
  esac
}

runtime_proxy_container() {
  runtime_proxy_container_at_url "http://127.0.0.1:${PORT}/api/health"
}

verify_proxy_target() {
  local expected_container="$1"
  local expected_commit="${2:-}"
  local observed_container=""
  local observed_ipv6_container=""

  for _ in $(seq 1 5); do
    observed_container="$(runtime_proxy_container)"
    observed_ipv6_container="$(runtime_proxy_container_at_url "http://[::1]:${PORT}/api/health")"
    if [ "$observed_container" = "$expected_container" ] && \
       [ "$observed_ipv6_container" = "$expected_container" ] && \
       curl -fsS --max-time 8 "http://127.0.0.1:${PORT}/api/health" >/tmp/git-deploy-entry-health.json 2>/tmp/git-deploy-entry-health.err && \
       health_payload_is_ready /tmp/git-deploy-entry-health.json "$expected_commit" && \
       curl --noproxy '*' -g -fsS --max-time 8 "http://[::1]:${PORT}/api/health" >/tmp/git-deploy-entry-health-ipv6.json 2>/tmp/git-deploy-entry-health-ipv6.err && \
       health_payload_is_ready /tmp/git-deploy-entry-health-ipv6.json "$expected_commit"; then
      return 0
    fi
    sleep 1
  done

  warn "Proxy target verification failed: expected=${expected_container}, observed_ipv4=${observed_container:-missing}, observed_ipv6=${observed_ipv6_container:-missing}"
  return 1
}

install_proxy_reconciler() {
  local script_temp=""
  local service_file="/etc/systemd/system/${PROXY_RECONCILE_SERVICE}"
  local service_temp=""
  local timer_file="/etc/systemd/system/${PROXY_RECONCILE_TIMER}"
  local timer_temp=""

  mkdir -p "$PROXY_ROOT" || return 1
  script_temp="$(mktemp "${PROXY_RECONCILE_SCRIPT}.tmp.XXXXXX")"
  printf '%s' "$PROXY_RECONCILE_SCRIPT_B64" | base64 -d > "$script_temp"
  bash -n "$script_temp"
  chmod 700 "$script_temp"
  mv "$script_temp" "$PROXY_RECONCILE_SCRIPT"

  service_temp="$(mktemp "${service_file}.tmp.XXXXXX")"
  cat > "$service_temp" <<EOF
[Unit]
Description=Reconcile ${CONTAINER_NAME} local proxy upstream
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
Environment=CONTAINER_NAME=${CONTAINER_NAME}
Environment=PORT=${PORT}
Environment=PROXY_ROOT=${PROXY_ROOT}
Environment=PROXY_SERVICE=${PROXY_SERVICE}
ExecStart=${PROXY_RECONCILE_SCRIPT}
TimeoutStartSec=180
EOF
  chmod 0644 "$service_temp"
  mv "$service_temp" "$service_file"

  timer_temp="$(mktemp "${timer_file}.tmp.XXXXXX")"
  cat > "$timer_temp" <<EOF
[Unit]
Description=Check ${CONTAINER_NAME} local proxy upstream

[Timer]
OnBootSec=20s
OnUnitActiveSec=15s
AccuracySec=1s
Persistent=true

[Install]
WantedBy=timers.target
EOF
  chmod 0644 "$timer_temp"
  mv "$timer_temp" "$timer_file"

  systemctl daemon-reload
  systemctl enable "$PROXY_RECONCILE_TIMER" >/dev/null 2>&1 || return 1
  systemctl restart "$PROXY_RECONCILE_TIMER"
}

container_running() {
  [ "$(docker inspect -f '{{.State.Running}}' "$1" 2>/dev/null || true)" = "true" ]
}

read_recorded_container() {
  local name=""

  if [ -s "$CURRENT_FILE" ]; then
    name="$(tr -d '\r\n' < "$CURRENT_FILE")"
  fi

  case "$name" in
    "$BLUE_CONTAINER"|"$GREEN_CONTAINER") printf '%s\n' "$name" ;;
    *) printf '\n' ;;
  esac
}

write_current_container() {
  local name="$1"
  local temp_file=""

  mkdir -p "$PROXY_ROOT"
  temp_file="$(mktemp "${CURRENT_FILE}.tmp.XXXXXX")"
  printf '%s\n' "$name" > "$temp_file"
  chmod 0644 "$temp_file"
  mv "$temp_file" "$CURRENT_FILE"
}

discover_current_container() {
  local recorded_container=""
  local runtime_container=""
  local running_containers=()
  local name=""

  recorded_container="$(read_recorded_container)"
  runtime_container="$(runtime_proxy_container)"

  if [ -n "$runtime_container" ] && container_running "$runtime_container"; then
    printf '%s\n' "$runtime_container"
    return 0
  fi

  for name in "$BLUE_CONTAINER" "$GREEN_CONTAINER"; do
    if container_running "$name"; then
      running_containers+=("$name")
    fi
  done

  if [ "${#running_containers[@]}" -eq 1 ]; then
    printf '%s\n' "${running_containers[0]}"
    return 0
  fi

  if [ "${#running_containers[@]}" -gt 1 ]; then
    warn "Multiple running material containers found without a verified runtime proxy target (recorded=${recorded_container:-missing})"
    return 1
  fi

  printf '\n'
}

health_payload_is_ready() {
  local payload_file="$1"
  local expected_commit="${2:-}"

  grep -Fq -- '"status":"healthy"' "$payload_file" || return 1
  grep -Fq -- '"database":{"status":"ok"' "$payload_file" || return 1
  grep -Fq -- '"redis":{"status":"ok"' "$payload_file" || return 1
  if [ -n "$expected_commit" ]; then
    grep -Fq -- "\"deploymentCommit\":\"${expected_commit}\"" "$payload_file" || return 1
  fi
}

wait_for_container_health() {
  local name="$1"
  local expected_commit="${2:-}"
  local ip=""

  for i in $(seq 1 24); do
    running="$(docker inspect -f '{{.State.Running}}' "$name" 2>/dev/null || echo false)"
    ip="$(container_ip "$name")"
    if [ "$running" = "true" ] && [ -n "$ip" ]; then
      if curl -fsS --max-time 8 "http://${ip}:3000/api/health" >/tmp/git-deploy-health.json 2>/tmp/git-deploy-health.err &&
         health_payload_is_ready /tmp/git-deploy-health.json "$expected_commit"; then
        printf '%s\n' "$ip"
        return 0
      fi
    fi
    sleep 5
  done

  return 1
}

container_healthy() {
  local name="$1"
  local expected_commit="${2:-}"
  local ip=""

  container_running "$name" || return 1
  ip="$(container_ip "$name")"
  [ -n "$ip" ] || return 1
  curl -fsS --max-time 8 "http://${ip}:3000/api/health" >/tmp/git-deploy-container-health.json 2>/dev/null &&
    health_payload_is_ready /tmp/git-deploy-container-health.json "$expected_commit"
}

# This is intentionally a one-slot replacement.  It never starts a second
# application worker beside the running one: the active slot is stopped before
# the new image is created with that same name.  It therefore matches the
# former short deployment model and avoids the video/transcode drain protocol
# required only by the retired blue/green hand-off path.
restore_direct_previous_container() {
  local name="$1"
  local previous_image="$2"
  local previous_ip=""

  docker rm -f "$name" >/dev/null 2>&1 || return 1
  create_container "$name" "$previous_image" 0 || return 1
  verify_container_uploads_mount_metadata "$name" || return 1
  verify_container_upload_dir_config "$name" 1 || return 1
  docker start "$name" >/dev/null || return 1
  verify_container_uploads_storage "$name" 1 || return 1
  previous_ip="$(wait_for_container_health "$name")" || return 1
  write_proxy_config "${previous_ip}:3000" "$name" || return 1
  switch_proxy || return 1
  verify_proxy_target "$name" || return 1
  write_current_container "$name" || return 1
}

fail_direct_replace_with_restore() {
  local reason="$1"
  local name="$2"
  local previous_image="$3"

  warn "$reason"
  if restore_direct_previous_container "$name" "$previous_image"; then
    fail "$reason; previous container was restored"
  fi
  fail "$reason; previous container could not be restored automatically"
}

retire_inactive_direct_slot() {
  local active_name="$1"
  local inactive_name=""

  case "$active_name" in
    "$BLUE_CONTAINER") inactive_name="$GREEN_CONTAINER" ;;
    "$GREEN_CONTAINER") inactive_name="$BLUE_CONTAINER" ;;
    *) return 1 ;;
  esac

  docker inspect "$inactive_name" >/dev/null 2>&1 || return 0
  if container_running "$inactive_name"; then
    log "Retiring inactive historical container: $inactive_name"
    docker stop --time 10 "$inactive_name" >/dev/null || return 1
  fi
  docker rm "$inactive_name" >/dev/null || return 1
}

direct_replace_active_container() {
  local name="$1"
  local previous_image=""
  local replacement_ip=""

  case "$name" in
    "$BLUE_CONTAINER"|"$GREEN_CONTAINER") ;;
    *) fail "Direct replacement requires one active material slot" ;;
  esac

  previous_image="$(docker inspect -f '{{.Config.Image}}' "$name" 2>/dev/null || true)"
  [ -n "$previous_image" ] || fail "Active container image could not be determined: $name"
  verify_container_uploads_storage "$name" || fail "Active container uploads storage could not be verified before direct replacement"
  verify_image_revision_label "$REGISTRY_COMMIT" "$COMMIT_SHA" || fail "Direct replacement image label does not match the exact Git commit"
  prepare_worker_runtime_directories || fail "Worker runtime directories could not be prepared"

  log "Replacing active container directly: $name"
  if ! docker stop --time 10 "$name" >/dev/null; then
    fail "Active container could not be stopped for direct replacement"
  fi
  if ! docker rm "$name" >/dev/null; then
    docker start "$name" >/dev/null 2>&1 || true
    fail "Stopped container could not be removed for direct replacement"
  fi
  if ! create_container "$name" "$REGISTRY_COMMIT" 0; then
    fail_direct_replace_with_restore "New direct container could not be created" "$name" "$previous_image"
  fi
  if ! verify_container_uploads_mount_metadata "$name" || ! verify_container_upload_dir_config "$name" 1; then
    fail_direct_replace_with_restore "New direct container uploads configuration is invalid" "$name" "$previous_image"
  fi
  if ! docker start "$name" >/dev/null; then
    fail_direct_replace_with_restore "New direct container could not be started" "$name" "$previous_image"
  fi
  if ! verify_container_uploads_storage "$name" 1 || ! verify_container_baked_revision "$name" "$COMMIT_SHA"; then
    fail_direct_replace_with_restore "New direct container identity or uploads storage verification failed" "$name" "$previous_image"
  fi
  if ! replacement_ip="$(wait_for_container_health "$name" "$COMMIT_SHA")"; then
    fail_direct_replace_with_restore "New direct container failed its health check" "$name" "$previous_image"
  fi
  if ! verify_transcode_lease_schema "$name"; then
    fail_direct_replace_with_restore "New direct container cannot verify required video transcode lease columns" "$name" "$previous_image"
  fi
  if ! verify_task_detail_upload_lease_schema "$name"; then
    fail_direct_replace_with_restore "New direct container cannot verify task-detail upload job lease schema" "$name" "$previous_image"
  fi
  if ! verify_brand_logo_defaults "$name"; then
    fail_direct_replace_with_restore "New direct container cannot verify safe brand logo database defaults" "$name" "$previous_image"
  fi
  if ! verify_material_upload_idempotency_schema "$name"; then
    fail_direct_replace_with_restore "New direct container cannot verify material upload idempotency schema" "$name" "$previous_image"
  fi
  if ! verify_candidate_database_identity "$name"; then
    fail_direct_replace_with_restore "New direct container database identity differs from the approved migration audit" "$name" "$previous_image"
  fi
  if ! verify_candidate_brand_and_storage_dependencies "$name" "$replacement_ip"; then
    fail_direct_replace_with_restore "New direct container cannot authenticate to S3 or decode configured brand images" "$name" "$previous_image"
  fi
  if ! verify_video_transcode_capability "$name"; then
    fail_direct_replace_with_restore "New direct container did not publish the required video transcode capability" "$name" "$previous_image"
  fi
  if ! verify_task_detail_upload_capability "$name"; then
    fail_direct_replace_with_restore "New direct container did not publish the required task-detail upload capability" "$name" "$previous_image"
  fi
  if ! verify_container_uploads_storage "$name" 1; then
    fail_direct_replace_with_restore "New direct container uploads storage identity changed before traffic switch" "$name" "$previous_image"
  fi
  if ! write_proxy_config "${replacement_ip}:3000" "$name" || ! switch_proxy || ! verify_proxy_target "$name" "$COMMIT_SHA"; then
    fail_direct_replace_with_restore "New direct container could not become the verified proxy target" "$name" "$previous_image"
  fi
  write_current_container "$name" || fail "Direct replacement traffic is healthy but the current-slot record could not be written"
  retire_inactive_direct_slot "$name" || warn "The inactive historical slot could not be removed; the active direct container remains healthy"
  rm -f -- "$(transcode_drain_file "$name")" "$(task_detail_drain_file "$name")" || true
  ok "Direct replacement completed: $name"
}

container_upstream_connection_count() {
  local name="$1"
  local ip=""

  command -v ss >/dev/null 2>&1 || return 2
  container_running "$name" || {
    printf '0\n'
    return 0
  }
  ip="$(container_ip "$name")"
  [ -n "$ip" ] || return 2

  # Let ss filter the peer endpoint itself; column positions differ between
  # iproute2 versions when the State column is omitted by -H.
  ss -Htan state established dst "${ip}:3000" 2>/dev/null |
    awk 'END { print NR + 0 }'
}

wait_for_container_drain() {
  local name="$1"
  local max_checks="${2:-15}"
  local count=""
  local zero_samples=0

  for _ in $(seq 1 "$max_checks"); do
    if ! count="$(container_upstream_connection_count "$name")"; then
      warn "Cannot prove that upstream connections drained for ${name}; leaving it running"
      return 1
    fi

    if [ "$count" = "0" ]; then
      zero_samples=$((zero_samples + 1))
      if [ "$zero_samples" -ge 2 ]; then
        return 0
      fi
    else
      zero_samples=0
      log "Waiting for ${count} active upstream connection(s) to drain from ${name}"
    fi
    sleep 2
  done

  warn "Active upstream connections did not drain from ${name}; leaving it running"
  return 1
}

TRANSCODE_RUNTIME_ROOT="${UPLOADS_MOUNT}/.video-transcode-runtime"
TRANSCODE_DRAIN_TARGET=""
TRANSCODE_DRAIN_TARGETS=""

transcode_capability_file() {
  printf '%s/capabilities/%s.v1\n' "$TRANSCODE_RUNTIME_ROOT" "$1"
}

transcode_drain_file() {
  printf '%s/drain/%s\n' "$TRANSCODE_RUNTIME_ROOT" "$1"
}

transcode_active_file() {
  printf '%s/active/%s.json\n' "$TRANSCODE_RUNTIME_ROOT" "$1"
}

container_transcode_instance_id() {
  local name="$1"
  docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$name" 2>/dev/null |
    while IFS='=' read -r key value; do
      if [ "$key" = "VIDEO_TRANSCODE_INSTANCE_ID" ]; then
        printf '%s\n' "$value"
        break
      fi
    done
}

verify_video_transcode_capability() {
  local name="$1"
  local capability
  local instance_id
  capability="$(transcode_capability_file "$name")"
  instance_id="$(container_transcode_instance_id "$name")"

  [ -n "$instance_id" ] || return 1
  [ -s "$capability" ] || return 1
  grep -Fqx -- 'VIDEO_TRANSCODE_DRAIN_PROTOCOL_V1' "$capability" || return 1
  grep -Fqx -- "workerId=$name" "$capability" || return 1
  grep -Fqx -- "instanceId=$instance_id" "$capability"
}

resume_video_transcode() {
  local name="$1"
  local marker
  marker="$(transcode_drain_file "$name")"
  rm -f -- "$marker" || return 1
  log "Video transcode drain resumed for ${name}"
}

wait_for_video_transcode_drain() {
  local name="$1"
  local max_checks="${2:-90}"
  local active
  local zero_samples=0
  active="$(transcode_active_file "$name")"

  for _ in $(seq 1 "$max_checks"); do
    if [ -e "$active" ]; then
      zero_samples=0
      log "Waiting for active video transcode lease in ${name}"
    else
      zero_samples=$((zero_samples + 1))
      if [ "$zero_samples" -ge 2 ]; then
        return 0
      fi
    fi
    sleep 2
  done

  warn "Cannot prove video transcode worker ${name} is inactive; container will not be stopped"
  return 1
}

request_video_transcode_drain() {
  local name="$1"
  local marker
  marker="$(transcode_drain_file "$name")"

  if ! verify_video_transcode_capability "$name"; then
    warn "Container ${name} does not prove current-instance VIDEO_TRANSCODE_DRAIN_PROTOCOL_V1 support"
    return 2
  fi

  mkdir -p "$(dirname "$marker")"
  : > "$marker"
  chmod 600 "$marker"
  TRANSCODE_DRAIN_TARGET="$name"
  case " $TRANSCODE_DRAIN_TARGETS " in
    *" $name "*) ;;
    *) TRANSCODE_DRAIN_TARGETS="${TRANSCODE_DRAIN_TARGETS} ${name}" ;;
  esac
  wait_for_video_transcode_drain "$name"
}

TASK_DETAIL_RUNTIME_ROOT="${UPLOADS_MOUNT}/.task-detail-upload-runtime"
TASK_DETAIL_DRAIN_TARGETS=""

prepare_worker_runtime_directories() {
  local app_uid=''
  local app_gid=''
  local runtime_root=''
  app_uid="$(docker run --rm --network none --entrypoint id "$REGISTRY_COMMIT" -u nextjs 2>/dev/null || true)"
  app_gid="$(docker run --rm --network none --entrypoint id "$REGISTRY_COMMIT" -g nextjs 2>/dev/null || true)"
  [[ "$app_uid" =~ ^[1-9][0-9]*$ ]] || return 1
  [[ "$app_gid" =~ ^[1-9][0-9]*$ ]] || return 1

  for runtime_root in "$TRANSCODE_RUNTIME_ROOT" "$TASK_DETAIL_RUNTIME_ROOT"; do
    if [ -e "$runtime_root" ] && { [ ! -d "$runtime_root" ] || [ -L "$runtime_root" ]; }; then
      return 1
    fi
    install -d -m 0750 -o "$app_uid" -g "$app_gid" "$runtime_root" || return 1
    install -d -m 0750 -o "$app_uid" -g "$app_gid" "$runtime_root/capabilities" "$runtime_root/active" || return 1
    if [ -e "$runtime_root/drain" ] && { [ ! -d "$runtime_root/drain" ] || [ -L "$runtime_root/drain" ]; }; then
      return 1
    fi
    install -d -m 0755 -o 0 -g 0 "$runtime_root/drain" || return 1
  done
}

task_detail_capability_file() {
  printf '%s/capabilities/%s.v1\n' "$TASK_DETAIL_RUNTIME_ROOT" "$1"
}

task_detail_drain_file() {
  printf '%s/drain/%s\n' "$TASK_DETAIL_RUNTIME_ROOT" "$1"
}

task_detail_active_file() {
  printf '%s/active/%s.json\n' "$TASK_DETAIL_RUNTIME_ROOT" "$1"
}

container_task_detail_instance_id() {
  local name="$1"
  docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$name" 2>/dev/null |
    while IFS='=' read -r key value; do
      if [ "$key" = "TASK_DETAIL_UPLOAD_INSTANCE_ID" ]; then
        printf '%s\n' "$value"
        break
      fi
    done
}

verify_task_detail_upload_capability() {
  local name="$1"
  local capability
  local instance_id
  capability="$(task_detail_capability_file "$name")"
  instance_id="$(container_task_detail_instance_id "$name")"

  [ -n "$instance_id" ] || return 1
  [ -s "$capability" ] || return 1
  grep -Fqx -- 'TASK_DETAIL_UPLOAD_DRAIN_PROTOCOL_V1' "$capability" || return 1
  grep -Fqx -- "workerId=$name" "$capability" || return 1
  grep -Fqx -- "instanceId=$instance_id" "$capability"
}

resume_task_detail_upload() {
  local name="$1"
  rm -f -- "$(task_detail_drain_file "$name")" || return 1
  log "Task-detail upload drain resumed for ${name}"
}

wait_for_task_detail_upload_drain() {
  local name="$1"
  local max_checks="${2:-900}"
  local active
  local zero_samples=0
  active="$(task_detail_active_file "$name")"

  for _ in $(seq 1 "$max_checks"); do
    if [ -e "$active" ]; then
      zero_samples=0
      log "Waiting for active task-detail upload job in ${name}"
    else
      zero_samples=$((zero_samples + 1))
      if [ "$zero_samples" -ge 2 ]; then
        return 0
      fi
    fi
    sleep 2
  done

  warn "Cannot prove task-detail upload worker ${name} is inactive; container will not be stopped"
  return 1
}

request_task_detail_upload_drain() {
  local name="$1"
  local marker
  marker="$(task_detail_drain_file "$name")"

  if ! verify_task_detail_upload_capability "$name"; then
    warn "Container ${name} does not prove current-instance TASK_DETAIL_UPLOAD_DRAIN_PROTOCOL_V1 support"
    return 2
  fi

  mkdir -p "$(dirname "$marker")"
  : > "$marker"
  chmod 600 "$marker"
  case " $TASK_DETAIL_DRAIN_TARGETS " in
    *" $name "*) ;;
    *) TASK_DETAIL_DRAIN_TARGETS="${TASK_DETAIL_DRAIN_TARGETS} ${name}" ;;
  esac
  wait_for_task_detail_upload_drain "$name"
}

forget_task_detail_drain_target() {
  local forgotten="$1"
  local retained=""
  local target
  for target in $TASK_DETAIL_DRAIN_TARGETS; do
    if [ "$target" != "$forgotten" ]; then
      retained="${retained} ${target}"
    fi
  done
  TASK_DETAIL_DRAIN_TARGETS="$retained"
}

verify_task_detail_upload_lease_schema() {
  local name="$1"
  local result
  result="$(docker exec "$name" node -e '
const { createHash } = require("crypto");
const { readFileSync } = require("fs");
const { PrismaClient } = require("@prisma/client");
const p = new PrismaClient();
const migrationName = "20260812_add_product_package_upload_job_lease";
const migrationPath = `/app/prisma/migrations/${migrationName}/migration.sql`;
let sourceChecksum = "";
try {
  sourceChecksum = createHash("sha256")
    .update(readFileSync(migrationPath, "utf8").replace(/\r\n/g, "\n"), "utf8")
    .digest("hex");
}
catch (error) { process.stderr.write(String(error && error.message || error)); process.exit(1); }
Promise.all([
  p.$queryRawUnsafe("SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 AND column_name IN ($2, $3, $4)", "product_package_upload_jobs", "worker_id", "lease_token", "lease_expires_at"),
  p.$queryRawUnsafe("SELECT indexdef FROM pg_indexes WHERE schemaname = current_schema() AND tablename = $1 AND indexname = $2", "product_package_upload_jobs", "product_package_upload_jobs_lease_idx"),
  p.$queryRawUnsafe("SELECT checksum FROM \"_prisma_migrations\" WHERE migration_name = $1 AND finished_at IS NOT NULL AND rolled_back_at IS NULL", migrationName)
]).then(([columns, indexes, migrations]) => {
  const byName = new Map(columns.map((row) => [String(row.column_name), row]));
  const textColumnOk = (column) => byName.has(column)
    && byName.get(column).data_type === "text"
    && byName.get(column).is_nullable === "YES";
  const timestamp = byName.get("lease_expires_at");
  const columnsOk = textColumnOk("worker_id") && textColumnOk("lease_token")
    && timestamp && timestamp.data_type === "timestamp without time zone" && timestamp.is_nullable === "YES";
  const indexDefinition = String(indexes[0] && indexes[0].indexdef || "");
  const normalizedIndexDefinition = indexDefinition.replace(/"/g, "");
  const indexOk = indexes.length === 1
    && /\(\s*status\s*,\s*lease_expires_at\s*\)/i.test(normalizedIndexDefinition);
  const migrationOk = migrations.length === 1 && String(migrations[0].checksum || "") === sourceChecksum;
  if (!columnsOk || !indexOk || !migrationOk) {
    process.stderr.write(JSON.stringify({ columnsOk, indexOk, migrationOk, indexDefinition, sourceChecksum }));
    process.exitCode = 1;
    return;
  }
  process.stdout.write("OK");
}).catch((error) => {
  process.stderr.write(String(error && error.message || error));
  process.exitCode = 1;
}).finally(() => p.$disconnect());
' 2>/dev/null || true)"
  [ "$result" = "OK" ]
}

verify_transcode_lease_schema() {
  local name="$1"
  local result
  result="$(docker exec "$name" node -e '
const { createHash } = require("crypto");
const { readFileSync } = require("fs");
const { PrismaClient } = require("@prisma/client");
const p = new PrismaClient();
const migrationName = "20260811_add_video_transcode_lease";
const migrationPath = `/app/prisma/migrations/${migrationName}/migration.sql`;
let sourceChecksum = "";
try {
  sourceChecksum = createHash("sha256")
    .update(readFileSync(migrationPath, "utf8").replace(/\r\n/g, "\n"), "utf8")
    .digest("hex");
}
catch (error) { process.stderr.write(String(error && error.message || error)); process.exit(1); }
Promise.all([
  p.$queryRawUnsafe("SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 AND column_name IN ($2, $3)", "materials", "transcode_lease_token", "transcode_lease_expires_at"),
  p.$queryRawUnsafe("SELECT indexdef FROM pg_indexes WHERE schemaname = current_schema() AND tablename = $1 AND indexname = $2", "materials", "materials_transcode_lease_idx"),
  p.$queryRawUnsafe("SELECT checksum FROM \"_prisma_migrations\" WHERE migration_name = $1 AND finished_at IS NOT NULL AND rolled_back_at IS NULL", migrationName)
]).then(([columns, indexes, migrations]) => {
  const byName = new Map(columns.map((row) => [String(row.column_name), row]));
  const token = byName.get("transcode_lease_token");
  const expires = byName.get("transcode_lease_expires_at");
  const columnsOk = columns.length === 2
    && token && token.data_type === "text" && token.is_nullable === "YES"
    && expires && expires.data_type === "timestamp without time zone" && expires.is_nullable === "YES";
  const indexDefinition = String(indexes[0] && indexes[0].indexdef || "");
  const indexOk = indexes.length === 1
    && /^CREATE INDEX\s+\S+\s+ON\s+\S+\s+USING\s+btree\s*\(\s*transcode_lease_expires_at\s*,\s*transcode_lease_token\s*\)\s*$/i.test(indexDefinition.replace(/"/g, ""))
    && !/\bUNIQUE\b|\bWHERE\b/i.test(indexDefinition);
  const migrationOk = migrations.length === 1 && String(migrations[0].checksum || "") === sourceChecksum;
  if (!columnsOk || !indexOk || !migrationOk) {
    process.stderr.write(JSON.stringify({ columnsOk, indexOk, migrationOk, indexDefinition, sourceChecksum }));
    process.exitCode = 1;
    return;
  }
  process.stdout.write("OK");
}).catch((error) => {
  process.stderr.write(String(error && error.message || error));
  process.exitCode = 1;
}).finally(() => p.$disconnect());
' 2>/dev/null || true)"
  [ "$result" = "OK" ]
}

verify_brand_logo_defaults() {
  local name="$1"
  local result
  result="$(docker exec "$name" node -e '
const { PrismaClient } = require("@prisma/client");
const p = new PrismaClient();
Promise.all([
  p.$queryRawUnsafe("SELECT column_name, column_default FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 AND column_name IN ($2, $3, $4)", "system_settings", "headerLogoUrl", "loginLogoUrl", "logoUrl"),
  p.$queryRawUnsafe("SELECT COUNT(*)::int AS count FROM \"_prisma_migrations\" WHERE migration_name = $1 AND finished_at IS NOT NULL AND rolled_back_at IS NULL", "20260811_update_brand_logo_defaults"),
  p.$queryRawUnsafe("SELECT id, \"headerLogoUrl\", \"loginLogoUrl\" FROM \"system_settings\" ORDER BY id")
]).then(([columns, migrations, brandRows]) => {
  const defaults = new Map(columns.map((row) => [String(row.column_name), row.column_default]));
  const quote = String.fromCharCode(39);
  const normalize = (value) => {
    let normalized = String(value == null ? "" : value).trim().replace(/::(?:text|character varying)$/i, "");
    if (normalized.startsWith(quote) && normalized.endsWith(quote)) normalized = normalized.slice(1, -1);
    return normalized;
  };
  const headerOk = defaults.has("headerLogoUrl") && normalize(defaults.get("headerLogoUrl")) === "/brand/header-logo.png";
  const loginOk = defaults.has("loginLogoUrl") && normalize(defaults.get("loginLogoUrl")) === "/brand/login-logo.png";
  const legacyOk = !defaults.has("logoUrl") || normalize(defaults.get("logoUrl")) === "/brand/header-logo.png";
  const migrationOk = Number(migrations[0] && migrations[0].count || 0) === 1;
  const isTrustedBrandValue = (value, localDefault) => {
    const normalized = String(value == null ? "" : value).trim();
    if (normalized === localDefault) return true;
    try {
      const parsed = new URL(normalized);
      return parsed.protocol === "https:"
        && parsed.hostname === "s3.jiansun.vip"
        && parsed.port === ""
        && parsed.username === ""
        && parsed.password === ""
        && parsed.pathname.startsWith("/gongxiangpan/")
        && parsed.search === ""
        && parsed.hash === "";
    } catch {
      return false;
    }
  };
  const rowsOk = brandRows.every((row) =>
    isTrustedBrandValue(row.headerLogoUrl, "/brand/header-logo.png")
      && isTrustedBrandValue(row.loginLogoUrl, "/brand/login-logo.png")
  );
  if (!headerOk || !loginOk || !legacyOk || !migrationOk || !rowsOk) {
    process.stderr.write(JSON.stringify({ headerOk, loginOk, legacyOk, migrationOk, rowsOk }));
    process.exitCode = 1;
    return;
  }
  process.stdout.write("OK");
}).catch((error) => {
  process.stderr.write(String(error && error.message || error));
  process.exitCode = 1;
}).finally(() => p.$disconnect());
' 2>/dev/null || true)"
  [ "$result" = "OK" ]
}

verify_material_upload_idempotency_schema() {
  local name="$1"
  local result
  result="$(docker exec "$name" node -e '
const { createHash } = require("crypto");
const { readFileSync } = require("fs");
const { PrismaClient } = require("@prisma/client");
const p = new PrismaClient();
const historicalMigrationName = "20251118000000_add_upload_id_to_materials";
const normalizationMigrationName = "20260812_align_material_upload_idempotency_index";
const migrationChecksum = (name) => createHash("sha256")
  .update(readFileSync(`/app/prisma/migrations/${name}/migration.sql`, "utf8").replace(/\r\n/g, "\n"), "utf8")
  .digest("hex");
let historicalSourceChecksum = "";
let normalizationSourceChecksum = "";
try {
  historicalSourceChecksum = migrationChecksum(historicalMigrationName);
  normalizationSourceChecksum = migrationChecksum(normalizationMigrationName);
}
catch (error) { process.stderr.write(String(error && error.message || error)); process.exit(1); }
Promise.all([
  p.$queryRawUnsafe("SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 AND column_name = $2", "materials", "uploadId"),
  p.$queryRawUnsafe(`
    SELECT i.indisunique, i.indisprimary, i.indisvalid, i.indisready,
           am.amname AS access_method, i.indnkeyatts, i.indnatts,
           pg_get_expr(i.indpred, i.indrelid) AS predicate,
           pg_get_indexdef(i.indexrelid) AS indexdef,
           ARRAY(
             SELECT a.attname
             FROM unnest(i.indkey) WITH ORDINALITY AS k(attnum, ordinality)
             JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = k.attnum
             WHERE k.ordinality <= i.indnkeyatts
             ORDER BY k.ordinality
           ) AS key_columns
    FROM pg_class t
    JOIN pg_namespace n ON n.oid = t.relnamespace
    JOIN pg_index i ON i.indrelid = t.oid
    JOIN pg_class idx ON idx.oid = i.indexrelid
    JOIN pg_am am ON am.oid = idx.relam
    WHERE n.nspname = current_schema() AND t.relname = $1 AND idx.relname = $2
  `, "materials", "materials_uploadId_key"),
  p.$queryRawUnsafe("SELECT migration_name, checksum FROM \"_prisma_migrations\" WHERE migration_name IN ($1, $2) AND finished_at IS NOT NULL AND rolled_back_at IS NULL ORDER BY migration_name", historicalMigrationName, normalizationMigrationName)
]).then(([columns, indexes, migrations]) => {
  const column = columns[0];
  const columnOk = columns.length === 1 && column
    && column.column_name === "uploadId"
    && column.data_type === "text"
    && column.is_nullable === "YES";
  const index = indexes[0];
  const indexDefinition = String(index && index.indexdef || "");
  const predicate = String(index && index.predicate || "");
  const normalizedPredicate = predicate.replace(/[\"()\s]/g, "").toLowerCase();
  const keyColumns = Array.isArray(index && index.key_columns)
    ? index.key_columns.map(String)
    : [];
  const indexOk = indexes.length === 1 && index
    && index.indisunique === true
    && index.indisprimary === false
    && index.indisvalid === true
    && index.indisready === true
    && index.access_method === "btree"
    && Number(index.indnkeyatts) === 1
    && Number(index.indnatts) === 1
    && keyColumns.length === 1 && keyColumns[0] === "uploadId"
    && (normalizedPredicate === "uploadidisnotnullanddeletedatisnull"
      || normalizedPredicate === "deletedatisnullanduploadidisnotnull");
  const migrationByName = new Map(migrations.map((row) => [String(row.migration_name), String(row.checksum || "")]));
  const migrationOk = migrations.length === 2
    && migrationByName.get(historicalMigrationName) === historicalSourceChecksum
    && migrationByName.get(normalizationMigrationName) === normalizationSourceChecksum;
  if (!columnOk || !indexOk || !migrationOk) {
    process.stderr.write(JSON.stringify({ columnOk, indexOk, migrationOk, indexDefinition, predicate, keyColumns, historicalSourceChecksum, normalizationSourceChecksum }));
    process.exitCode = 1;
    return;
  }
  process.stdout.write("OK");
}).catch((error) => {
  process.stderr.write(String(error && error.message || error));
  process.exitCode = 1;
}).finally(() => p.$disconnect());
' 2>/dev/null || true)"
  [ "$result" = "OK" ]
}

BACKGROUND_WORKERS_COMMITTED=0

resume_transcode_after_failed_deploy() {
  local status=$?
  trap - EXIT
  if [ "$status" -ne 0 ] && [ "$BACKGROUND_WORKERS_COMMITTED" != "1" ]; then
    for target in $TRANSCODE_DRAIN_TARGETS; do
      resume_video_transcode "$target" || \
        warn "Deployment failed and video worker drain marker could not be removed: $target"
    done
    for target in $TASK_DETAIL_DRAIN_TARGETS; do
      resume_task_detail_upload "$target" || \
        warn "Deployment failed and task-detail worker drain marker could not be removed: $target"
    done
  elif [ "$status" -ne 0 ]; then
    warn "Deployment failed after worker commit; previous background-worker drain markers remain enabled"
  fi
  exit "$status"
}

trap resume_transcode_after_failed_deploy EXIT

forget_transcode_drain_target() {
  local forgotten="$1"
  local retained=""
  local target
  for target in $TRANSCODE_DRAIN_TARGETS; do
    if [ "$target" != "$forgotten" ]; then
      retained="${retained} ${target}"
    fi
  done
  TRANSCODE_DRAIN_TARGETS="$retained"
}

remove_video_container_safely() {
  local name="$1"
  if docker inspect "$name" >/dev/null 2>&1; then
    if container_running "$name"; then
      if ! wait_for_video_transcode_drain "$name" 2; then
        warn "Container $name still has active video transcode work and will be preserved"
        return 1
      fi
      if ! wait_for_task_detail_upload_drain "$name" 2; then
        warn "Container $name still has active task-detail upload work and will be preserved"
        return 1
      fi
      if ! docker stop --time 30 "$name" >/dev/null 2>&1; then
        warn "Container $name could not be stopped and will be preserved"
        return 1
      fi
    fi
    if [ -e "$(transcode_active_file "$name")" ]; then
      warn "Container $name left an active marker and will not be removed"
      return 1
    fi
    if [ -e "$(task_detail_active_file "$name")" ]; then
      warn "Container $name left a task-detail active marker and will not be removed"
      return 1
    fi
    docker rm "$name" >/dev/null 2>&1 || return 1
  fi
  rm -f -- \
    "$(transcode_drain_file "$name")" \
    "$(transcode_capability_file "$name")" \
    "$(task_detail_drain_file "$name")" \
    "$(task_detail_capability_file "$name")"
}

restore_unreloaded_proxy_config() {
  [ "$PROXY_CONFIG_REPLACED" = "1" ] || return 0
  if [ -n "$PROXY_CONFIG_BACKUP" ] && [ -f "$PROXY_CONFIG_BACKUP" ]; then
    cp -a "$PROXY_CONFIG_BACKUP" "$PROXY_CONF" || return 1
  else
    rm -f -- "$PROXY_CONF" || return 1
  fi
  PROXY_CONFIG_REPLACED=0
  PROXY_CONFIG_BACKUP=""
}

fail_candidate_before_traffic() {
  local reason="$1"
  local proxy_config_restored=1
  local candidate_removed=1

  if ! restore_unreloaded_proxy_config; then
    proxy_config_restored=0
    warn "Previous proxy configuration could not be restored after candidate rejection"
  fi
  if ! remove_video_container_safely "$NEXT_CONTAINER"; then
    candidate_removed=0
    warn "Rejected candidate could not be removed safely: $NEXT_CONTAINER"
  fi
  if [ "$proxy_config_restored" = "1" ] && [ "$candidate_removed" = "1" ]; then
    fail "${reason}; candidate was removed and existing entry was kept"
  fi
  fail "${reason}; existing traffic was not switched, but rejection cleanup needs operator attention"
}

maintenance_entry_is_ready_after_restore() {
  local suffix=""
  local url=""
  local http_code=""
  local target_count=""
  local target=""

  for suffix in ipv4 ipv6; do
    if [ "$suffix" = "ipv4" ]; then
      url="http://127.0.0.1:${PORT}/api/health"
    else
      url="http://[::1]:${PORT}/api/health"
    fi
    http_code="$(curl --noproxy '*' -g -sS --max-time 8 \
      -D "/tmp/git-deploy-maintenance-${suffix}.headers" \
      -o "/tmp/git-deploy-maintenance-${suffix}.body" \
      -w '%{http_code}' "$url")" || return 1
    [ "$http_code" = "503" ] || return 1
    target_count="$(tr -d '\r' <"/tmp/git-deploy-maintenance-${suffix}.headers" | grep -Fic 'X-Material-Proxy-Target:' || true)"
    target="$(tr -d '\r' <"/tmp/git-deploy-maintenance-${suffix}.headers" | sed -nE 's/^X-Material-Proxy-Target:[[:space:]]*(.*)$/\1/Ip' | tail -n 1 || true)"
    [ "$target_count" = "1" ] && [ "$target" = "legacy-bootstrap-maintenance" ] || return 1
  done
}

restore_bootstrap_maintenance_entry() {
  local temp_conf=""

  [ -n "$READY_BOOTSTRAP_HANDOFF" ] || return 1
  [ -n "$PROXY_CONFIG_BACKUP" ] && [ -f "$PROXY_CONFIG_BACKUP" ] && [ ! -L "$PROXY_CONFIG_BACKUP" ] || return 1
  temp_conf="$(mktemp "${PROXY_CONF}.restore.XXXXXX")" || return 1
  cp -a -- "$PROXY_CONFIG_BACKUP" "$temp_conf" || { rm -f -- "$temp_conf"; return 1; }
  nginx -p "${PROXY_ROOT}/" -c "$temp_conf" -t || { rm -f -- "$temp_conf"; return 1; }
  mv -- "$temp_conf" "$PROXY_CONF" || { rm -f -- "$temp_conf"; return 1; }
  systemctl reload "$PROXY_SERVICE" || return 1
  maintenance_entry_is_ready_after_restore || return 1
  rm -f -- "$CURRENT_FILE" || return 1
  PROXY_CONFIG_REPLACED=0
  PROXY_CONFIG_BACKUP=""
}

rollback_to_previous_entry() {
  local previous_ip=""

  [ "$ROLLBACK_ON_FAILURE" = "1" ] || return 1

  if [ "$PROXY_WAS_RUNNING" = "1" ] && [ -n "$CURRENT_CONTAINER" ]; then
    if ! container_running "$CURRENT_CONTAINER"; then
      if ! verify_container_uploads_mount_metadata "$CURRENT_CONTAINER"; then
        warn "Previous container uploads mount metadata is invalid: $CURRENT_CONTAINER"
        return 1
      fi
      if ! verify_container_upload_dir_config "$CURRENT_CONTAINER" 0; then
        warn "Previous container upload root configuration is invalid: $CURRENT_CONTAINER"
        return 1
      fi
      if ! docker start "$CURRENT_CONTAINER" >/dev/null; then
        warn "Failed to restart previous container $CURRENT_CONTAINER"
        return 1
      fi
      if ! verify_container_uploads_statfs "$CURRENT_CONTAINER"; then
        warn "Previous container uploads statfs identity is invalid: $CURRENT_CONTAINER"
        return 1
      fi
      if ! verify_container_upload_dir_runtime "$CURRENT_CONTAINER" 0; then
        warn "Previous container application upload root is invalid: $CURRENT_CONTAINER"
        return 1
      fi
      if ! wait_for_container_health "$CURRENT_CONTAINER" >/dev/null; then
        warn "Previous container did not become healthy: $CURRENT_CONTAINER"
        return 1
      fi
    else
      if ! verify_container_uploads_storage "$CURRENT_CONTAINER"; then
        warn "Previous container uploads storage identity is invalid: $CURRENT_CONTAINER"
        return 1
      fi
      if ! container_healthy "$CURRENT_CONTAINER"; then
        warn "Previous container is not healthy: $CURRENT_CONTAINER"
        return 1
      fi
    fi

    previous_ip="$(container_ip "$CURRENT_CONTAINER")"
    [ -n "$previous_ip" ] || return 1
    if ! write_proxy_config "${previous_ip}:3000" "$CURRENT_CONTAINER"; then
      return 1
    fi
    if ! switch_proxy; then
      return 1
    fi
    if ! verify_proxy_target "$CURRENT_CONTAINER"; then
      return 1
    fi
    if ! write_current_container "$CURRENT_CONTAINER"; then
      return 1
    fi
    resume_video_transcode "$CURRENT_CONTAINER" || {
      warn "Previous container traffic was restored but video transcode drain could not be resumed"
      return 1
    }
    resume_task_detail_upload "$CURRENT_CONTAINER" || {
      warn "Previous container traffic was restored but task-detail upload drain could not be resumed"
      return 1
    }
    return 0
  fi

  return 1
}

abort_after_uncertain_switch() {
  local reason="$1"

  warn "$reason"
  # Traffic may already have reached the candidate. From this point the EXIT
  # trap must never blindly resume either old or new workers; rollback handles
  # the chosen worker explicitly and otherwise leaves both sides drained.
  BACKGROUND_WORKERS_COMMITTED=1
  if [ "${PROXY_LOCK_HELD:-0}" != "1" ]; then
    if ! flock -w 30 8; then
      fail "$reason; proxy reconciliation lock could not be reacquired, so both containers remain drained"
    fi
    PROXY_LOCK_HELD=1
  fi
  if ! request_video_transcode_drain "$NEXT_CONTAINER"; then
    warn "Candidate video transcode worker could not be safely drained; rollback was not attempted"
    fail "$reason; both containers were preserved"
  fi
  if ! request_task_detail_upload_drain "$NEXT_CONTAINER"; then
    warn "Candidate task-detail upload worker could not be safely drained; rollback was not attempted"
    fail "$reason; both containers were preserved"
  fi
  if rollback_to_previous_entry; then
    ok "Previous entry was restored and verified"
    if wait_for_container_drain "$NEXT_CONTAINER" 15; then
      remove_video_container_safely "$NEXT_CONTAINER" || \
        warn "Rolled-back candidate was retained because video activity or stop state is uncertain"
    else
      warn "Rolled-back candidate was retained because an in-flight request is still using it"
    fi
    fail "$reason; deployment was rolled back"
  fi

  if restore_bootstrap_maintenance_entry; then
    ok "Bootstrap maintenance entry was restored and verified"
    if wait_for_container_drain "$NEXT_CONTAINER" 15; then
      remove_video_container_safely "$NEXT_CONTAINER" || \
        warn "Candidate was retained after maintenance rollback because its stop state is uncertain"
    else
      warn "Candidate was retained after maintenance rollback because an in-flight request is still using it"
    fi
    fail "$reason; deployment returned to the verified bootstrap maintenance entry"
  fi

  warn "Rollback could not be verified; candidate container is being kept for recovery"
  fail "$reason; both containers were preserved"
}

# The historical shadow topology shared production uploads/runtime while using
# a separate database lease. A running shadow app therefore makes global FFmpeg
# exclusivity unknowable; inspect both known names and the Compose service label.
verify_bootstrap_handoff_if_present

if [ "$TARGET" = "production" ]; then
  if ! RUNNING_CONTAINER_METADATA="$(docker ps --format '{{.Names}}\t{{.Label "com.docker.compose.service"}}')"; then
    fail "Cannot inspect running containers for shadow topology; production deployment is blocked"
  fi
  RUNNING_SHADOW_CONTAINERS="$(
    printf '%s\n' "$RUNNING_CONTAINER_METADATA" |
      awk -F '\t' '$1 == "youyidian-3d-material-shadow" || $1 ~ /^youyidian-3d-shadow($|[-_])/ || $2 == "app-shadow" { print $1 }' |
      sort -u
  )"
  if [ -n "$RUNNING_SHADOW_CONTAINERS" ]; then
    fail "Running shadow container(s) detected; production deployment is blocked until they are stopped and verified: $RUNNING_SHADOW_CONTAINERS"
  fi
fi

# This general deployment entry must never perform the one-time direct-to-proxy
# topology migration. Detect the legacy direct container before starting a
# candidate, changing traffic, draining workers, or stopping any container.
LEGACY_IMAGE="$(docker inspect -f '{{.Config.Image}}' "$CONTAINER_NAME" 2>/dev/null || true)"
PROXY_WAS_RUNNING=0
if is_proxy_running; then
  PROXY_WAS_RUNNING=1
elif [ -n "$LEGACY_IMAGE" ]; then
  fail "Stable local proxy is not running while legacy direct container $CONTAINER_NAME exists; no container or traffic was changed. Use the controlled one-time direct-to-proxy migration SOP before rerunning this deployment."
fi
if [ -n "$LEGACY_IMAGE" ]; then
  log "Legacy direct container detected behind an already-running stable proxy: $LEGACY_IMAGE"
fi

mkdir -p "$PROXY_ROOT"
exec 8>"$PROXY_RECONCILE_LOCK"
flock -w 30 8 || fail "Another proxy switch or reconciliation is already running"
PROXY_LOCK_HELD=1
install_proxy_reconciler

RECORDED_CONTAINER="$(read_recorded_container)"
if ! CURRENT_CONTAINER="$(discover_current_container)"; then
  fail "Cannot safely determine the active material container"
fi

if [ -n "$CURRENT_CONTAINER" ] && [ "$CURRENT_CONTAINER" != "$RECORDED_CONTAINER" ]; then
  warn "Repairing stale current-container state: ${RECORDED_CONTAINER:-missing} -> ${CURRENT_CONTAINER}"
  write_current_container "$CURRENT_CONTAINER"
fi

if [ "$DEPLOYMENT_STRATEGY" = "direct" ]; then
  [ -n "$CURRENT_CONTAINER" ] || fail "Direct replacement requires an active material container"
  direct_replace_active_container "$CURRENT_CONTAINER"
  exit 0
fi

if [ "$CURRENT_CONTAINER" = "$BLUE_CONTAINER" ]; then
  NEXT_CONTAINER="$GREEN_CONTAINER"
else
  NEXT_CONTAINER="$BLUE_CONTAINER"
fi

ensure_public_traffic_rollup_token

TRANSCODE_DRAIN_SOURCES=""
if [ -n "$CURRENT_CONTAINER" ]; then
  TRANSCODE_DRAIN_SOURCES="$CURRENT_CONTAINER"
fi
if [ -n "$LEGACY_IMAGE" ] && container_running "$CONTAINER_NAME"; then
  case " $TRANSCODE_DRAIN_SOURCES " in
    *" $CONTAINER_NAME "*) ;;
    *) TRANSCODE_DRAIN_SOURCES="${TRANSCODE_DRAIN_SOURCES} ${CONTAINER_NAME}" ;;
  esac
fi

# 蓝绿入口和意外残留的直连容器都可能运行 worker；必须逐个证明当前协议、
# 设置 drain 并等待 active 消失。任一状态不明都保留原容器并停止发布。
for TRANSCODE_DRAIN_SOURCE in $TRANSCODE_DRAIN_SOURCES; do
  if ! verify_container_uploads_storage "$TRANSCODE_DRAIN_SOURCE"; then
    fail "Existing container uploads mount could not be verified before drain; candidate was not created"
  fi
  if ! verify_transcode_lease_schema "$TRANSCODE_DRAIN_SOURCE"; then
    fail "Video transcode lease columns are missing or could not be verified; apply the additive Prisma migration before deployment"
  fi
  if ! verify_task_detail_upload_lease_schema "$TRANSCODE_DRAIN_SOURCE"; then
    fail "Task-detail upload job lease schema or migration checksum is missing; apply and audit the additive Prisma migration before deployment"
  fi
  if ! verify_material_upload_idempotency_schema "$TRANSCODE_DRAIN_SOURCE"; then
    fail "Existing container cannot verify the exact material uploadId column, unique index, and migration checksum; candidate was not created"
  fi
  if ! request_video_transcode_drain "$TRANSCODE_DRAIN_SOURCE"; then
    fail "Existing container cannot be safely drained for video transcode; candidate was not started (first rollout fails closed)"
  fi
  if ! request_task_detail_upload_drain "$TRANSCODE_DRAIN_SOURCE"; then
    fail "Existing container cannot be safely drained for task-detail uploads; candidate was not started (first rollout fails closed)"
  fi
  ok "Existing video transcode worker is drained: $TRANSCODE_DRAIN_SOURCE"
  ok "Existing task-detail upload worker is drained: $TRANSCODE_DRAIN_SOURCE"
done

log "Starting candidate container $NEXT_CONTAINER"
if ! verify_image_revision_label "$REGISTRY_COMMIT" "$COMMIT_SHA"; then
  fail "Candidate image label does not match the exact preflighted Git commit; no container or traffic was changed"
fi
if container_running "$NEXT_CONTAINER"; then
  if ! verify_container_uploads_storage "$NEXT_CONTAINER"; then
    fail "Inactive deployment slot $NEXT_CONTAINER has an untrusted uploads mount and cannot be safely drained"
  fi
  if ! request_video_transcode_drain "$NEXT_CONTAINER"; then
    fail "Inactive deployment slot $NEXT_CONTAINER cannot prove video transcode drain support"
  fi
  if ! request_task_detail_upload_drain "$NEXT_CONTAINER"; then
    fail "Inactive deployment slot $NEXT_CONTAINER cannot prove task-detail upload drain support"
  fi
  if ! wait_for_container_drain "$NEXT_CONTAINER" 15; then
    fail "Inactive deployment slot $NEXT_CONTAINER is still serving requests; retry after those requests finish"
  fi
  if ! wait_for_video_transcode_drain "$NEXT_CONTAINER" 2; then
    fail "Inactive deployment slot $NEXT_CONTAINER has unknown video activity and will not be removed"
  fi
  if ! wait_for_task_detail_upload_drain "$NEXT_CONTAINER" 2; then
    fail "Inactive deployment slot $NEXT_CONTAINER has unknown task-detail upload activity and will not be removed"
  fi
fi
if ! remove_video_container_safely "$NEXT_CONTAINER"; then
  fail "Inactive deployment slot $NEXT_CONTAINER could not be removed safely"
fi
forget_transcode_drain_target "$NEXT_CONTAINER"
forget_task_detail_drain_target "$NEXT_CONTAINER"
if ! prepare_worker_runtime_directories; then
  fail "Worker runtime directories could not be safely assigned to the verified application UID/GID"
fi
mkdir -p "$(dirname "$(transcode_drain_file "$NEXT_CONTAINER")")"
: > "$(transcode_drain_file "$NEXT_CONTAINER")"
chmod 600 "$(transcode_drain_file "$NEXT_CONTAINER")"
mkdir -p "$(dirname "$(task_detail_drain_file "$NEXT_CONTAINER")")"
: > "$(task_detail_drain_file "$NEXT_CONTAINER")"
chmod 600 "$(task_detail_drain_file "$NEXT_CONTAINER")"
if ! create_container "$NEXT_CONTAINER" "$REGISTRY_COMMIT" 0 >/tmp/git-deploy-new-container-id.txt; then
  fail_candidate_before_traffic "Candidate container could not be created"
fi
cat /tmp/git-deploy-new-container-id.txt
if ! verify_container_uploads_mount_metadata "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate uploads bind metadata failed before docker start"
fi
if ! verify_container_upload_dir_config "$NEXT_CONTAINER" 1; then
  fail_candidate_before_traffic "Candidate UPLOAD_DIR is not pinned to /app/uploads before docker start"
fi
if ! docker start "$NEXT_CONTAINER" >/dev/null; then
  fail_candidate_before_traffic "Candidate container could not be started"
fi
if ! verify_container_uploads_statfs "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate host/container statfs identity differs before health checks"
fi
if ! verify_container_upload_dir_runtime "$NEXT_CONTAINER" 1; then
  fail_candidate_before_traffic "Candidate application upload root is not exactly /app/uploads"
fi
if ! verify_container_baked_revision "$NEXT_CONTAINER" "$COMMIT_SHA"; then
  fail_candidate_before_traffic "Candidate image label or baked commit file does not match the exact Git commit"
fi

if ! NEXT_IP="$(wait_for_container_health "$NEXT_CONTAINER" "$COMMIT_SHA")"; then
  warn "Candidate container failed health check"
  if ! docker logs --tail 120 "$NEXT_CONTAINER" 2>&1; then
    warn "Candidate logs could not be read"
  fi
  fail_candidate_before_traffic "Deployment failed before traffic switch"
fi

ok "Candidate container is healthy at ${NEXT_IP}:3000"
if ! verify_transcode_lease_schema "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate cannot verify required video transcode lease columns; traffic was not switched"
fi
if ! verify_task_detail_upload_lease_schema "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate cannot verify task-detail upload job lease columns, index, and migration checksum; traffic was not switched"
fi
if ! verify_brand_logo_defaults "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate cannot verify safe brand logo database defaults and completed migration; traffic was not switched"
fi
if ! verify_material_upload_idempotency_schema "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate cannot verify material upload idempotency column, unique index, and completed migration; traffic was not switched"
fi
if ! verify_candidate_database_identity "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate database identity differs from the approved migration audit; traffic was not switched"
fi
if ! verify_candidate_brand_and_storage_dependencies "$NEXT_CONTAINER" "$NEXT_IP"; then
  fail_candidate_before_traffic "Candidate cannot authenticate to S3 or fully decode its configured and baked brand images; traffic was not switched"
fi
if ! verify_video_transcode_capability "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate did not publish the required video transcode drain capability"
fi
if ! verify_task_detail_upload_capability "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate did not publish the required task-detail upload drain capability"
fi
if ! wait_for_video_transcode_drain "$NEXT_CONTAINER" 2; then
  fail_candidate_before_traffic "Candidate started despite its pre-set drain marker; traffic was not switched"
fi
if ! wait_for_task_detail_upload_drain "$NEXT_CONTAINER" 2; then
  fail_candidate_before_traffic "Candidate started despite its pre-set task-detail drain marker; traffic was not switched"
fi
if ! write_proxy_config "${NEXT_IP}:3000" "$NEXT_CONTAINER"; then
  fail_candidate_before_traffic "Candidate proxy configuration could not be prepared"
fi
if ! verify_container_uploads_storage "$NEXT_CONTAINER" 1; then
  fail_candidate_before_traffic "Candidate uploads storage identity changed immediately before traffic switch"
fi

SWITCH_REPORTED_FAILURE=0
# nginx reload can complete before the shell receives its status. From this
# instruction onward traffic may have reached the candidate, so the generic
# EXIT trap must never resume the old workers on its own.
BACKGROUND_WORKERS_COMMITTED=1
if ! switch_proxy; then
  SWITCH_REPORTED_FAILURE=1
fi

if ! verify_proxy_target "$NEXT_CONTAINER"; then
  cat /tmp/git-deploy-entry-health.err >&2 2>/dev/null || true
  abort_after_uncertain_switch "Stable local entry did not verify the candidate target"
fi

if [ "$SWITCH_REPORTED_FAILURE" = "1" ]; then
  warn "Proxy switch command reported failure, but the runtime candidate target was independently verified"
fi

if ! write_current_container "$NEXT_CONTAINER"; then
  abort_after_uncertain_switch "Candidate traffic was verified but the committed target record could not be written"
fi

sleep 3
if ! verify_proxy_target "$NEXT_CONTAINER" "$COMMIT_SHA"; then
  abort_after_uncertain_switch "Candidate target did not remain healthy during the post-switch check"
fi

if ! resume_video_transcode "$NEXT_CONTAINER"; then
  abort_after_uncertain_switch "Candidate traffic is stable but its video transcode drain could not be resumed"
fi
if ! resume_task_detail_upload "$NEXT_CONTAINER"; then
  abort_after_uncertain_switch "Candidate traffic is stable but its task-detail upload drain could not be resumed"
fi
BACKGROUND_WORKERS_COMMITTED=1
ok "Candidate is the committed background worker: $NEXT_CONTAINER"

if [ -n "$CURRENT_CONTAINER" ] && [ "$CURRENT_CONTAINER" != "$NEXT_CONTAINER" ]; then
  if [ "$(runtime_proxy_container)" != "$NEXT_CONTAINER" ] || \
     [ "$(read_recorded_container)" != "$NEXT_CONTAINER" ] || \
     ! container_healthy "$NEXT_CONTAINER" "$COMMIT_SHA" || \
     ! verify_container_uploads_storage "$CURRENT_CONTAINER"; then
    abort_after_uncertain_switch "Proxy state changed before the previous container could be drained"
  fi

  if wait_for_container_drain "$CURRENT_CONTAINER" 15; then
    if wait_for_video_transcode_drain "$CURRENT_CONTAINER" 2 && \
       wait_for_task_detail_upload_drain "$CURRENT_CONTAINER" 2 && \
       docker stop --time 30 "$CURRENT_CONTAINER" >/dev/null 2>&1; then
      ok "Previous container stopped and retained for rollback: $CURRENT_CONTAINER"
    else
      warn "Previous container background-worker activity is not proven idle; it was retained in drain mode: $CURRENT_CONTAINER"
    fi
  else
    warn "Previous container is still serving an in-flight request and was retained: $CURRENT_CONTAINER"
  fi
fi

if ! verify_proxy_target "$NEXT_CONTAINER" "$COMMIT_SHA"; then
  abort_after_uncertain_switch "Candidate target failed after the previous container drain"
fi

if ! flock -u 8; then
  PROXY_LOCK_HELD=0
  abort_after_uncertain_switch "Proxy reconciliation lock could not be released for post-deployment verification"
fi
PROXY_LOCK_HELD=0
if ! systemctl start "$PROXY_RECONCILE_SERVICE"; then
  abort_after_uncertain_switch "Proxy reconciler failed its post-deployment verification"
fi
ok "Stable local entry is healthy on port $PORT"
docker logs --tail 20 "$NEXT_CONTAINER" 2>&1 || true

if install_public_traffic_rollup_timers; then
  if [ "$TARGET" = "production" ]; then
    if systemctl start "$PUBLIC_TRAFFIC_ROLLUP_SERVICE" >/tmp/public-traffic-rollup-sync.log 2>/tmp/public-traffic-rollup-sync.err; then
      ok "Public traffic statistics rollups synced"
    else
      warn "Public traffic statistics rollup sync failed; page remains available, check /tmp/public-traffic-rollup-sync.err"
      cat /tmp/public-traffic-rollup-sync.err >&2 || true
    fi

    backfill_start="$(TZ=Asia/Shanghai date -d '7 days ago' +%F)"
    backfill_end="$(TZ=Asia/Shanghai date -d 'yesterday' +%F)"
    if docker exec "$NEXT_CONTAINER" python3 /app/scripts/public-traffic-rollup-from-nginx.py --granularity day --start-date "$backfill_start" --end-date "$backfill_end" >/tmp/public-traffic-rollup-backfill.log 2>/tmp/public-traffic-rollup-backfill.err; then
      ok "Public traffic historical day rollups backfilled from ${backfill_start} to ${backfill_end}"
    else
      warn "Public traffic historical backfill failed; check /tmp/public-traffic-rollup-backfill.err"
      cat /tmp/public-traffic-rollup-backfill.err >&2 || true
    fi
  fi
else
  warn "Public traffic statistics rollup timers were not installed"
fi

if [ -n "$LEGACY_IMAGE" ]; then
  if ! remove_video_container_safely "$CONTAINER_NAME"; then
    abort_after_uncertain_switch "Legacy direct container could not be proven inactive and was preserved"
  fi
fi

if [ "$TARGET" = "production" ]; then
  log "Checking public FRP, authenticated S3, and Logo decode acceptance under the deployment lock"
  COMMITTED_PUBLIC_TARGET="$(tr -d '\r\n' < "$CURRENT_FILE" 2>/dev/null || true)"
  [ "$COMMITTED_PUBLIC_TARGET" = "$NEXT_CONTAINER" ] || abort_after_uncertain_switch "Production did not report the committed candidate target after cutover"
  curl -fsS --max-time 12 -D /tmp/git-deploy-public-health.headers \
    "$PUBLIC_APP_URL/api/health" >/tmp/git-deploy-public-health.json || \
    abort_after_uncertain_switch "Public application endpoint is unreachable after cutover"
  health_payload_is_ready /tmp/git-deploy-public-health.json "$COMMIT_SHA" || \
    abort_after_uncertain_switch "Public application endpoint does not prove the expected commit and healthy database/Redis after cutover"
  public_target_count="$(tr -d '\r' </tmp/git-deploy-public-health.headers | grep -Fic 'X-Material-Proxy-Target:' || true)"
  public_target="$(tr -d '\r' </tmp/git-deploy-public-health.headers | sed -nE 's/^X-Material-Proxy-Target:[[:space:]]*(.*)$/\1/Ip' | tail -n 1 || true)"
  [ "$public_target_count" = "1" ] && [ "$public_target" = "$COMMITTED_PUBLIC_TARGET" ] || \
    abort_after_uncertain_switch "Public application endpoint does not point uniquely to the deployed candidate after cutover"

  verify_candidate_authenticated_s3 "$NEXT_CONTAINER" || abort_after_uncertain_switch "Candidate lost authenticated access to the configured S3 bucket after cutover"
  curl -fsS --max-time 12 "https://s3.jiansun.vip/minio/health/live" >/tmp/git-deploy-public-s3-health.txt || \
    abort_after_uncertain_switch "Public S3 endpoint is unhealthy after cutover"
  curl -fsS --max-time 12 "$PUBLIC_APP_URL/api/system-settings" >/tmp/git-deploy-public-settings.json || \
    abort_after_uncertain_switch "Public system settings are unavailable after cutover"
  PUBLIC_APP_URL="$PUBLIC_APP_URL" docker exec -i -e PUBLIC_APP_URL="$PUBLIC_APP_URL" "$NEXT_CONTAINER" node -e '
const fs = require("fs");
(async () => {
  const chunks = [];
  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
  const input = Buffer.concat(chunks).toString("utf8");
  const settings = JSON.parse(input);
  const origin = new URL(process.env.PUBLIC_APP_URL);
  const values = [settings.headerLogoUrl, settings.loginLogoUrl];
  if (!values.every((value) => typeof value === "string" && value.length > 0)) process.exit(1);
  for (const value of values) {
    const parsed = new URL(value, origin);
    const local = parsed.origin === origin.origin && /^\/brand\/[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(parsed.pathname)
      && !parsed.search && !parsed.hash;
    const s3 = parsed.protocol === "https:" && parsed.hostname === "s3.jiansun.vip"
      && parsed.port === "" && parsed.pathname.startsWith("/gongxiangpan/") && !parsed.search && !parsed.hash;
    if (!local && !s3) process.exit(1);
  }
  process.stdout.write(values.join("\n") + "\n");
})().catch((error) => { process.stderr.write(String(error && error.message || error)); process.exitCode = 1; });
' </tmp/git-deploy-public-settings.json >/tmp/git-deploy-public-logo-urls.txt || \
    abort_after_uncertain_switch "Public system settings did not expose two trusted Logo URLs"

  logo_index=0
  while IFS= read -r logo_url; do
    logo_index=$((logo_index + 1))
    case "$logo_url" in /*) resolved_logo_url="${PUBLIC_APP_URL%/}${logo_url}" ;; *) resolved_logo_url="$logo_url" ;; esac
    curl -fsS --max-time 12 -D "/tmp/git-deploy-logo-${logo_index}.headers" \
      -o "/tmp/git-deploy-logo-${logo_index}.body" "$resolved_logo_url" || \
      abort_after_uncertain_switch "Configured public Logo ${logo_index} is unavailable after cutover"
    logo_content_type="$(tr -d '\r' <"/tmp/git-deploy-logo-${logo_index}.headers" | sed -nE 's/^Content-Type:[[:space:]]*([^;[:space:]]+).*$/\1/Ip' | tail -n 1 | tr 'A-Z' 'a-z')"
    case "$logo_content_type" in image/*) ;; *) abort_after_uncertain_switch "Configured public Logo ${logo_index} did not return an image Content-Type" ;; esac
    decode_image_stream_with_candidate "$NEXT_CONTAINER" < "/tmp/git-deploy-logo-${logo_index}.body" || abort_after_uncertain_switch "Configured public Logo ${logo_index} cannot be fully decoded"
  done </tmp/git-deploy-public-logo-urls.txt
  for fallback_logo in header-logo.png login-logo.png; do
    curl -fsS --max-time 12 -D /tmp/git-deploy-fallback-logo.headers \
      -o /tmp/git-deploy-fallback-logo.body "$PUBLIC_APP_URL/brand/$fallback_logo" || \
      abort_after_uncertain_switch "Local fallback Logo $fallback_logo is unavailable after cutover"
    fallback_content_type="$(tr -d '\r' </tmp/git-deploy-fallback-logo.headers | sed -nE 's/^Content-Type:[[:space:]]*([^;[:space:]]+).*$/\1/Ip' | tail -n 1 | tr 'A-Z' 'a-z')"
    case "$fallback_content_type" in image/*) ;; *) abort_after_uncertain_switch "Local fallback Logo $fallback_logo did not return an image Content-Type" ;; esac
    decode_image_stream_with_candidate "$NEXT_CONTAINER" </tmp/git-deploy-fallback-logo.body || abort_after_uncertain_switch "Local fallback Logo $fallback_logo cannot be fully decoded"
  done
  verify_candidate_baked_brand_assets "$NEXT_CONTAINER" || abort_after_uncertain_switch "Baked brand image assets cannot be fully decoded after cutover"
  ok "Public commit, target, database, Redis, authenticated S3, and all Logo images passed acceptance"
fi

[ -z "$READY_BOOTSTRAP_HANDOFF" ] || {
  mv -- "$READY_BOOTSTRAP_HANDOFF/handoff.ready" "$READY_BOOTSTRAP_HANDOFF/consumed" || \
    abort_after_uncertain_switch "Bootstrap handoff could not be atomically consumed after acceptance"
  chmod 600 "$READY_BOOTSTRAP_HANDOFF/consumed" || \
    abort_after_uncertain_switch "Consumed bootstrap handoff permissions could not be secured"
}
PROD_SCRIPT

  printf '%s' "$PROD_PAYLOAD" | prod_ssh_script \
    "$TARGET" "$CONTAINER_NAME" "$PORT" "$REGISTRY_COMMIT" "$EXPECTED_IMAGE_ID" "$COMMIT_SHA" \
    "/mnt/PoolOne/apps/youyidian-3d/$ENV_FILE" "$PUBLIC_APP_URL" "$CORS_ALLOWED_ORIGINS" \
    "$DINGTALK_CALLBACK_ORIGIN" "$DINGTALK_INTERNAL_RETURN_ORIGINS" "$S3_PUBLIC_DOMAIN" \
    "$DOWNLOAD_TOKEN_SECRET" "$PROXY_RECONCILE_SCRIPT_B64" 'youyidian-3d_app-network' \
    "$UPLOADS_MOUNT" "$ROLLBACK_ON_FAILURE" "$MIGRATION_AUDIT_FILE" "$MIGRATION_AUDIT_SHA256" \
    "$MIGRATION_AUDIT_SOURCE_COMMIT" "$REQUIRE_MIGRATION_AUDIT" "$DEPLOYMENT_STRATEGY"
  ok "Production deployment command completed"

  if [ "$TARGET" = "production" ]; then
    ok "Public commit, target, database, Redis, authenticated S3 and Logo decode acceptance completed under the production deployment lock"
  fi
else
  warn "Skipping production deployment by request"
fi

start_remote_step "Cleanup"
if [ "$KEEP_OLD_IMAGES" = "1" ]; then
  warn "Skipping cleanup by request"
else
  docker image prune -f >/dev/null 2>&1 || true
  if [ "$AGGRESSIVE_CLEANUP" = "1" ]; then
    docker builder prune -af --filter until=168h >/dev/null 2>&1 || true
    ok "Build server cleanup completed, including old build cache"
  else
    ok "Build server image cleanup completed; build cache preserved"
  fi

  prod_ssh \
    "docker image prune -af --filter until=6h >/dev/null 2>&1 || true"
  ok "Production server cleanup completed"
fi

start_remote_step "Deployment Summary"
ok "Target: $TARGET"
ok "Commit: $COMMIT_SHA"
ok "Image: $REGISTRY_COMMIT"
ok "Container: $CONTAINER_NAME"
'@

Write-Step "Git Incremental Deploy"
Write-Info "Target: $Target"
Write-Info "Repository: $RepoUrl"
Write-Info "Branch: $Branch"
if ($Commit) {
    Write-Info "Commit override: $Commit"
}
if ($DryRun) {
    Write-Warning-Custom 'DryRun mode: no code, image, or production container will be changed.'
}

Write-Info 'Resolving and scanning the exact Git tree that will be deployed...'
$resolvedTargetCommit = Invoke-LegacyStorageBoundaryPreflight `
    -RepositoryUrl $RepoUrl `
    -TargetBranch $Branch `
    -RequestedCommit $Commit
$tokens['__COMMIT__'] = ConvertTo-ShellSingleQuoted $resolvedTargetCommit
Write-Success "Exact deployment target passed legacy storage boundary preflight: $resolvedTargetCommit"

$remoteScript = $remoteTemplate
foreach ($key in $tokens.Keys) {
    $remoteScript = $remoteScript.Replace($key, $tokens[$key])
}

$exitCode = Invoke-BuildServerScript -ScriptText $remoteScript
if ($exitCode -ne 0) {
    Write-Error-Custom "Git incremental deployment failed with exit code $exitCode"
    exit $exitCode
}

Write-Success 'Git incremental deployment finished.'