# nh3-svos -> SVOS v0.0.24 (d14dc94), U22 card summaries. svos-dev thread 01M59P4Z1VJ4WHJB0N8N1P743K.
# PRE-REQS: the stage playbook; origin's v0.0.24 == d14dc94f6840 (git ls-remote on nh3-dev); Prime AT THE BOARD.
# This playbook does the release + the JUDGE (step 1 of svos-dev's order): backup, judge.toml explain_seconds, current,
# front door (UI 0.0.28), restart ONLY svos-judge -> a held card for app-judge (its reads refuse until approved: the task
# form's draft and admit wait). The INTERFACE restart is a separate playbook, run only after the judge's card is approved
# (nh3-svos-d14dc94-v0.0.24-interface.yaml). The kernel is NOT restarted (0.0.24 = 0.0.22 in code). No instance.toml change.
steps:
  - name: Pre-reqs present
    sudo: true
    shell: test -f /opt/svos/releases/d14dc94/apps-env/bin/svos-judge && readlink /opt/svos/current && runuser -u svc-svos -- /opt/svos/releases/d14dc94/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
    changed_when: "false"
  - name: Online backup to /var/lib/svos/backup/pre-d14dc94 (svos.db and the interface's stores)
    sudo: true
    shell: |
      set -e
      d=/var/lib/svos/backup/pre-d14dc94
      runuser -u svc-svos -- install -d -m 0700 $d
      runuser -u svc-svos -- python3 -c "
      import sqlite3, glob, os
      for src in ['/var/lib/svos/state/svos.db'] + sorted(glob.glob('/var/lib/svos/state/apps/interface/*.sqlite3')):
          dst = '$d/' + os.path.basename(src)
          s = sqlite3.connect('file:' + src + '?mode=ro', uri=True); t = sqlite3.connect(dst); s.backup(t); t.close(); s.close()
          c = sqlite3.connect('file:' + dst + '?mode=ro', uri=True); print(os.path.basename(src), 'integrity', c.execute('pragma integrity_check').fetchone()[0])"
      runuser -u svc-svos -- cp -p /var/lib/svos/config/apps/judge.toml /var/lib/svos/config/apps/judge.toml.pre-d14dc94
  - {name: judge.toml with explain_seconds, upload: {src: configs/svos-apps/judge.toml, dest: /var/lib/svos/config/apps/judge.toml.new, mode: "0600"}, sudo: true}
  - name: Swap judge.toml (owned by svc-svos)
    sudo: true
    shell: |
      set -e
      cd /var/lib/svos/config/apps
      chown svc-svos:svc-svos judge.toml.new && mv judge.toml.new judge.toml && grep -n '^explain_seconds' judge.toml
  - name: Switch current to d14dc94
    sudo: true
    shell: ln -sfn /opt/svos/releases/d14dc94 /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
  - name: Front door inventory (UI 0.0.28 live; 2f29d0d becomes previous)
    sudo: true
    shell: /usr/local/sbin/svos-front-inventory 2>&1 | grep -E 'GENERATED|updated|root \*|path /assets' | head -4
  - name: Restart ONLY svos-judge (raises the held card for app-judge)
    sudo: true
    shell: |
      systemctl restart svos-judge; sleep 6; systemctl is-active svos-judge
      journalctl -u svos-judge --since "-30s" --no-pager -o cat | grep -iE "manifest|revision|held|error|config" | tail -5 | cut -c1-200 || true
verify:
  - name: Judge on d14dc94; its manifest revision and card
    sudo: true
    shell: |
      pid=$(systemctl show svos-judge -p MainPID --value); grep -q /opt/svos/releases/d14dc94 /proc/$pid/maps && echo "judge pid $pid on d14dc94"
      python3 -c "
      import sqlite3
      c = sqlite3.connect('file:/var/lib/svos/state/svos.db?mode=ro', uri=True)
      for r in c.execute(\"select slug, revision, substr(sha256,1,12), state from app_manifests where slug='app-judge' order by revision desc limit 2\"): print(r)
      for r in c.execute(\"select id, kind, state, created_at, expires_at from cards where slug='app-judge' and kind='manifest' order by created_at desc limit 1\"): print(r)"
    changed_when: "false"