#!/bin/bash
# Full-only pre-.NET seam. Claim one persistent owned probe before forking;
# launchd then execs the original Apple daemon, including on a real failure.
set -u
PROOF_TOKEN="@@PROOF_TOKEN@@"
STATE_DIR="/Volumes/installstate"
MARKER="$STATE_DIR/probe.started"

bootstrap_failed() {
  printf '[full-bootstrap] ERROR: %s\n' "$1" >&2
  [ "$(cat "$STATE_DIR/run.owner" 2>/dev/null)" = "$PROOF_TOKEN" ] || return 1
  printf '{"token":"%s","phase":"bootstrap-failed","reason":"%s"}\n' "$PROOF_TOKEN" "$1" > "$STATE_DIR/guest-phase.bootstrap.$$.tmp" &&
    /bin/mv -f "$STATE_DIR/guest-phase.bootstrap.$$.tmp" "$STATE_DIR/guest-phase.json"
}

wait_for_owned_state() {
  local count=0
  while :; do
    if [ -e "$STATE_DIR/run.owner" ] || [ -L "$STATE_DIR/run.owner" ]; then
      [ -f "$STATE_DIR/run.owner" ] && [ ! -L "$STATE_DIR/run.owner" ] &&
        [ "$(cat "$STATE_DIR/run.owner" 2>/dev/null)" = "$PROOF_TOKEN" ] || {
          bootstrap_failed foreign_state_owner
          return 1
        }
      return 0
    fi
    if (( count >= 120 )); then
      bootstrap_failed state_share_mount_timeout
      return 1
    fi
    /sbin/mount_9p installstate >/dev/null 2>&1 || :
    count=$((count + 1))
    sleep 1
  done
}

owns_probe_marker() {
  local record extra
  [ -f "$MARKER" ] && [ ! -L "$MARKER" ] || return 1
  {
    IFS= read -r record || return 1
    if IFS= read -r extra || [ -n "$extra" ]; then return 1; fi
  } < "$MARKER"
  [ "$record" = "$PROOF_TOKEN:$source_commit" ]
}

claim_probe() {
  [[ "$PROOF_TOKEN" =~ ^[0-9a-f]{32}$ ]] || { bootstrap_failed invalid_probe_token; return 1; }
  [ "$(cat "$STATE_DIR/run.owner" 2>/dev/null)" = "$PROOF_TOKEN" ] || { bootstrap_failed foreign_state_owner; return 1; }
  source_commit=$(cat "$STATE_DIR/source.commit" 2>/dev/null) || { bootstrap_failed source_commit_missing; return 1; }
  [[ "$source_commit" =~ ^[0-9a-f]{40}$ ]] || { bootstrap_failed source_commit_invalid; return 1; }
  if [ -e "$MARKER" ] || [ -L "$MARKER" ]; then
    owns_probe_marker || { bootstrap_failed foreign_or_invalid_probe_marker; return 1; }
    return 2
  fi
  # Keep partial/failed markers: an incomplete first start is an error, no retry.
  if ! ( set -o noclobber; printf '%s:%s\n' "$PROOF_TOKEN" "$source_commit" > "$MARKER" ); then
    bootstrap_failed probe_marker_write_failed
    return 1
  fi
  owns_probe_marker || { bootstrap_failed probe_marker_incomplete; return 1; }
  return 0
}

if wait_for_owned_state && claim_probe; then
  (
    /bin/bash "$STATE_DIR/readiness.sh"
    child_exit=$?
    (( child_exit == 0 )) || bootstrap_failed first_probe_child_failed
  ) &
fi
exec /usr/libexec/recoveryosd