#!/bin/sh
# ogma-image-bootok -- record a HEALTHY boot for the appliance IMAGE edition's
# A/B switch-back (10.E9 S2 part 2; Appliance contract D-A7 `RB-boot-counter`;
# the counter itself is etc/rc.image.subr's ogma_image_boot_begin).
#
#   ogma-image-bootok            record boot-ok for the active root
#   ogma-image-bootok --status   print the /mbr state line (read-only)
#
# Exec'd by sysd (daemon/sysd/image_boot.c) from its once-per-boot settle hook
# once authd's control socket exists -- "healthy" means the management plane
# came up, not merely that the kernel booted -- and retried from the tick
# until it succeeds. Root only (mounts /mbr). Inert on the software edition
# (exit 2: no image marker). Every failure is loud and exits non-zero so sysd
# audits it and retries; nothing here ever flips the active root.
#
# What it writes to /mbr/etc/ogma-boot.state (rc.image.subr's format):
# attempts=0, flips=0, the active letter joins the known-good set, last_ok=now,
# pending=0. Then it rewrites the tmpfs boot record so healthd/ctl show the
# reset without a reboot.
#
# Test seams (never operator knobs): OGMA_IMAGE_ROOT prefixes every path.

set -u

root=${OGMA_IMAGE_ROOT:-}
marker=$root/etc/ogmaprotect/image-layout
mbr=$root/mbr
mbr_etc=$mbr/etc		# the boot partition's own /etc (composed: /mbr/ is its own durable partition, not a root path)
state=$mbr_etc/ogma-boot.state
fstab=$root/etc/fstab
record=$root/var/run/ogmaprotect/image-boot

[ -f "$marker" ] || { echo "ogma-image-bootok: software edition (no image marker): nothing to record"; exit 2; }

active=$(awk '$2 == "/" { n = split($1, a, "."); print a[n]; exit }' "$fstab" 2>/dev/null)
case $active in d|e) ;; *) echo "ogma-image-bootok: cannot read the active root letter from $fstab" >&2; exit 4 ;; esac

mounted_by_us=0
if ! mount 2>/dev/null | grep -q " on $mbr "; then
	mount "$mbr" 2>/dev/null || { echo "ogma-image-bootok: /mbr did not mount" >&2; exit 3; }
	mounted_by_us=1
fi
finish() { [ "$mounted_by_us" = 1 ] && umount "$mbr" 2>/dev/null; }

a=$active; at=0; fl=0; g=-; lo=0; pe=0
if [ -r "$state" ]; then
	read -r m v a2 at2 fl2 g2 lo2 pe2 < "$state" 2>/dev/null || true
	if [ "${m:-}" = ogma-boot ] && [ "${v:-}" = 1 ]; then
		case ${g2:-} in ''|*[!de-]*) ;; *) g=$g2 ;; esac
		case ${fl2:-} in ''|*[!0-9]*) ;; *) fl=$fl2 ;; esac
		case ${at2:-} in ''|*[!0-9]*) ;; *) at=$at2 ;; esac
	fi
fi
if [ "${1:-}" = --status ]; then
	echo "active=$active attempts=$at flips=$fl good=$g last_ok=$lo pending=$pe"
	finish; exit 0
fi
# Add the active letter to the good set (ordered d then e for a stable token).
hd=0; he=0
case $g in *d*) hd=1 ;; esac
case $g in *e*) he=1 ;; esac
[ "$active" = d ] && hd=1
[ "$active" = e ] && he=1
g=
[ "$hd" = 1 ] && g=d
[ "$he" = 1 ] && g="${g}e"
[ -n "$g" ] || g=-
now=$(date +%s)
if ! printf 'ogma-boot 1 %s 0 0 %s %s 0\n' "$active" "$g" "$now" > "$state.tmp" 2>/dev/null ||
   ! mv "$state.tmp" "$state" 2>/dev/null; then
	echo "ogma-image-bootok: could not write $state" >&2
	finish; exit 4
fi
sync
finish
# The tmpfs record: keep everything rc published, reset the counters.
if [ -r "$record" ]; then
	read -r rm rv cs fr ra rat rfl rg rlo rab rpe < "$record" 2>/dev/null || true
	if [ "${rm:-}" = ogma-image-boot ]; then
		printf 'ogma-image-boot 1 %s %s %s 0 0 %s %s ok 0\n' "${cs:-unknown}" "${fr:-0}" "$active" "$g" "$now" > "$record.tmp" 2>/dev/null &&
		    mv "$record.tmp" "$record" 2>/dev/null
	fi
fi
echo "ogma-image-bootok: boot-ok recorded for root $active (good=$g)"
exit 0
