#!/bin/sh
# Q129 CHECK -- the 2026-10-30 Timmy check-in carries the contract name in the
# tree and in git, its bytes are the bytes it was committed with, and the
# check-in ledger still reconciles against the directory it describes.
# rc 0 = four legs pass; 1 = a graded fault; 2 = could not grade.
set -u
REPO="$(cd "$(dirname "$0")/../.." && pwd)" || exit 2
cd "$REPO" || exit 2

CONTRACT="checkins/2026-10-30-timmy.md"
ORIGINAL="checkins/2026-10-30-timmy-tm-formidable.md"
PIN_SHA="ae9f399556e96ceaeac1506129ff556293e482d034df95cebddc3dff8722f7f3"
AUTHOR_REV="bd160bb"
WORK="${TMPDIR:-/tmp}/q129.$$"
fault=0

# (1) the contract name is present, the suffixed name is not -- in the tree,
#     and in the index when this is a worktree with one.
if [ -f "$CONTRACT" ]; then
    echo "ok name: $CONTRACT present"
else
    echo "FAIL name: $CONTRACT absent"; fault=$((fault+1))
fi
if [ -e "$ORIGINAL" ]; then
    echo "FAIL name: $ORIGINAL is back in the tree"; fault=$((fault+1))
else
    echo "ok name: $ORIGINAL absent from the tree"
fi
if git rev-parse --git-dir >/dev/null 2>&1; then
    if git ls-files --error-unmatch "$ORIGINAL" >/dev/null 2>&1; then
        echo "FAIL name: $ORIGINAL is tracked again"; fault=$((fault+1))
    else
        echo "ok name: $ORIGINAL is not tracked"
    fi
    if git ls-files --error-unmatch "$CONTRACT" >/dev/null 2>&1; then
        echo "ok name: $CONTRACT is tracked"
    else
        echo "FAIL name: $CONTRACT is not tracked"; fault=$((fault+1))
    fi
else
    echo "INFO name: not a git worktree -- tracking legs not graded"
fi

# (2) the bytes did not move. The pin is the blob as authored; when the
#     authoring rev is reachable, the digest is re-derived from it rather than
#     trusted, so an edited check-in cannot be re-pinned quietly.
if command -v sha256sum >/dev/null 2>&1 && [ -f "$CONTRACT" ]; then
    got="$(sha256sum "$CONTRACT" | cut -d' ' -f1)"
    if [ "$got" = "$PIN_SHA" ]; then
        echo "ok bytes: sha256 $got"
    else
        echo "FAIL bytes: sha256 $got != $PIN_SHA"; fault=$((fault+1))
    fi
    if git rev-parse --verify --quiet "$AUTHOR_REV:$ORIGINAL" >/dev/null 2>&1; then
        was="$(git show "$AUTHOR_REV:$ORIGINAL" | sha256sum | cut -d' ' -f1)"
        if [ "$was" = "$PIN_SHA" ]; then
            echo "ok bytes: $AUTHOR_REV:$ORIGINAL re-derives the same digest"
        else
            echo "FAIL bytes: $AUTHOR_REV:$ORIGINAL is $was, pin is $PIN_SHA"
            fault=$((fault+1))
        fi
    else
        echo "INFO bytes: $AUTHOR_REV:$ORIGINAL not reachable -- pin graded alone"
    fi
else
    echo "FAIL bytes: cannot read $CONTRACT or no sha256sum"; fault=$((fault+1))
fi

# (3) no check-in carries a fault class the ledger does not tolerate.
if python3 tools/checkin_check.py --repo . --fail \
        --baseline tools/checkin_baseline.tsv >"$WORK.ci" 2>&1; then
    echo "ok checkin: $(sed -n 's/^checkin_check: \(.*\)$/checkin_check: \1/p' "$WORK.ci" | tail -1)"
else
    cat "$WORK.ci"
    echo "FAIL checkin: rc != 0"
    fault=$((fault+1))
fi

# (4) the ledger still reconciles: re-emitting it moves no graded line.
if python3 tools/checkin_check.py --repo . --emit-baseline >"$WORK.emit" 2>&1; then
    grep -v '^#' "$WORK.emit" >"$WORK.emit.g"
    grep -v '^#' tools/checkin_baseline.tsv >"$WORK.base.g"
    if diff "$WORK.emit.g" "$WORK.base.g" >"$WORK.diff" 2>&1; then
        echo "ok ledger: re-emitted baseline differs on 0 non-comment line(s)"
    else
        head -20 "$WORK.diff"
        echo "FAIL ledger: re-emitted baseline differs from tools/checkin_baseline.tsv"
        fault=$((fault+1))
    fi
else
    echo "FAIL ledger: --emit-baseline rc != 0"
    fault=$((fault+1))
fi
rm -f "$WORK.ci" "$WORK.emit" "$WORK.emit.g" "$WORK.base.g" "$WORK.diff"

if [ "$fault" -ne 0 ]; then
    echo "q129: FAULT -- $fault leg line(s) red"
    exit 1
fi
echo "q129: 4 leg(s), 0 fault -- OK"
exit 0