"""Run authorized normal Cluster maintenance with exact client source and retained baseline."""
from pathlib import Path
import hashlib,json,subprocess
here=Path(__file__).resolve().parent;root=Path('/home/worsch/railiance-cluster')
packet=here.parent/'netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r6'
manifest=json.loads((packet/'manifest.json').read_text())
for name in ['scripts/consistency_check.py']:
 pin=next(x['candidate_sha256'] for x in manifest['files'] if x['path']==name)
 assert hashlib.sha256((Path('/home/worsch/state-hub')/name).read_bytes()).hexdigest()==pin,'fixed-client-source-drift'
assert json.loads((here/'receiver-rollout-r4/before-verified-client.json').read_text())['stage']=='before-verified-client'
# Verify the installed entrypoint's actual packaged checker, not just checkout bytes.
probe=subprocess.run(['/home/worsch/state-hub/.venv/bin/python','-c',"import custodian_cli,hashlib,json; p=custodian_cli.STATE_HUB_DIR/'scripts/consistency_check.py'; print(json.dumps({'path':str(p),'sha256':hashlib.sha256(p.read_bytes()).hexdigest()}))"],cwd=root,capture_output=True,text=True,timeout=10)
assert probe.returncode==0;loaded=json.loads(probe.stdout);assert loaded['sha256']==next(x['candidate_sha256'] for x in manifest['files'] if x['path']=='scripts/consistency_check.py')
(here/'verified-loaded-client.json').write_text(json.dumps(loaded,indent=2)+'\n')
baseline_head=subprocess.check_output(['git','-C',str(root),'rev-parse','HEAD'],text=True).strip();assert baseline_head=='6ae3f847c83da3402883453ee7110457bfb2d0d6'
backup=here/'railiance-cluster-publication-backup';originals=json.loads((backup/'originals.json').read_text())
def git(*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE)
for name,index in originals.items():
 assert (root/name).read_bytes()==(backup/(name+'.worktree')).read_bytes()
 assert git('ls-files','--stage','--',name).decode()==index
# Shield original staged generated content from any legacy writeback index.
for name in originals:
 raw=git('ls-tree','HEAD','--',name).decode().split();git('update-index','--cacheinfo',raw[0],raw[2],name)
try:
 for label,argv,limit in [('verified-client-cluster-consistency',['statehub','fix-consistency','--repo','railiance-cluster','--json'],300),('verified-client-cluster-projection',['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(root),'--push'],180)]:
  r=subprocess.run(argv,cwd=root,capture_output=True,text=True,timeout=limit)
  (here/(label+'.json')).write_text(r.stdout);(here/(label+'.stderr.txt')).write_text(r.stderr)
  assert r.returncode==0,label+'-refused-receipt-retained'
finally:
 for name,index in originals.items():
  (root/name).write_bytes((backup/(name+'.worktree')).read_bytes())
  mode,oid,stage,path=index.split();assert stage=='0';git('update-index','--cacheinfo',mode,oid,path)
  assert git('ls-files','--stage','--',name).decode()==index
c=json.loads((here/'verified-client-cluster-consistency.json').read_text());assert c['summary']['fail']==c['summary']['automation_error']==0
assert 'bindings: synced 20/20' in c['fixes_applied'],'frozen-binding-omission-not-observed'
p=json.loads((here/'verified-client-cluster-projection.json').read_text());assert p['status']=='applied'
assert p['commit']==p['receipt']['expected_commit']==p['receipt']['derived_commit']==baseline_head
assert p['receipt']['instance_role']=='primary' and p['receipt']['instance_label']=='railiance01'
assert not p['receipt']['outcome']['refused'] and not p['receipt']['outcome']['retired']
print(json.dumps({'status':'applied','commit':p['commit'],'fixed_client_source_verified':True,'current_hash_comparison':'pending','original_failed_comparison_retained':True,'unrelated_work_preserved':True}))