#!/usr/bin/env bash
set -euo pipefail

STATE_ROOT=/var/lib/rustd-resolved
SYSTEM_COPY=/usr/lib/systemd/rustd-resolved-switch
INSTALL_BASE=/usr/lib/systemd/rustd-resolved
GUARD_UNIT=/etc/systemd/system/rustd-resolved-guard.service
GUARD_NAME=rustd-resolved-guard.service
DROPIN_DIR=/etc/systemd/system/systemd-resolved.service.d
DROPIN_PATH=$DROPIN_DIR/90-rustd-resolved.conf
ACTIVE_LINK=$STATE_ROOT/active
MODE=install
CERTIFICATE=
TRANSACTION=
EXTERNAL_NAME=
MAX_CERTIFICATE_AGE=86400

usage() {
    cat <<'EOF'
Usage:
  sudo bash scripts/switch-resolved-transactionally-v2.sh --certificate FILE [OPTIONS]
  sudo bash scripts/switch-resolved-transactionally-v2.sh --confirm TRANSACTION
  sudo bash scripts/switch-resolved-transactionally-v2.sh --rollback [TRANSACTION]
  sudo /usr/lib/systemd/rustd-resolved-switch --guard

Install mode requires a schema-3 fail-closed certificate whose exact gate set passed
and whose daemon, client, and NSS module hashes match. The distro package remains
installed. Only a systemd ExecStart drop-in changes, and any failed health check
restores the exact prior drop-in, mask/enable state, guard unit, and active state.

Options:
  --certificate FILE       Certified report from certify-replacement-v2.sh
  --external-name NAME     Optional external DNS name for health checks
  --max-certificate-age S  Maximum certificate age in seconds (default 86400)
  --confirm TRANSACTION    Confirm after a healthy reboot
  --rollback [TRANSACTION] Restore selected or active transaction
  --guard                  Internal boot-guard mode
  -h, --help               Show this help
EOF
}

while (($#)); do
    case "$1" in
        --certificate)
            MODE=install
            CERTIFICATE=${2:?missing certificate path}
            shift 2
            ;;
        --external-name)
            EXTERNAL_NAME=${2:?missing external DNS name}
            shift 2
            ;;
        --max-certificate-age)
            MAX_CERTIFICATE_AGE=${2:?missing certificate age}
            shift 2
            ;;
        --confirm)
            MODE=confirm
            TRANSACTION=${2:?missing transaction id}
            shift 2
            ;;
        --rollback)
            MODE=rollback
            if (($# > 1)) && [[ ${2:-} != --* ]]; then
                TRANSACTION=$2
                shift 2
            else
                shift
            fi
            ;;
        --guard)
            MODE=guard
            shift
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            printf 'Unknown option: %s\n' "$1" >&2
            usage >&2
            exit 2
            ;;
    esac
done

valid_transaction_id() {
    [[ $1 =~ ^[0-9]{8}T[0-9]{6}-[1-9][0-9]*-[0-9a-f]{12}$ ]]
}

reject_git_environment() {
    local name
    while IFS='=' read -r name _; do
        if [[ $name == GIT_* ]]; then
            printf 'Ambient Git control is not permitted: %s\n' "$name" >&2
            return 2
        fi
    done < <(env)
}

if [[ $MODE == confirm || ( $MODE == rollback && -n $TRANSACTION ) ]]; then
    valid_transaction_id "$TRANSACTION" || {
        printf 'Invalid transaction id: %q\n' "$TRANSACTION" >&2
        exit 2
    }
fi

if [[ $MODE == install ]]; then
    printf '%s\n' \
        'Install mode is blocked until authenticated artifact provenance verification is implemented.' >&2
    exit 2
fi

[[ ${EUID:-$(id -u)} -eq 0 ]] || {
    printf 'This operation must run as root.\n' >&2
    exit 2
}
[[ $MAX_CERTIFICATE_AGE =~ ^[1-9][0-9]*$ ]] || {
    printf 'Certificate age must be a positive integer.\n' >&2
    exit 2
}

for command in busctl chmod cmp dirname env flock getent install mktemp mv python3 readlink sha256sum stat systemctl; do
    command -v "$command" >/dev/null || {
        printf 'Required command is missing: %s\n' "$command" >&2
        exit 2
    }
done
[[ -x /usr/bin/python3 ]] || {
    printf '%s\n' 'Required isolated Python interpreter is missing: /usr/bin/python3' >&2
    exit 2
}

# Install mode must prove the certificate and exact clean source checkout before
# creating state, taking the transaction lock, or changing the host. The copied
# guard/confirm/rollback program intentionally has no Git checkout dependency.
if [[ $MODE == install ]]; then
    reject_git_environment
    [[ -n $CERTIFICATE && -s $CERTIFICATE ]] || {
        printf 'A nonempty --certificate file is required.\n' >&2
        exit 2
    }
    command -v git >/dev/null || {
        printf 'Required install-mode command is missing: git\n' >&2
        exit 2
    }
    SOURCE_SCRIPT="$(readlink -f "${BASH_SOURCE[0]}")"
    REPOSITORY_ROOT="$(cd "$(dirname "$SOURCE_SCRIPT")/.." && pwd -P)"
    VERIFIER="$REPOSITORY_ROOT/scripts/verify-readiness-bundle.py"
    CONTRACT="$REPOSITORY_ROOT/scripts/replacement-certificate-contract.json"
    [[ -f $VERIFIER && -f $CONTRACT ]] || {
        printf 'Install mode must run from a complete resolver source checkout.\n' >&2
        exit 2
    }
    CERTIFICATE="$(readlink -f "$CERTIFICATE")"
    certificate_output=$(/usr/bin/python3 -I "$VERIFIER" \
        --certificate "$CERTIFICATE" \
        --maximum-age "$MAX_CERTIFICATE_AGE" \
        --source-root "$REPOSITORY_ROOT" \
        --shell-values) || {
        printf 'Certificate validation failed.\n' >&2
        exit 1
    }
    mapfile -t certificate_values <<<"$certificate_output"
    [[ ${#certificate_values[@]} -eq 9 ]] || {
        printf 'Certificate validation returned incomplete data.\n' >&2
        exit 1
    }
    SOURCE_COMMIT=${certificate_values[0]}
    SOURCE_TREE=${certificate_values[1]}
    BINARY=${certificate_values[2]}
    BINARY_SHA256=${certificate_values[3]}
    CLIENT=${certificate_values[4]}
    CLIENT_SHA256=${certificate_values[5]}
    NSS_MODULE=${certificate_values[6]}
    NSS_SHA256=${certificate_values[7]}
    UPSTREAM_COMMIT=${certificate_values[8]}
fi

if [[ -L $STATE_ROOT || -L $STATE_ROOT/transactions ]]; then
    printf 'Resolver state root must not contain symbolic links.\n' >&2
    exit 2
fi
install -d -m 0700 "$STATE_ROOT" "$STATE_ROOT/transactions"
STATE_ROOT_REAL="$(readlink -f "$STATE_ROOT")"
TRANSACTIONS_ROOT="$(readlink -f "$STATE_ROOT/transactions")"
if [[ $STATE_ROOT_REAL != "$STATE_ROOT" ]] \
    || [[ $TRANSACTIONS_ROOT != "$STATE_ROOT/transactions" ]]; then
    printf 'Resolver transaction root escaped its canonical location.\n' >&2
    exit 2
fi
exec 9>"$STATE_ROOT/transaction.lock"
flock -x 9

transaction_directory() {
    local transaction=$1
    local require_existing=${2:-true}
    valid_transaction_id "$transaction" || {
        printf 'Invalid transaction id: %q\n' "$transaction" >&2
        return 2
    }
    local directory="$TRANSACTIONS_ROOT/$transaction"
    if [[ $require_existing == true ]]; then
        [[ -d $directory && ! -L $directory ]] || {
            printf 'Unknown or unsafe transaction: %s\n' "$transaction" >&2
            return 2
        }
        [[ $(readlink -f "$directory") == "$directory" ]] || {
            printf 'Transaction directory escapes the state root: %s\n' \
                "$transaction" >&2
            return 2
        }
    else
        [[ ! -e $directory && ! -L $directory ]] || {
            printf 'Transaction already exists: %s\n' "$transaction" >&2
            return 2
        }
    fi
    printf '%s\n' "$directory"
}

active_transaction() {
    if [[ ! -e $ACTIVE_LINK && ! -L $ACTIVE_LINK ]]; then
        return 0
    fi
    [[ -L $ACTIVE_LINK ]] || {
        printf 'Active transaction marker is not a symbolic link.\n' >&2
        return 2
    }
    local target transaction expected
    target="$(readlink -f "$ACTIVE_LINK")" || return 2
    transaction="$(basename -- "$target")"
    valid_transaction_id "$transaction" || {
        printf 'Active transaction id is invalid: %q\n' "$transaction" >&2
        return 2
    }
    expected="$(transaction_directory "$transaction")" || return 2
    [[ $target == "$expected" ]] || {
        printf 'Active transaction marker escapes the transaction root.\n' >&2
        return 2
    }
    validate_transaction_chain "$transaction" >/dev/null || return 2
    printf '%s\n' "$transaction"
}

require_active_transaction() {
    local selected=$1
    local active
    active="$(active_transaction)" || return 2
    [[ -n $active && $active == "$selected" ]] || {
        printf 'Selected transaction is not active: %s\n' "$selected" >&2
        return 2
    }
}

metadata_value() {
    local metadata=$1
    local key=$2
    /usr/bin/python3 -I - "$metadata" "$key" <<'PY'
import json
import sys

data = json.load(open(sys.argv[1], encoding="utf-8"))
value = data
for component in sys.argv[2].split('.'):
    value = value.get(component) if isinstance(value, dict) else None
    if value is None:
        break
if isinstance(value, bool):
    print("true" if value else "false")
elif value is not None:
    print(value)
PY
}

validated_transaction_directory() {
    local transaction=$1
    local directory metadata
    directory="$(transaction_directory "$transaction")" || return 2
    metadata="$directory/transaction.json"
    [[ -f $metadata && ! -L $metadata ]] || {
        printf 'Transaction metadata is missing or unsafe: %s\n' "$transaction" >&2
        return 2
    }
    /usr/bin/python3 -I - "$metadata" "$transaction" "$INSTALL_BASE" <<'PY' || return 2
import json
from pathlib import Path
import re
import sys

path = Path(sys.argv[1])
transaction = sys.argv[2]
install_base = Path(sys.argv[3])
try:
    data = json.loads(path.read_text(encoding="utf-8"))
except (OSError, json.JSONDecodeError) as error:
    raise SystemExit(f"invalid transaction metadata: {error}")
transaction_pattern = re.compile(
    r"^[0-9]{8}T[0-9]{6}-[1-9][0-9]*-[0-9a-f]{12}$"
)
oid_pattern = re.compile(r"^[0-9a-f]{40}$")
hash_pattern = re.compile(r"^[0-9a-f]{64}$")
if not isinstance(data, dict) or data.get("schema") != 2:
    raise SystemExit("invalid transaction metadata schema")
if data.get("transaction") != transaction or not transaction_pattern.fullmatch(transaction):
    raise SystemExit("transaction metadata id differs")
parent = data.get("parent_transaction")
if parent is not None and (
    not isinstance(parent, str) or not transaction_pattern.fullmatch(parent)
):
    raise SystemExit("transaction metadata parent id is invalid")
for key in ("source_commit", "source_tree", "upstream_commit"):
    value = data.get(key)
    if not isinstance(value, str) or not oid_pattern.fullmatch(value):
        raise SystemExit(f"transaction metadata {key} is invalid")
source = data["source_commit"]
expected_paths = {
    "installed_binary": str(install_base / source / "systemd-resolved"),
    "installed_client": str(install_base / source / "resolvectl"),
    "installed_nss": str(install_base / source / "libnss_resolve.so.2"),
}
for key, expected in expected_paths.items():
    if data.get(key) != expected:
        raise SystemExit(f"transaction metadata {key} escapes its install root")
for key in ("daemon_sha256", "client_sha256", "nss_sha256"):
    value = data.get(key)
    if not isinstance(value, str) or not hash_pattern.fullmatch(value):
        raise SystemExit(f"transaction metadata {key} is invalid")
external = data.get("external_name")
if external is not None and (
    not isinstance(external, str)
    or not external
    or len(external) > 253
    or any(character.isspace() for character in external)
):
    raise SystemExit("transaction metadata external name is invalid")
PY
    printf '%s\n' "$directory"
}

validate_transaction_chain() {
    local transaction=$1
    local current=$transaction
    local directory=
    local first_directory=
    local metadata parent
    local seen=' '
    while [[ -n $current ]]; do
        case "$seen" in
            *" $current "*)
                printf 'Transaction parent chain contains a cycle: %s\n' \
                    "$current" >&2
                return 2
                ;;
        esac
        seen+="$current "
        directory="$(validated_transaction_directory "$current")" || return 2
        [[ -n $first_directory ]] || first_directory=$directory
        metadata="$directory/transaction.json"
        parent="$(metadata_value "$metadata" parent_transaction)" || return 2
        current=$parent
    done
    printf '%s\n' "$first_directory"
}

preflight_optional_backup() {
    local directory=$1
    local stem=$2
    local kind=$3
    local marker="$directory/$stem.existed"
    local backup="$directory/$stem.previous"
    if [[ -e $marker || -L $marker ]]; then
        [[ -f $marker && ! -L $marker && ! -s $marker ]] || {
            printf 'Saved %s marker is unsafe.\n' "$stem" >&2
            return 2
        }
        case "$kind" in
            regular)
                [[ -f $backup && ! -L $backup ]] || {
                    printf 'Saved %s backup is missing or unsafe.\n' "$stem" >&2
                    return 2
                }
                ;;
            file-or-link)
                [[ ( -f $backup && ! -L $backup ) || -L $backup ]] || {
                    printf 'Saved %s backup is missing or unsafe.\n' "$stem" >&2
                    return 2
                }
                ;;
            *)
                printf 'Invalid backup preflight kind: %s\n' "$kind" >&2
                return 2
                ;;
        esac
    elif [[ -e $backup || -L $backup ]]; then
        printf 'Saved %s backup has no matching marker.\n' "$stem" >&2
        return 2
    fi
}

preflight_state_value() {
    local directory=$1
    local name=$2
    local kind=$3
    local path="$directory/$name"
    [[ -f $path && ! -L $path ]] || {
        printf 'Saved unit state is missing or unsafe: %s\n' "$name" >&2
        return 2
    }
    local value
    value=$(<"$path")
    case "$kind:$value" in
        enabled:masked|enabled:masked-runtime|enabled:enabled|\
        enabled:enabled-runtime|enabled:disabled|enabled:static|\
        enabled:indirect|enabled:generated|enabled:transient|enabled:alias|\
        enabled:linked|enabled:linked-runtime|enabled:bad|enabled:not-found|\
        active:active|active:inactive)
            ;;
        *)
            printf 'Saved unit state is invalid: %s=%q\n' "$name" "$value" >&2
            return 2
            ;;
    esac
}

preflight_restore_transaction() {
    local transaction=$1
    local directory metadata parent
    directory="$(validate_transaction_chain "$transaction")" || return 2
    metadata="$directory/transaction.json"
    parent=$(metadata_value "$metadata" parent_transaction) || return 2

    preflight_optional_backup "$directory" dropin file-or-link || return 2
    preflight_optional_backup "$directory" guard file-or-link || return 2
    preflight_optional_backup "$directory" system-copy regular || return 2
    preflight_state_value "$directory" resolved-enabled.before enabled || return 2
    preflight_state_value "$directory" resolved-active.before active || return 2
    preflight_state_value "$directory" guard-enabled.before enabled || return 2
    preflight_state_value "$directory" guard-active.before active || return 2
    if [[ -e $directory/rollback-phase || -L $directory/rollback-phase ]]; then
        [[ -f $directory/rollback-phase && ! -L $directory/rollback-phase ]] || {
            printf '%s\n' 'Rollback phase journal is unsafe.' >&2
            return 2
        }
        local rollback_phase
        rollback_phase=$(<"$directory/rollback-phase")
        case "$rollback_phase" in
            restoring-files|restoring-units|removing-install|restoring-active|complete) ;;
            *)
                printf 'Rollback phase journal is invalid: %q\n' "$rollback_phase" >&2
                return 2
                ;;
        esac
    fi

    local active_marker="$directory/active.existed"
    local active_backup="$directory/active.previous"
    local prior_target= prior_transaction= expected_prior=
    if [[ -e $active_marker || -L $active_marker ]]; then
        [[ -f $active_marker && ! -L $active_marker && ! -s $active_marker ]] || {
            printf '%s\n' 'Saved active marker is unsafe.' >&2
            return 2
        }
        [[ -L $active_backup ]] || {
            printf '%s\n' 'Saved active transaction link is missing or unsafe.' >&2
            return 2
        }
        prior_target="$(readlink -f "$active_backup")" || return 2
        prior_transaction="$(basename -- "$prior_target")"
        [[ -n $parent && $prior_transaction == "$parent" ]] || {
            printf '%s\n' 'Saved active transaction differs from metadata parent.' >&2
            return 2
        }
        expected_prior="$(transaction_directory "$parent")" || return 2
        [[ $prior_target == "$expected_prior" ]] || {
            printf '%s\n' 'Saved active transaction escapes the transaction root.' >&2
            return 2
        }
    else
        [[ ! -e $active_backup && ! -L $active_backup && -z $parent ]] || {
            printf '%s\n' 'Saved active transaction state is inconsistent.' >&2
            return 2
        }
    fi

    local live
    for live in "$DROPIN_PATH" "$GUARD_UNIT" "$SYSTEM_COPY"; do
        [[ ! -d $live || -L $live ]] || {
            printf 'Live rollback target is an unsafe directory: %s\n' "$live" >&2
            return 2
        }
    done
    if [[ -e $ACTIVE_LINK || -L $ACTIVE_LINK ]]; then
        [[ -L $ACTIVE_LINK ]] || {
            printf '%s\n' 'Live active transaction marker is unsafe.' >&2
            return 2
        }
        local live_target
        live_target="$(readlink -f "$ACTIVE_LINK")" || return 2
        [[ $live_target == "$directory" \
            || ( -n $expected_prior && $live_target == "$expected_prior" ) ]] || {
            printf '%s\n' 'Live active transaction state differs from rollback state.' >&2
            return 2
        }
    fi
    printf '%s\n' "$directory"
}

unit_state() {
    local property=$1
    systemctl show --property "$property" --value systemd-resolved.service 2>/dev/null || true
}

restore_enable_state() {
    local state=$1
    case "$state" in
        masked)
            systemctl unmask systemd-resolved.service >/dev/null 2>&1 || return 1
            systemctl mask systemd-resolved.service >/dev/null || return 1
            ;;
        masked-runtime)
            systemctl unmask systemd-resolved.service >/dev/null 2>&1 || return 1
            systemctl mask --runtime systemd-resolved.service >/dev/null || return 1
            ;;
        enabled)
            systemctl unmask systemd-resolved.service >/dev/null 2>&1 || return 1
            systemctl enable systemd-resolved.service >/dev/null 2>&1 || return 1
            ;;
        enabled-runtime)
            systemctl unmask systemd-resolved.service >/dev/null 2>&1 || return 1
            systemctl enable --runtime systemd-resolved.service >/dev/null 2>&1 || return 1
            ;;
        disabled)
            systemctl unmask systemd-resolved.service >/dev/null 2>&1 || return 1
            systemctl disable systemd-resolved.service >/dev/null 2>&1 || return 1
            ;;
        static|indirect|generated|transient|alias|linked|linked-runtime|bad|not-found)
            ;;
        *)
            printf 'Cannot restore unrecognized previous unit-file state %s\n' "$state" >&2
            return 1
            ;;
    esac
    local observed status=0
    observed="$(systemctl is-enabled systemd-resolved.service 2>/dev/null)" \
        || status=$?
    if [[ -z $observed || $observed != "$state" ]]; then
        printf 'Restored resolver enable state differs: expected %s, got %s (status %s).\n' \
            "$state" "${observed:-<empty>}" "$status" >&2
        return 1
    fi
}

restore_active_state() {
    local state=$1
    case "$state" in
        active)
            systemctl restart systemd-resolved.service || return 1
            ;;
        inactive)
            systemctl stop systemd-resolved.service >/dev/null 2>&1 || return 1
            ;;
        *) return 1 ;;
    esac
    local observed status=0
    observed="$(systemctl is-active systemd-resolved.service 2>/dev/null)" \
        || status=$?
    if [[ -z $observed || $observed != "$state" ]]; then
        printf 'Restored resolver active state differs: expected %s, got %s (status %s).\n' \
            "$state" "${observed:-<empty>}" "$status" >&2
        return 1
    fi
}

verify_restored_backup() {
    local directory=$1
    local stem=$2
    local target=$3
    local backup="$directory/$stem.previous"
    if [[ -e $directory/$stem.existed ]]; then
        if [[ -L $backup ]]; then
            [[ -L $target && $(readlink -- "$target") == "$(readlink -- "$backup")" \
                && $(stat -c '%f:%u:%g' -- "$target") == "$(stat -c '%f:%u:%g' -- "$backup")" ]] \
                || return 1
        else
            [[ -f $target && ! -L $target ]] || return 1
            cmp -s -- "$backup" "$target" || return 1
            [[ $(stat -c '%f:%u:%g' -- "$target") == "$(stat -c '%f:%u:%g' -- "$backup")" ]] \
                || return 1
        fi
    else
        [[ ! -e $target && ! -L $target ]] || return 1
    fi
}

atomic_restore_backup() {
    local directory=$1
    local stem=$2
    local target=$3
    local parent
    parent="$(dirname -- "$target")"
    [[ -d $parent && ! -L $parent ]] || {
        printf 'Restore parent is missing or unsafe: %s\n' "$parent" >&2
        return 1
    }
    local stage
    stage="$(mktemp -d "$parent/.rustd-resolved-restore.XXXXXX")" || return 1
    if [[ -e $directory/$stem.existed ]]; then
        if ! cp -a --no-dereference "$directory/$stem.previous" "$stage/value" \
            || ! mv -f --no-target-directory "$stage/value" "$target"; then
            rm -rf -- "$stage"
            return 1
        fi
    elif ! rm -f -- "$target"; then
        rm -rf -- "$stage"
        return 1
    fi
    rmdir -- "$stage" || return 1
    verify_restored_backup "$directory" "$stem" "$target" || {
        printf 'Restored file state differs for %s.\n' "$target" >&2
        return 1
    }
}

restore_guard() {
    local directory=$1
    atomic_restore_backup "$directory" guard "$GUARD_UNIT" || return 1
    systemctl daemon-reload || return 1
    if ! systemctl disable --now "$GUARD_NAME" >/dev/null 2>&1; then
        local current_enabled current_active enabled_status=0 active_status=0
        current_enabled="$(systemctl is-enabled "$GUARD_NAME" 2>/dev/null)" \
            || enabled_status=$?
        current_active="$(systemctl is-active "$GUARD_NAME" 2>/dev/null)" \
            || active_status=$?
        case "$current_enabled" in
            disabled|static|indirect|generated|transient|alias|bad|not-found) ;;
            *)
                printf 'Could not disable restored guard unit (state %s, status %s).\n' \
                    "${current_enabled:-<empty>}" "$enabled_status" >&2
                return 1
                ;;
        esac
        [[ $current_active == inactive ]] || {
            printf 'Could not stop restored guard unit (state %s, status %s).\n' \
                "${current_active:-<empty>}" "$active_status" >&2
            return 1
        }
    fi
    local guard_enabled guard_active
    guard_enabled=$(<"$directory/guard-enabled.before") || return 1
    guard_active=$(<"$directory/guard-active.before") || return 1
    case "$guard_enabled" in
        enabled) systemctl enable "$GUARD_NAME" >/dev/null 2>&1 || return 1 ;;
        enabled-runtime) systemctl enable --runtime "$GUARD_NAME" >/dev/null 2>&1 || return 1 ;;
        disabled) systemctl disable "$GUARD_NAME" >/dev/null 2>&1 || return 1 ;;
        masked) systemctl mask "$GUARD_NAME" >/dev/null 2>&1 || return 1 ;;
        masked-runtime) systemctl mask --runtime "$GUARD_NAME" >/dev/null 2>&1 || return 1 ;;
        static|indirect|generated|transient|alias|linked|linked-runtime|bad|not-found) ;;
        *) return 1 ;;
    esac
    if [[ $guard_active == active ]]; then
        systemctl start "$GUARD_NAME" >/dev/null 2>&1 || return 1
    fi
    local observed_enabled observed_active enabled_status=0 active_status=0
    observed_enabled="$(systemctl is-enabled "$GUARD_NAME" 2>/dev/null)" \
        || enabled_status=$?
    observed_active="$(systemctl is-active "$GUARD_NAME" 2>/dev/null)" \
        || active_status=$?
    [[ $observed_enabled == "$guard_enabled" ]] || {
        printf 'Restored guard enable state differs: expected %s, got %s (status %s).\n' \
            "$guard_enabled" "${observed_enabled:-<empty>}" "$enabled_status" >&2
        return 1
    }
    [[ $observed_active == "$guard_active" ]] || {
        printf 'Restored guard active state differs: expected %s, got %s (status %s).\n' \
            "$guard_active" "${observed_active:-<empty>}" "$active_status" >&2
        return 1
    }
}

restore_system_copy() {
    local directory=$1
    atomic_restore_backup "$directory" system-copy "$SYSTEM_COPY" || return 1
}

write_rollback_phase() {
    local directory=$1
    local phase=$2
    local temporary
    temporary="$(mktemp "$directory/.rollback-phase.XXXXXX")" || return 1
    if ! printf '%s\n' "$phase" >"$temporary" \
        || ! chmod 0600 "$temporary" \
        || ! mv -f --no-target-directory "$temporary" "$directory/rollback-phase"; then
        rm -f -- "$temporary"
        return 1
    fi
}

write_transaction_timestamp() {
    local directory=$1
    local name=$2
    local temporary
    temporary="$(mktemp "$directory/.${name}.XXXXXX")" || return 1
    if ! date --utc --iso-8601=seconds >"$temporary" \
        || ! chmod 0600 "$temporary" \
        || ! mv -f --no-target-directory "$temporary" "$directory/$name"; then
        rm -f -- "$temporary"
        return 1
    fi
}

mutation_checkpoint() {
    local name=$1
    if [[ ${RUSTD_RESOLVED_SWITCH_TEST_FAIL_AT:-} == "$name" ]]; then
        printf 'Injected switch failure at %s.\n' "$name" >&2
        return 99
    fi
}

health_check() {
    local transaction=$1
    local directory
    directory="$(validate_transaction_chain "$transaction")" || return 1
    local metadata="$directory/transaction.json"

    local binary client nss external expected_binary pid
    binary=$(metadata_value "$metadata" installed_binary)
    client=$(metadata_value "$metadata" installed_client)
    nss=$(metadata_value "$metadata" installed_nss)
    external=$(metadata_value "$metadata" external_name)
    [[ -x $binary && -x $client && -f $nss ]] || return 1

    local expected_daemon_hash expected_client_hash expected_nss_hash
    expected_daemon_hash=$(metadata_value "$metadata" daemon_sha256)
    expected_client_hash=$(metadata_value "$metadata" client_sha256)
    expected_nss_hash=$(metadata_value "$metadata" nss_sha256)
    [[ $(sha256sum "$binary" | awk '{print $1}') == "$expected_daemon_hash" ]] || return 1
    [[ $(sha256sum "$client" | awk '{print $1}') == "$expected_client_hash" ]] || return 1
    [[ $(sha256sum "$nss" | awk '{print $1}') == "$expected_nss_hash" ]] || return 1

    systemctl is-active --quiet systemd-resolved.service || return 1
    pid=$(unit_state MainPID)
    [[ $pid =~ ^[1-9][0-9]*$ ]] || return 1
    expected_binary=$(readlink -f "/proc/$pid/exe") || return 1
    [[ $expected_binary == "$(readlink -f "$binary")" ]] || return 1

    /usr/bin/python3 -I - <<'PY' || return 1
import socket
import struct

name = b"\x09localhost\0"
query = struct.pack("!HHHHHH", 0x5253, 0x0100, 1, 0, 0, 0) + name + struct.pack("!HH", 1, 1)
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as stream:
    stream.settimeout(2)
    stream.sendto(query, ("127.0.0.53", 53))
    response, _ = stream.recvfrom(65535)
    if len(response) < 12 or response[:2] != b"RS" or response[3] & 0x0F:
        raise SystemExit(1)
with socket.create_connection(("127.0.0.53", 53), timeout=2) as stream:
    stream.sendall(struct.pack("!H", len(query)) + query)
    length_data = b""
    while len(length_data) < 2:
        chunk = stream.recv(2 - len(length_data))
        if not chunk:
            raise SystemExit(1)
        length_data += chunk
    length = struct.unpack("!H", length_data)[0]
    response = b""
    while len(response) < length:
        chunk = stream.recv(length - len(response))
        if not chunk:
            raise SystemExit(1)
        response += chunk
    if response[:2] != b"RS" or response[3] & 0x0F:
        raise SystemExit(1)
PY

    busctl --system --no-pager introspect \
        org.rustd.resolve1 /org/rustd/resolve1 \
        org.rustd.resolve1.Manager >/dev/null || return 1
    "$client" status >/dev/null || return 1
    "$client" statistics >/dev/null || return 1
    "$client" query localhost >/dev/null || return 1
    SYSTEMD_NSS_RESOLVE_SHM=0 \
        SYSTEMD_NSS_RESOLVE_STUB=0 \
        LD_LIBRARY_PATH="$(dirname "$nss")" \
        getent -s resolve ahosts localhost >/dev/null || return 1
    getent ahosts localhost >/dev/null || return 1
    if [[ -n $external ]]; then
        "$client" query "$external" >/dev/null || return 1
        SYSTEMD_NSS_RESOLVE_SHM=0 \
            SYSTEMD_NSS_RESOLVE_STUB=0 \
            LD_LIBRARY_PATH="$(dirname "$nss")" \
            getent -s resolve ahosts "$external" >/dev/null || return 1
        getent ahosts "$external" >/dev/null || return 1
    fi
    return 0
}

restore_transaction() {
    local transaction=$1
    local directory
    directory="$(preflight_restore_transaction "$transaction")" || return 1
    local metadata="$directory/transaction.json"
    write_rollback_phase "$directory" restoring-files || return 1

    install -d -m 0755 "$DROPIN_DIR" || return 1
    atomic_restore_backup "$directory" dropin "$DROPIN_PATH" || return 1
    if [[ ! -e $directory/dropin.existed ]]; then
        rmdir "$DROPIN_DIR" 2>/dev/null || true
    fi

    restore_guard "$directory" || return 1
    restore_system_copy "$directory" || return 1
    systemctl daemon-reload || return 1
    write_rollback_phase "$directory" restoring-units || return 1
    local enabled active
    enabled=$(<"$directory/resolved-enabled.before") || return 1
    active=$(<"$directory/resolved-active.before") || return 1
    if [[ $enabled == masked || $enabled == masked-runtime ]]; then
        systemctl unmask systemd-resolved.service >/dev/null 2>&1 || return 1
        restore_active_state "$active" || return 1
        restore_enable_state "$enabled" || return 1
    else
        restore_enable_state "$enabled" || return 1
        restore_active_state "$active" || return 1
    fi

    local installed_binary installed_client installed_nss install_root
    installed_binary=$(metadata_value "$metadata" installed_binary) || return 1
    installed_client=$(metadata_value "$metadata" installed_client) || return 1
    installed_nss=$(metadata_value "$metadata" installed_nss) || return 1
    install_root=$(dirname -- "$installed_binary")
    write_rollback_phase "$directory" removing-install || return 1
    rm -f "$installed_binary" "$installed_client" "$installed_nss" || return 1
    if [[ -d $install_root ]]; then
        rmdir "$install_root" || return 1
    fi

    write_transaction_timestamp "$directory" rolled-back-at || return 1
    write_rollback_phase "$directory" restoring-active || return 1
    atomic_restore_backup "$directory" active "$ACTIVE_LINK" || return 1
    rm -f "$directory/pending" || return 1
    write_rollback_phase "$directory" complete || return 1
    printf 'Rolled back resolver transaction %s.\n' "$transaction"
}

case "$MODE" in
    guard)
        TRANSACTION=$(active_transaction)
        [[ -n $TRANSACTION ]] || exit 0
        directory="$(validate_transaction_chain "$TRANSACTION")"
        [[ -e $directory/pending ]] || exit 0
        if health_check "$TRANSACTION"; then
            printf 'Resolver transaction %s passed the boot guard.\n' "$TRANSACTION"
            exit 0
        fi
        printf 'Resolver transaction %s failed the boot guard; rolling back.\n' "$TRANSACTION" >&2
        restore_transaction "$TRANSACTION"
        exit 1
        ;;
    confirm)
        require_active_transaction "$TRANSACTION"
        directory="$(preflight_restore_transaction "$TRANSACTION")"
        [[ -e $directory/pending ]] || {
            printf 'Transaction is not pending: %s\n' "$TRANSACTION" >&2
            exit 2
        }
        health_check "$TRANSACTION" || {
            printf 'Transaction is not healthy and cannot be confirmed.\n' >&2
            exit 1
        }
        restore_guard "$directory" || {
            printf '%s\n' 'Could not restore the pre-transaction guard state.' >&2
            exit 1
        }
        rm -f "$directory/pending" || exit 1
        write_transaction_timestamp "$directory" confirmed-at || exit 1
        printf 'Confirmed resolver transaction %s.\n' "$TRANSACTION"
        exit 0
        ;;
    rollback)
        if [[ -z $TRANSACTION ]]; then
            TRANSACTION=$(active_transaction)
        fi
        [[ -n $TRANSACTION ]] || {
            printf 'There is no active resolver transaction.\n' >&2
            exit 2
        }
        require_active_transaction "$TRANSACTION"
        restore_transaction "$TRANSACTION"
        exit 0
        ;;
    install)
        ;;
    *)
        printf 'Invalid mode: %s\n' "$MODE" >&2
        exit 2
        ;;
esac

[[ -x $BINARY && -x $CLIENT && -f $NSS_MODULE ]] || {
    printf 'Certified daemon, client, or NSS module is missing.\n' >&2
    exit 1
}
[[ $(sha256sum "$BINARY" | awk '{print $1}') == "$BINARY_SHA256" ]] || {
    printf 'Certified daemon hash does not match.\n' >&2
    exit 1
}
[[ $(sha256sum "$CLIENT" | awk '{print $1}') == "$CLIENT_SHA256" ]] || {
    printf 'Certified client hash does not match.\n' >&2
    exit 1
}
[[ $(sha256sum "$NSS_MODULE" | awk '{print $1}') == "$NSS_SHA256" ]] || {
    printf 'Certified NSS module hash does not match.\n' >&2
    exit 1
}

PARENT_TRANSACTION=$(active_transaction)
if [[ -n $PARENT_TRANSACTION ]]; then
    validate_transaction_chain "$PARENT_TRANSACTION" >/dev/null
fi
TRANSACTION="$(date --utc +%Y%m%dT%H%M%S)-$$-${SOURCE_COMMIT:0:12}"
valid_transaction_id "$TRANSACTION" || {
    printf 'Generated transaction id is invalid: %q\n' "$TRANSACTION" >&2
    exit 2
}
DIRECTORY="$(transaction_directory "$TRANSACTION" false)"
INSTALL_ROOT="$INSTALL_BASE/$SOURCE_COMMIT"
INSTALLED_BINARY="$INSTALL_ROOT/systemd-resolved"
INSTALLED_CLIENT="$INSTALL_ROOT/resolvectl"
INSTALLED_NSS="$INSTALL_ROOT/libnss_resolve.so.2"
[[ ! -e $INSTALL_ROOT && ! -L $INSTALL_ROOT ]] || {
    printf 'Certified install root already exists: %s\n' "$INSTALL_ROOT" >&2
    exit 2
}
install -d -m 0700 "$DIRECTORY"
cp -a "$CERTIFICATE" "$DIRECTORY/certificate.json"
SYSTEM_COPY_CANDIDATE="$DIRECTORY/system-copy.candidate"
certified_git() {
    env -i "PATH=$PATH" git --no-replace-objects \
        -c "safe.directory=$REPOSITORY_ROOT" -C "$REPOSITORY_ROOT" "$@"
}
SYSTEM_COPY_BLOB="$(certified_git rev-parse \
    "$SOURCE_COMMIT:scripts/switch-resolved-transactionally-v2.sh")"
[[ $SYSTEM_COPY_BLOB =~ ^[0-9a-f]{40}$ ]] || {
    printf '%s\n' 'Certified switch-program blob identity is invalid.' >&2
    exit 2
}
certified_git show \
    "$SOURCE_COMMIT:scripts/switch-resolved-transactionally-v2.sh" \
    >"$SYSTEM_COPY_CANDIDATE"
[[ -s $SYSTEM_COPY_CANDIDATE && -f $SYSTEM_COPY_CANDIDATE \
    && ! -L $SYSTEM_COPY_CANDIDATE ]] || {
    printf '%s\n' 'Certified switch-program blob is missing or unsafe.' >&2
    exit 2
}
[[ $(certified_git hash-object "$SYSTEM_COPY_CANDIDATE") == "$SYSTEM_COPY_BLOB" ]] || {
    printf '%s\n' 'Certified switch-program blob hash differs.' >&2
    exit 2
}
chmod 0700 "$SYSTEM_COPY_CANDIDATE"

if [[ -e $DROPIN_PATH || -L $DROPIN_PATH ]]; then
    cp -a --no-dereference "$DROPIN_PATH" "$DIRECTORY/dropin.previous"
    : >"$DIRECTORY/dropin.existed"
fi
if [[ -e $GUARD_UNIT || -L $GUARD_UNIT ]]; then
    cp -a --no-dereference "$GUARD_UNIT" "$DIRECTORY/guard.previous"
    : >"$DIRECTORY/guard.existed"
fi
if [[ -e $SYSTEM_COPY || -L $SYSTEM_COPY ]]; then
    [[ ! -d $SYSTEM_COPY || -L $SYSTEM_COPY ]] || {
        printf 'Existing switch program path is a directory.\n' >&2
        exit 2
    }
    cp -a --no-dereference "$SYSTEM_COPY" "$DIRECTORY/system-copy.previous"
    : >"$DIRECTORY/system-copy.existed"
fi
if [[ -e $ACTIVE_LINK || -L $ACTIVE_LINK ]]; then
    [[ -L $ACTIVE_LINK ]] || {
        printf 'Active transaction marker is unsafe.\n' >&2
        exit 2
    }
    cp -a --no-dereference "$ACTIVE_LINK" "$DIRECTORY/active.previous"
    : >"$DIRECTORY/active.existed"
fi
systemctl is-enabled systemd-resolved.service 2>/dev/null \
    >"$DIRECTORY/resolved-enabled.before" || true
systemctl is-active systemd-resolved.service 2>/dev/null \
    >"$DIRECTORY/resolved-active.before" || true
systemctl is-enabled "$GUARD_NAME" 2>/dev/null \
    >"$DIRECTORY/guard-enabled.before" || true
systemctl is-active "$GUARD_NAME" 2>/dev/null \
    >"$DIRECTORY/guard-active.before" || true
systemctl cat systemd-resolved.service >"$DIRECTORY/unit-before.txt" 2>&1 || true
systemctl show systemd-resolved.service >"$DIRECTORY/unit-properties-before.txt" 2>&1 || true
cp -a --no-dereference /etc/resolv.conf "$DIRECTORY/resolv.conf.before" 2>/dev/null || true
cp -a --no-dereference /etc/nsswitch.conf "$DIRECTORY/nsswitch.conf.before" 2>/dev/null || true

/usr/bin/python3 -I - \
    "$DIRECTORY/transaction.json" "$TRANSACTION" "$PARENT_TRANSACTION" \
    "$SOURCE_COMMIT" "$SOURCE_TREE" "$UPSTREAM_COMMIT" "$CERTIFICATE" \
    "$INSTALLED_BINARY" "$BINARY_SHA256" "$INSTALLED_CLIENT" "$CLIENT_SHA256" \
    "$INSTALLED_NSS" "$NSS_SHA256" "$EXTERNAL_NAME" <<'PY'
from datetime import datetime, timezone
import json
from pathlib import Path
import sys

(
    path,
    transaction,
    parent,
    source_commit,
    source_tree,
    upstream,
    certificate,
    binary,
    daemon_hash,
    client,
    client_hash,
    nss,
    nss_hash,
    external,
) = sys.argv[1:]
Path(path).write_text(
    json.dumps(
        {
            "schema": 2,
            "transaction": transaction,
            "parent_transaction": parent or None,
            "created_at": datetime.now(timezone.utc).isoformat(),
            "source_commit": source_commit,
            "source_tree": source_tree,
            "upstream_commit": upstream,
            "certificate": certificate,
            "installed_binary": binary,
            "daemon_sha256": daemon_hash,
            "installed_client": client,
            "client_sha256": client_hash,
            "installed_nss": nss,
            "nss_sha256": nss_hash,
            "external_name": external or None,
        },
        indent=2,
        sort_keys=True,
    )
    + "\n",
    encoding="utf-8",
)
PY

preflight_restore_transaction "$TRANSACTION" >/dev/null

rollback_on_failure() {
    local status=$1
    trap - EXIT HUP INT TERM
    if ((status != 0)); then
        printf 'Replacement transaction failed; restoring the previous resolver.\n' >&2
        local rollback_status
        set +e
        restore_transaction "$TRANSACTION"
        rollback_status=$?
        set -e
        if ((rollback_status != 0)); then
            printf 'Automatic resolver rollback failed with status %s; transaction %s remains unconfirmed.\n' \
                "$rollback_status" "$TRANSACTION" >&2
            exit 125
        fi
    fi
    exit "$status"
}
trap 'rollback_on_failure $?' EXIT
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM

# Every persistent replacement mutation is below the armed rollback boundary.
mutation_checkpoint install-root
install -d -m 0755 "$INSTALL_ROOT"
install -m 0755 "$BINARY" "$INSTALLED_BINARY"
install -m 0755 "$CLIENT" "$INSTALLED_CLIENT"
install -m 0755 "$NSS_MODULE" "$INSTALLED_NSS"
mutation_checkpoint system-copy
rm -f "$SYSTEM_COPY"
install -m 0755 "$SYSTEM_COPY_CANDIDATE" "$SYSTEM_COPY"

[[ $(sha256sum "$INSTALLED_BINARY" | awk '{print $1}') == "$BINARY_SHA256" ]] || exit 1
[[ $(sha256sum "$INSTALLED_CLIENT" | awk '{print $1}') == "$CLIENT_SHA256" ]] || exit 1
[[ $(sha256sum "$INSTALLED_NSS" | awk '{print $1}') == "$NSS_SHA256" ]] || exit 1

mutation_checkpoint dropin
install -d -m 0755 "$DROPIN_DIR"
DROPIN_TEMP="$DIRECTORY/dropin.new"
cat >"$DROPIN_TEMP" <<EOF
[Service]
ExecStart=
ExecStart=$INSTALLED_BINARY
Environment=RUSTD_RESOLVED_REPLACEMENT_TRANSACTION=$TRANSACTION
EOF
rm -f "$DROPIN_PATH"
install -m 0644 "$DROPIN_TEMP" "$DROPIN_PATH"

mutation_checkpoint guard
cat >"$DIRECTORY/guard.new" <<EOF
[Unit]
Description=Rollback guard for a pending rustd-resolved replacement
After=systemd-resolved.service network-online.target
Requires=systemd-resolved.service
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=$SYSTEM_COPY --guard

[Install]
WantedBy=multi-user.target
EOF
rm -f "$GUARD_UNIT"
install -m 0644 "$DIRECTORY/guard.new" "$GUARD_UNIT"

mutation_checkpoint active
: >"$DIRECTORY/pending"
ln -sfn "$DIRECTORY" "$ACTIVE_LINK"

mutation_checkpoint service
systemctl daemon-reload
systemctl unmask systemd-resolved.service >/dev/null 2>&1 || true
systemctl enable "$GUARD_NAME" >/dev/null
systemctl restart systemd-resolved.service

healthy=false
for _ in {1..100}; do
    if health_check "$TRANSACTION"; then
        healthy=true
        break
    fi
    sleep 0.1
done
[[ $healthy == true ]]

trap - EXIT HUP INT TERM
printf '%s\n' "$(date --utc --iso-8601=seconds)" >"$DIRECTORY/switched-at"
printf 'Resolver transaction %s is active and pending post-reboot confirmation.\n' "$TRANSACTION"
printf 'After a successful reboot, confirm with:\n'
printf '  sudo %s --confirm %s\n' "$SYSTEM_COPY" "$TRANSACTION"
printf 'Rollback remains available with:\n'
printf '  sudo %s --rollback %s\n' "$SYSTEM_COPY" "$TRANSACTION"