// Private invocation/fixture barrier. Labels alone never authorize the controller's release.
import { setPriority, getPriority } from 'node:os';
import { readFileSync, writeFileSync, existsSync, renameSync } from 'node:fs';
import { dirname, join, resolve } from 'node:path';
import { createHash } from 'node:crypto';
const stat = readFileSync('/proc/self/stat', 'utf8');
const start = stat.slice(stat.lastIndexOf(')') + 2).split(/\s+/)[19];
const boot = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
const host = process.env.ROW227_CONTROL_ROOT;
const runDir = process.env.MOSAIC_TURN_MARKER ? dirname(process.env.MOSAIC_TURN_MARKER)
  : process.argv[1]?.endsWith('/packages/harness/src/runner.mjs') ? resolve(process.argv[2]) : null;
const control = host ? JSON.parse(readFileSync(join(host, 'control.json'), 'utf8'))
  : runDir ? JSON.parse(readFileSync(join(runDir, '.row227-native-control.json'), 'utf8')) : null;
if (!control || control.version !== 1 || !/^[a-f0-9]{32}$/.test(control.nonce)) throw Error('native-control-missing');
const kind = host ? 'host' : process.env.MOSAIC_TURN_MARKER ? 'adapter' : 'runner';
const role = host ? process.execArgv.includes('--check') ? 'host-syntax' : 'host-main' : kind;
const directory = host ? join(host, 'host') : join(runDir, '.row227-native');
setPriority(0, 19);
const nice = getPriority(0);
if (nice !== 19) throw Error('native-priority-refused');
const row = { version: 1, nonce: control.nonce, kind, pid: process.pid, start, boot, nice,
  argv: process.argv, module: process.argv[1] ?? null, execArgv: process.execArgv, run: host ? null : resolve(runDir) };
const name = `${kind}-${process.pid}-${start}`;
const bytes = JSON.stringify(row) + '\n';
const digest = createHash('sha256').update(bytes).digest('hex');
const pending = join(directory, name + '.pending');
writeFileSync(pending, bytes, { flag: 'wx', mode: 0o600 });
renameSync(pending, join(directory, name + '.json'));
const stop = () => process.exit(143);
process.once('SIGTERM', stop); process.once('SIGINT', stop);
const end = Date.now() + 5000;
while (!existsSync(join(directory, name + '.release'))) {
  if (Date.now() >= end) throw Error('native-release-timeout');
  await new Promise(r => setTimeout(r, 10));
}
const release = JSON.parse(readFileSync(join(directory, name + '.release'), 'utf8'));
const binding = release.binding;
if (release.receiptSha256 !== digest || JSON.stringify(release.receipt) !== JSON.stringify(row)
  || binding?.receiptSha256 !== digest || binding.kind !== kind || binding.role !== role
  || binding.namespacePid !== process.pid || binding.hostStart !== start || binding.boot !== boot
  || binding.run !== row.run || binding.module !== row.module || JSON.stringify(binding.argv) !== JSON.stringify(row.argv)
  || JSON.stringify(binding.execArgv) !== JSON.stringify(row.execArgv) || getPriority(0) !== 19) throw Error('native-release-association-refused');
process.removeListener('SIGTERM', stop); process.removeListener('SIGINT', stop);