#!/usr/bin/env bash
set -euo pipefail
test "${PATIENT_RELEASE_APPROVED:-}" = patient-session-20260918
release=/home/ps/patient-session-20260918
cd "$release"
test -f candidate-passed
test -f backup-patient.json
python3 patient_server_guard.py baseline
cd /opt/im-admin/deploy/im-admin
docker compose config --quiet
rollback_on_error() { rc=$?; trap - ERR; bash "$release/rollback-patient.sh"; exit "$rc"; }
trap rollback_on_error ERR
python3 - <<'PY'
from pathlib import Path
import json,hashlib,os
r=Path('/home/ps/patient-session-20260918');target=Path('/opt/im-admin')
for row in json.loads((r/'patient-manifest.json').read_text()):
    if not row['path'].startswith('wechat_rpa/'):continue
    p=(target/row['path']).resolve();assert p.is_relative_to(target)
    data=(r/'payload'/row['path']).read_bytes();assert hashlib.sha256(data).hexdigest()==row['sha256']
    tmp=p.with_name(p.name+'.patient-session.tmp');assert not tmp.exists()
    with tmp.open('xb') as f:f.write(data)
    os.chmod(tmp,p.stat().st_mode & 0o777);os.replace(tmp,p)
PY
docker compose stop -t 190 knowledge-worker
docker compose stop -t 65 gateway
docker tag zyt/wecom-admin:patient-session-20260918 zyt/wecom-admin:current
docker compose up -d --no-build --wait --wait-timeout 180 api gateway knowledge-worker
bash "$release/04-patient-verify.sh"
trap - ERR
printf '%s\n' 'Patient session overlay deployed and verified.'