#!/usr/bin/env sh
# Remote-daemon wiring regression; no Docker daemon, app, or network load.
set -eu
wrapper="$(pwd)/scripts/bench/runtime.sh"
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
mkdir "$tmp/bin"
cat >"$tmp/bin/docker" <<'DOCKER'
#!/usr/bin/env sh
set -eu
printf '%s\n' "$*" >>"$FAKE_LOG"
case "$1" in
  version|info) printf 'fake remote daemon\n' ;;
  image) printf '{}\n' ;;
  volume) case "$2" in inspect) exit 1;; *) exit 0;; esac ;;
  run|create) printf 'fake-container-id\n' ;;
  exec)
    case "$*" in
      *--input-type=module*) cat >/dev/null; printf '{"fixture":true}\n' ;;
      *) exit 0 ;;
    esac ;;
  inspect) printf 'false\n' ;;
  stats) printf '{}\n' ;;
  start) printf '{"assertions":{"passed":true}}\n' ;;
  wait) printf '%s\n' "$FAKE_LOAD_EXIT" ;;
  cp) case "$2" in *:/tmp/*) printf 'fake-db' >"$3";; *) exit 0;; esac ;;
  logs|rm) exit 0 ;;
  *) echo 'Unexpected Docker operation' >&2; exit 99 ;;
esac
DOCKER
cat >"$tmp/bin/node" <<'NODE'
#!/usr/bin/env sh
echo 'Benchmark must never execute runner-host Node' >&2
exit 97
NODE
chmod +x "$tmp/bin/docker" "$tmp/bin/node"
for expected in 0 23; do
  log="$tmp/docker-$expected.log"
  if PATH="$tmp/bin:$PATH" FAKE_LOG="$log" FAKE_LOAD_EXIT="$expected" BENCH_P95_LIMIT_MS=321 BENCH_CONCURRENCY=7 BENCH_STEADY_CONCURRENCY=3 BENCH_STEADY_INTERVAL_MS=1350 sh "$wrapper" fixture:immutable "$tmp/out-$expected" >/dev/null; then actual=0; else actual=$?; fi
  if [ "$expected" = 0 ]; then [ "$actual" = 0 ]; else [ "$actual" != 0 ]; fi
  grep -E '^run -d --name evofw-bench-[^ ]+ --cpus 2 --memory 4g --network none ' "$log" >/dev/null
  grep -E '^create --name evofw-bench-[^ ]+-load --network container:evofw-bench-[^ ]+ --user 65534:65534 --cap-drop ALL --security-opt no-new-privileges:true ' "$log" >/dev/null
  grep -F -- ' --entrypoint node -e BENCH_URL=http://127.0.0.1:8080 -e BENCH_P95_LIMIT_MS=321 -e BENCH_CONCURRENCY=7 -e BENCH_STEADY_CONCURRENCY=3 -e BENCH_STEADY_INTERVAL_MS=1350 fixture:immutable /tmp/load.mjs' "$log" >/dev/null
  grep -E '^cp scripts/bench/load.mjs evofw-bench-[^ ]+-load:/tmp/load.mjs$' "$log" >/dev/null
  grep -E '^cp scripts/bench/fixture.mjs evofw-bench-[^ ]+-load:/tmp/fixture.mjs$' "$log" >/dev/null
  grep -E '^start --attach evofw-bench-[^ ]+-load$' "$log" >/dev/null
  grep -E '^wait evofw-bench-[^ ]+-load$' "$log" >/dev/null
  grep -E '^rm -fv evofw-bench-[^ ]+-load$' "$log" >/dev/null
  grep -E '^volume rm evofw-bench-[^ ]+-data$' "$log" >/dev/null
  if grep -E -- '(--publish|--privileged|--network host|--pid host|type=bind|docker.sock|^port )' "$log" >/dev/null; then echo 'Unsafe or daemon-local benchmark wiring' >&2; exit 1; fi
  [ -f "$tmp/out-$expected/backup.db" ]
done
echo 'Runtime benchmark wrapper regression passed (remote daemon, separate driver, failure, cleanup)'