/**
 * `upgrade-rollback` — the detached rollback unit (#486).
 *
 * Reads the state-dir upgrade journal, restores every surface the failed
 * install touched from the durable pre-install snapshot, reloads the services
 * the install reloaded, and writes the outcome back to the journal plus the
 * durable outbox. Runs as its own transient unit so the restarts it performs
 * pass it by — the same trust boundary as the install: the process that rolls
 * back is not the process that failed.
 */

import type { CommandContext } from "./context.ts";
import { rollbackFromJournal } from "../upgrade.ts";

export async function upgradeRollbackCommand(ctx: CommandContext): Promise<void> {
  // Nothing here varies by project (#514): the rollback restores every
  // surface the failed install touched, from the host-wide journal. The
  // flag only ever misled, so refuse it with a reason.
  if (ctx.projectFlag !== undefined) {
    process.stderr.write(
      `omp-conductor: upgrade-rollback does not take a project — it restores the whole host from the upgrade journal\n`,
    );
    process.exit(2);
  }
  const result = await rollbackFromJournal();
  process.stdout.write(
    `rolled back to omp-conductor@${result.restoredVersion} after the failed ` +
      `upgrade to ${result.failedVersion}\n` +
      `  surfaces   restored from the pre-install snapshot\n` +
      `  dispatch   paused — the next tick verifies the old version and resumes\n`,
  );
}