From 561133f39bf80269e3b64495d725e7324349967c Mon Sep 17 00:00:00 2001
From: root <root@srv1522135.hstgr.cloud>
Date: Mon, 31 Aug 2026 07:02:48 +0000
Subject: [PATCH] RAIN Hotfix: Remediation Archive Build-Input-Semantik
 (branch-spezifisch, recovery unveraendert)

---
 .../control-plane/cp2a2_2b/rq-historical              | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/red-queen-architecture/control-plane/cp2a2_2b/rq-historical b/red-queen-architecture/control-plane/cp2a2_2b/rq-historical
index 8577de5..6263937 100755
--- a/red-queen-architecture/control-plane/cp2a2_2b/rq-historical
+++ b/red-queen-architecture/control-plane/cp2a2_2b/rq-historical
@@ -2120,6 +2120,8 @@ archive_image() {  # $1 = role
       ;;
     remediation)
       remediation_session || die "archive(remediation): keine gueltige Build-Session (FAIL CLOSED)"
+      # (RAIN Hotfix) Source-State-Variablen deterministisch aus autorisiertem State initialisieren
+      load_remediation_source_state
       id="$(remediation_full_image_id)"
       PIN_REMEDIATION_TARGET_ID="$id"
       ;;
@@ -2170,7 +2172,14 @@ archive_image() {  # $1 = role
   # wuerde unter set -euo pipefail mit EXIT=1 abbrechen (bewiesener Root Cause).
   # Die korrekte Berechnung erfolgt NACH write_runtime_config/write_app_manifest.
   HOST_SOT_RUNNER_SHA_CUR="$(sha256sum /opt/historical-v2/app/run_backfill_year.py 2>/dev/null | awk '{print $1}')"
-  BUILD_INPUT_SHA_CUR="$(build_context_manifest 2>/dev/null | sha256sum | awk '{print $1}')"
+  # (RAIN Hotfix) Branch-spezifische Build-Input-Semantik: Recovery nutzt build_context_manifest
+  # (RECOVERY_BUILD_CONTEXT), Remediation nutzt remediation_expected_build_input_sha
+  # (REMEDIATION_BUILD_CONTEXT, Gold-Source + autorisierter Runner-Overlay). KEIN globaler Tausch.
+  case "$role" in
+    recovery)   BUILD_INPUT_SHA_CUR="$(build_context_manifest 2>/dev/null | sha256sum | awk '{print $1}')" ;;
+    remediation) BUILD_INPUT_SHA_CUR="$(remediation_expected_build_input_sha)" ;;
+    *) die "archive: unbekannte Rolle $role (FAIL CLOSED)" ;;
+  esac
   WRAPPER_SHA_CUR="$(sha256sum /usr/local/bin/rq-historical | awk '{print $1}')"
   # Reihenfolge (Punkt 5): erst Manifest + Runtime erzeugen, DANN deren SHAs
   # berechnen, DANN gen_archive_meta mit allen Pflicht-SHAs aufrufen.