#!/usr/bin/env bash
# Syntax-check every shell script + install.sh --dry-run (no system mutations).
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

fail() {
  echo "health: $1" >&2
  exit 1
}

while IFS= read -r -d '' script; do
  if ! bash -n "$script"; then
    fail "bash -n failed: $script"
  fi
done < <(find "$ROOT" -name '*.sh' -type f -print0)

if ! "$ROOT/install.sh" --dry-run >/dev/null 2>&1; then
  fail "install.sh --dry-run failed"
fi

# oomctl is absent on build boxes; the memory posture only applies to the workstation.
if command -v oomctl >/dev/null 2>&1; then
  if ! "$ROOT/scripts/mem-guard-root.sh" --audit; then
    fail "memory posture drift (see DRIFT lines above; fix: deck-sudo bash $ROOT/scripts/mem-guard-root.sh)"
  fi
fi

exit 0