---
# The workstation manifest's "source: deploy" symlink formula (bin.json,
# claude.json) is only proven correct on the laptop, where it was probed
# 2026-08-15. On the three buildboxes the SAME bin names (pi, cdx) are
# populated by a different mechanism — mise shims from devtools.json — not
# by symlinking into deploy_root; probing debian1 showed
# ~/.local/bin/pi -> ~/.local/share/mise/shims/pi, and ~/.claude/{bin,lib,
# hooks} are real populated directories, not symlinks. Enforcing the
# workstation formula there would be wrong, not drift. So: assert/converge
# only on the workstation group; report-only (no assertion of a "correct"
# value) on buildboxes until the box-side formula is transcribed from
# buildbox-parity.sh / devtools.json (tracked as an open S1 gap).

- name: assert deploy-sourced PATH bins/symlinks match declared source (workstation only)
  ansible.builtin.file:
    src: "{{ item.target }}"
    dest: "{{ item.link }}"
    state: link
    force: true
  loop: "{{ path_bins_deploy_symlinks }}"
  loop_control:
    label: "{{ item.link }}"
  when: "'workstations' in group_names"
  register: path_bins_result
  ignore_errors: true

- name: report path bins that could not be converged to symlinks (drift, not a play failure)
  ansible.builtin.debug:
    msg: >-
      DRIFT: {{ item.item.link }} is not a symlink to {{ item.item.target }}
      and could not be safely converted ({{ item.msg | default('see result') }}).
      Needs manual review, not an automatic apply.
  loop: "{{ path_bins_result.results | default([]) }}"
  loop_control:
    label: "{{ item.item.link }}"
  when: "'workstations' in group_names and item is failed"

- name: buildboxes — record current state of the same paths, no assertion (open S1 gap, see README)
  ansible.builtin.stat:
    path: "{{ item.link }}"
  loop: "{{ path_bins_deploy_symlinks }}"
  loop_control:
    label: "{{ item.link }}"
  when: "'buildboxes' in group_names"
  register: path_bins_buildbox_stat

- name: buildboxes — surface what is actually there (informational, no diff/change)
  ansible.builtin.debug:
    msg: >-
      {{ item.item.link }}: {{ 'symlink -> ' + item.stat.lnk_target if item.stat.islnk | default(false)
      else ('exists, not a symlink (' + (item.stat.isdir | default(false) | ternary('directory', 'file')) + ')' if item.stat.exists | default(false)
      else 'does not exist') }}
  loop: "{{ path_bins_buildbox_stat.results | default([]) }}"
  loop_control:
    label: "{{ item.item.link }}"
  when: "'buildboxes' in group_names"
