# Deploy local repo run.ps1 -> C:\ProgramData\backup\run.ps1 with .bak rollback.
# MUST be run elevated (ProgramData ACL = SYSTEM + Administrators).
# Usage: open elevated PowerShell, cd to repo root, then:  & .\scripts\windows-host-fallback-backup-daily\deploy.ps1

$ErrorActionPreference = 'Stop'
$repoSrc = Join-Path $PSScriptRoot 'run.ps1'
$dst = 'C:\ProgramData\backup\run.ps1'
$bak = "$dst.bak-pre-unify"

if (-not (Test-Path $repoSrc)) { throw "source missing: $repoSrc" }
if (-not (Test-Path $dst))     { throw "destination missing: $dst (windows-host backup not initialized?)" }

# Backup current (if no pre-unify backup yet)
if (-not (Test-Path $bak)) {
    Copy-Item $dst $bak -Force
    Write-Host "  backup: $bak"
} else {
    Write-Host "  backup already present: $bak"
}

Copy-Item $repoSrc $dst -Force
$srcHash = (Get-FileHash $repoSrc -Algorithm SHA256).Hash
$dstHash = (Get-FileHash $dst    -Algorithm SHA256).Hash
if ($srcHash -ne $dstHash) { throw "hash mismatch after copy: src=$srcHash dst=$dstHash" }
Write-Host "  deployed:  $dst"
Write-Host "  sha256:    $($dstHash.Substring(0,12))"
Write-Host "  mtime:     $((Get-Item $dst).LastWriteTime)"