2 台へ振り分け、故障した 1 台を経路から外す

ssh deployer@<app02の接続名>
# STEP 01 の 1-1「各 VM 共通の取得経路ブロック」をここで実行する

# STEP 01 の 1-3 の全ブロックを app02 で実行する（TAPAPI_NODE だけ app02 にする）
curl --fail --show-error http://localhost:8080/health

/tmp/tapapi-1.1.tar.gz: OK
size=2728 bytes (期待値 2728 と一致)
TAPAPI_NODE=app02
PGHOST=<db01のアドレス>
PGPORT=5432
PGDATABASE=transit_lab
PGUSER=tap_app
root tapapi 640 /etc/tapapi/tapapi.env

{"status":"ok","db":"ok","node":"app02"}

# app01 と app02 の両方で実行する
{
  sha256sum /opt/tapapi/tapapi.py /opt/tapapi/schema.sql \
    /etc/systemd/system/tapapi.service
  sudo grep -vE '^(PGPASSWORD|TAPAPI_NODE)=' /etc/tapapi/tapapi.env | sort | sha256sum
  stat -c '%U %G %a %n' /opt/tapapi /opt/tapapi/tapapi.py \
    /etc/tapapi /etc/tapapi/tapapi.env /etc/systemd/system/tapapi.service
  sudo grep -E '^TAPAPI_NODE=' /etc/tapapi/tapapi.env
} | tee "/tmp/ch4-parity-$(hostname).txt"

08431c5c34240e2a5c1a3f07315c1f8cee9bae76bf1f4e360e2a7cf464174e52  /opt/tapapi/tapapi.py
731b8b72f71d9de4f41b003a2ecc43ff0db10c9d9e672604330e2a0fa52cefc1  /opt/tapapi/schema.sql
db0cbb60d177232ed97fb9aa4d69feb30ed8162884aa30fd53a993bd32193b86  /etc/systemd/system/tapapi.service
946b5db6bf2a6fdc2e5480320b6df6cb6827a16836f75cc32a39e358aa2426f8  -
root root 755 /opt/tapapi
root root 755 /opt/tapapi/tapapi.py
root root 755 /etc/tapapi
root tapapi 640 /etc/tapapi/tapapi.env
root root 644 /etc/systemd/system/tapapi.service
TAPAPI_NODE=app01

08431c5c34240e2a5c1a3f07315c1f8cee9bae76bf1f4e360e2a7cf464174e52  /opt/tapapi/tapapi.py
731b8b72f71d9de4f41b003a2ecc43ff0db10c9d9e672604330e2a0fa52cefc1  /opt/tapapi/schema.sql
db0cbb60d177232ed97fb9aa4d69feb30ed8162884aa30fd53a993bd32193b86  /etc/systemd/system/tapapi.service
946b5db6bf2a6fdc2e5480320b6df6cb6827a16836f75cc32a39e358aa2426f8  -
root root 755 /opt/tapapi
root root 755 /opt/tapapi/tapapi.py
root root 755 /etc/tapapi
root tapapi 640 /etc/tapapi/tapapi.env
root root 644 /etc/systemd/system/tapapi.service
TAPAPI_NODE=app02

curl --fail --show-error --include "http://localhost:8080/health"

HTTP/1.0 200 OK
Server: tapapi 
Content-Type: application/json; charset=utf-8
Content-Length: 40

{"status":"ok","db":"ok","node":"app01"}

HTTP/1.0 200 OK
Server: tapapi 
Content-Type: application/json; charset=utf-8
Content-Length: 40

{"status":"ok","db":"ok","node":"app02"}

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT usename, datname, application_name, client_addr, state
     FROM pg_stat_activity
    WHERE usename = 'tap_app';"

# app01 と app02 の両方で: 要求を流し続ける
timeout 20 bash -c 'while :; do curl -sS -m5 "http://localhost:8080/health" > /dev/null; done'

# db01 で: 上と並行して、観測を繰り返す
for i in $(seq 1 300); do
  sudo -u postgres psql -d transit_lab -Atc \
    "SELECT usename, application_name, client_addr, state
       FROM pg_stat_activity
      WHERE usename = 'tap_app';"
done | grep -m 10 tap_app

tap_app||<app01のアドレス>|idle in transaction
tap_app||<app02のアドレス>|idle
tap_app||<app02のアドレス>|idle
tap_app||<app02のアドレス>|idle
tap_app||<app02のアドレス>|idle
tap_app||<app01のアドレス>|idle
tap_app||<app01のアドレス>|idle
tap_app||<app02のアドレス>|idle
tap_app||<app02のアドレス>|idle
tap_app||<app02のアドレス>|idle in transaction

log_format tap_with_upstream
    '$remote_addr $request status=$status event_id=$http_x_event_id '
    'upstream=$upstream_addr upstream_status=$upstream_status';

upstream tap_app_backend {
    server <app01の接続名>:8080;
    server <app02の接続名>:8080;
}

server {
    listen <入口の待受port>;
    access_log /var/log/nginx/tap_access.log tap_with_upstream;

    location / {
        proxy_set_header X-Event-ID $http_x_event_id;
        proxy_set_header Host $host;
        proxy_pass http://tap_app_backend;
    }
}

sudoedit "<nginxの章専用設定ファイル>"
sudo ln -s "<nginxの章専用設定ファイル>" "<nginxの有効化先>"
sudo nginx -t
sudo systemctl reload nginx
systemctl status nginx --no-pager

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-08-25 00:55:49 UTC; 1min 36s ago
lrwxrwxrwx 1 root root 34 Aug 25 00:55 default -> /etc/nginx/sites-available/default
lrwxrwxrwx 1 root root 36 Aug 25 00:57 part4-ch4 -> /etc/nginx/sites-available/part4-ch4

for N in 1 2 3 4 5 6; do
  EVENT_ID="event-balance-${N}"
  curl --fail --show-error --include \
    -H "X-Event-ID: ${EVENT_ID}" \
    -H 'Content-Type: application/json' \
    --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\",\"amount\":10}" \
    "http://<front01の接続名>:<入口の待受port>/tap"
done

{"ok":true,"card_id":"card-demo","balance":990,"event_id":"event-balance-1","node":"app01"}
{"ok":true,"card_id":"card-demo","balance":980,"event_id":"event-balance-2","node":"app02"}
{"ok":true,"card_id":"card-demo","balance":970,"event_id":"event-balance-3","node":"app01"}
{"ok":true,"card_id":"card-demo","balance":960,"event_id":"event-balance-4","node":"app02"}
{"ok":true,"card_id":"card-demo","balance":950,"event_id":"event-balance-5","node":"app01"}
{"ok":true,"card_id":"card-demo","balance":940,"event_id":"event-balance-6","node":"app02"}

# front01
sudo grep -F 'event_id=event-balance-' /var/log/nginx/tap_access.log

# app01 と app02 のそれぞれ
sudo journalctl -u tapapi.service --no-pager \
  | grep -F 'event-balance-'

<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-balance-1 upstream=<app01のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-balance-2 upstream=<app02のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-balance-3 upstream=<app01のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-balance-4 upstream=<app02のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-balance-5 upstream=<app01のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-balance-6 upstream=<app02のアドレス>:8080 upstream_status=200

{"event_id":"event-balance-1","card_id":"card-demo","amount":10,"node":"app01","status":200,"result":"ok"}
{"event_id":"event-balance-3","card_id":"card-demo","amount":10,"node":"app01","status":200,"result":"ok"}
{"event_id":"event-balance-5","card_id":"card-demo","amount":10,"node":"app01","status":200,"result":"ok"}

{"event_id":"event-balance-2","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}
{"event_id":"event-balance-4","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}
{"event_id":"event-balance-6","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT event_id, card_id, amount, created_at
     FROM tap_events
    WHERE event_id LIKE 'event-balance-%'
    ORDER BY created_at;"
sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT card_id, balance FROM cards WHERE card_id = 'card-demo';"

    event_id     |  card_id  | amount |          created_at           
-----------------+-----------+--------+-------------------------------
 event-balance-1 | card-demo |     10 | 2026-08-25 00:57:36.571777+00
 event-balance-2 | card-demo |     10 | 2026-08-25 00:57:36.599873+00
 event-balance-3 | card-demo |     10 | 2026-08-25 00:57:36.624258+00
 event-balance-4 | card-demo |     10 | 2026-08-25 00:57:36.648303+00
 event-balance-5 | card-demo |     10 | 2026-08-25 00:57:36.676865+00
 event-balance-6 | card-demo |     10 | 2026-08-25 00:57:36.705683+00
(6 rows)

  card_id  | balance 
-----------+---------
 card-demo |     940
(1 row)

upstream tap_app_backend {
    server <app01の接続名>:8080 max_fails=1 fail_timeout=30s;
    server <app02の接続名>:8080 max_fails=1 fail_timeout=30s;
}

location / {
    proxy_set_header X-Event-ID $http_x_event_id;
    proxy_set_header Host $host;
    proxy_next_upstream off;
    proxy_pass http://tap_app_backend;
}

sudoedit "<nginxの章専用設定ファイル>"
sudo nginx -t
sudo systemctl reload nginx
systemctl status nginx --no-pager

6:    server <app01のアドレス>:8080 max_fails=1 fail_timeout=30s;
7:    server <app02のアドレス>:8080 max_fails=1 fail_timeout=30s;
17:        proxy_next_upstream off;
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
● nginx.service - A high performance web server and a reverse proxy server
     Active: active (running) since Tue 2026-08-25 00:55:49 UTC; 2min 23s ago

curl --fail --show-error --include "http://localhost:8080/health"

HTTP/1.0 200 OK
{"status":"ok","db":"ok","node":"app01"}

HTTP/1.0 200 OK
{"status":"ok","db":"ok","node":"app02"}

sudo systemctl start tapapi.service
systemctl status tapapi.service --no-pager
# 待受が開くまで待つ（開かなければ 30 秒で諦める）
timeout 30 bash -c 'until curl -sf http://localhost:8080/health > /dev/null; do sleep 1; done'
curl --fail --show-error --include "http://localhost:8080/health"

● tapapi.service - Part 4 transit-card tap API
     Loaded: loaded (/etc/systemd/system/tapapi.service; disabled; preset: enabled)
     Active: active (running) since Tue 2026-08-25 09:59:25 JST; 2s ago
   Main PID: 4555 (python3)
HTTP/1.0 200 OK
{"status":"ok","db":"ok","node":"app01"}

# 除外時間（fail_timeout=30s）の経過を待つ
sleep 35

for N in 1 2 3 4 5 6; do
  EVENT_ID="event-recovered-${N}"
  curl --fail --show-error --include \
    -H "X-Event-ID: ${EVENT_ID}" \
    -H 'Content-Type: application/json' \
    --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\",\"amount\":10}" \
    "http://<front01の接続名>:<入口の待受port>/tap"
done

{"ok":true,"card_id":"card-demo","balance":880,"event_id":"event-recovered-1","node":"app02"}
{"ok":true,"card_id":"card-demo","balance":870,"event_id":"event-recovered-2","node":"app02"}
{"ok":true,"card_id":"card-demo","balance":860,"event_id":"event-recovered-3","node":"app01"}
{"ok":true,"card_id":"card-demo","balance":850,"event_id":"event-recovered-4","node":"app02"}
{"ok":true,"card_id":"card-demo","balance":840,"event_id":"event-recovered-5","node":"app01"}
{"ok":true,"card_id":"card-demo","balance":830,"event_id":"event-recovered-6","node":"app02"}

# front01
sudo grep -F 'event_id=event-recovered-' /var/log/nginx/tap_access.log

# app01 と app02 のそれぞれ
sudo journalctl -u tapapi.service --no-pager \
  | grep -F 'event-recovered-'

# db01
sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT event_id, card_id, amount, created_at
     FROM tap_events
    WHERE event_id LIKE 'event-recovered-%'
    ORDER BY created_at;"
sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT card_id, balance FROM cards WHERE card_id = 'card-demo';"

<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-recovered-1 upstream=<app02のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-recovered-2 upstream=<app02のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-recovered-3 upstream=<app01のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-recovered-4 upstream=<app02のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-recovered-5 upstream=<app01のアドレス>:8080 upstream_status=200
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-recovered-6 upstream=<app02のアドレス>:8080 upstream_status=200

{"event_id":"event-recovered-3","card_id":"card-demo","amount":10,"node":"app01","status":200,"result":"ok"}
{"event_id":"event-recovered-5","card_id":"card-demo","amount":10,"node":"app01","status":200,"result":"ok"}

{"event_id":"event-recovered-1","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}
{"event_id":"event-recovered-2","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}
{"event_id":"event-recovered-4","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}
{"event_id":"event-recovered-6","card_id":"card-demo","amount":10,"node":"app02","status":200,"result":"ok"}

     event_id      |  card_id  | amount |          created_at           
-------------------+-----------+--------+-------------------------------
 event-recovered-1 | card-demo |     10 | 2026-08-25 01:00:13.450054+00
 event-recovered-2 | card-demo |     10 | 2026-08-25 01:00:13.476982+00
 event-recovered-3 | card-demo |     10 | 2026-08-25 01:00:13.502812+00
 event-recovered-4 | card-demo |     10 | 2026-08-25 01:00:13.529724+00
 event-recovered-5 | card-demo |     10 | 2026-08-25 01:00:13.555179+00
 event-recovered-6 | card-demo |     10 | 2026-08-25 01:00:13.581179+00
(6 rows)

  card_id  | balance 
-----------+---------
 card-demo |     830
(1 row)

hostname
test -s /tmp/part4-packages-before.tsv
sudo ufw status verbose

# db01 だけで実行する
PG_CONF="$(sudo -u postgres psql -Atc 'SHOW config_file;')"
PG_HBA="$(sudo -u postgres psql -Atc 'SHOW hba_file;')"
PG_CONF_DIR="$(dirname "$PG_CONF")"
printf 'config=%s\nhba=%s\n' "$PG_CONF" "$PG_HBA"

hostname
sudo systemctl disable --now tapapi.service
systemctl is-active tapapi.service || true
systemctl is-enabled tapapi.service || true

hostname
sudo rm -f "<nginxの有効化先>"
sudo rm -f "<nginxの章専用設定ファイル>"
sudo nginx -t
sudo systemctl reload nginx
sudo rm -f /var/log/nginx/tap_access.log /var/log/nginx/tap_access.log.*
test ! -e "<nginxの有効化先>"
test ! -e "<nginxの章専用設定ファイル>"

(
sudo -u postgres dropdb --if-exists transit_lab
sudo -u postgres dropuser --if-exists tap_app

sudo rm -f "$PG_CONF_DIR/conf.d/part4.conf"
sudo sed -i \
  -e '\|^host transit_lab tap_app 172\.16\.10\.20/32 scram-sha-256$|d' \
  -e '\|^host transit_lab tap_app 172\.16\.10\.21/32 scram-sha-256$|d' \
  "$PG_HBA"
sudo systemctl restart postgresql

test ! -e "$PG_CONF_DIR/conf.d/part4.conf"
test "$(sudo grep -cE '^host transit_lab tap_app (172\.16\.10\.20|172\.16\.10\.21)/32 scram-sha-256$' "$PG_HBA" || true)" -eq 0
test "$(sudo -u postgres psql -Atc "SELECT count(*) FROM pg_database WHERE datname='transit_lab';")" -eq 0
test "$(sudo -u postgres psql -Atc "SELECT count(*) FROM pg_roles WHERE rolname='tap_app';")" -eq 0

# 基準状態の db01 に PostgreSQL は無い。ここに出る cluster は本章が作ったもの。
# 見覚えのない cluster が出たら、消さずに止めて演習環境の担当へ知らせる。
pg_lsclusters --no-header
pg_lsclusters --no-header | awk '{print $1, $2}' | while read -r version cluster; do
  sudo pg_dropcluster --stop "$version" "$cluster"
done

mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "${pkg%:amd64}" in
    postgresql|postgresql-16|postgresql-client|postgresql-client-16|postgresql-client-common|postgresql-common|libcommon-sense-perl|libjson-perl|libjson-xs-perl|libllvm17t64|libpq5|libtypes-serialiser-perl|ssl-cert) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }

APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"

sudo userdel postgres 2>/dev/null || true
sudo groupdel postgres 2>/dev/null || true
sudo groupdel ssl-cert 2>/dev/null || true
sudo chown root:root /etc/ssl/private
sudo chmod 0700 /etc/ssl/private
getent passwd postgres || true
getent group postgres || true
getent group ssl-cert || true
stat -c '%a %u %g %n' /etc/ssl/private
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

# app01 と app02 の両方で、hostname を確認して実行する
(
hostname
sudo rm -f /etc/systemd/system/tapapi.service
sudo systemctl daemon-reload
sudo rm -rf /opt/tapapi /etc/tapapi
sudo userdel tapapi 2>/dev/null || true
getent group tapapi >/dev/null && sudo groupdel tapapi || true

mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "${pkg%:amd64}" in
    python3-psycopg2|libpq5) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }

APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

# front01 で実行する
(
hostname

mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "${pkg%:amd64}" in
    nginx|nginx-common) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }

APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

sudo rm -rf /etc/apt/sources.list.d.part4
sudo rm -f /etc/apt/keyrings/infra-study-archive-keyring.asc
test ! -e /etc/apt/sources.list.d.part4
test ! -e /etc/apt/keyrings/infra-study-archive-keyring.asc

rm -f /tmp/infra-study-archive-keyring.asc /tmp/apt-update-part4.log /tmp/tapapi-1.1.tar.gz
[ -z "${TAPAPI_TMP:-}" ] || rm -rf -- "$TAPAPI_TMP"

# app01 と app02
rm -f /tmp/ch4-parity-*.txt
# app01
rm -f /tmp/ch4-app01-stop-since
# workstation01
rm -f /tmp/ch4-try-*.txt /tmp/ch4-failed-event-id

dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort > /tmp/part4-packages-after.tsv
diff -u /tmp/part4-packages-before.tsv /tmp/part4-packages-after.tsv

systemctl status tapapi.service --no-pager || true
systemctl status nginx --no-pager || true
systemctl status postgresql --no-pager || true
sudo ss -lntp | grep -E ':(5432|8080)([[:space:]]|$)' || true

test ! -e /opt/tapapi
test ! -e /etc/tapapi
test ! -e /etc/systemd/system/tapapi.service
test ! -e "<nginxの章専用設定ファイル>"
test ! -e "<nginxの有効化先>"
test ! -e /etc/apt/sources.list.d.part4
test ! -e /etc/apt/keyrings/infra-study-archive-keyring.asc
getent passwd tapapi || true
getent group tapapi || true
getent passwd postgres || true
getent group postgres || true
getent group ssl-cert || true
sudo ufw status numbered

sudo find /etc /var/lib /srv /opt /usr/local "$HOME" \
  -not -path '/var/lib/apt/*' \
  -not -path '/var/lib/dpkg/*' \
  -not -path '/var/lib/systemd/*' \
  -not -path '/var/log/*' \
  -not -path '/var/cache/*' \
  -not -name '.bash_history' \
  -not -path '/etc/passwd-' -not -path '/etc/group-' \
  -not -path '/etc/shadow-' -not -path '/etc/gshadow-' \
  -not -path '/var/lib/fwupd' -not -path '/var/lib/fwupd/*' \
  -not -path '/etc/fwupd' -not -path '/etc/fwupd/*' \
  -not -path '/var/lib/ucf' -not -path '/var/lib/ucf/*' \
  -not -path '/var/lib/landscape' -not -path '/var/lib/landscape/*' \
  -not -path '/etc/ld.so.cache' \
  -not -path '/var/lib/ubuntu-release-upgrader/release-upgrade-available' \
  -not -path '/var/lib/snapd/state.json' \
  -not -path '/var/lib/snapd/maintenance.json' \
  -not -path '/var/lib/logrotate/status' \
  -printf '%p\t%y\t%m\t%U\t%G\t%s\t%T@\n' 2>/dev/null \
  | LC_ALL=C sort \
  | sudo tee /tmp/part4-manifest-after.tsv >/dev/null
sudo diff -u /tmp/part4-manifest-before.tsv /tmp/part4-manifest-after.tsv > /var/tmp/part4-chapter-manifest.diff
diff_rc=$?
if [ "$diff_rc" -le 1 ]; then
  if ! awk 'BEGIN { FS = "\t"; c = "LC_ALL=C sort" }
      /^\+\+\+|^---|^@@/ { next }
      /^[+-]/ {
        if (NF != 7) { printf "manifest の列数が 7 ではありません: %s\n", $0 > "/dev/stderr"; bad = 1; exit 2 }
        t++; s = substr($1, 1, 1); p = substr($1, 2)
        k = $2 " " $3 " " $4 " " $5 " " ($2 == "d" ? "-" : $6)
        if (s == "-") { if (p in b) { dup = p; exit 2 } b[p] = k; bm[p] = $7; bt[p] = $2 }
        else          { if (p in a) { dup = p; exit 2 } a[p] = k; am[p] = $7 }
      }
      END {
        if (bad) exit 2
        if (dup != "") { printf "同じパスが重複しています: %s\n", dup > "/dev/stderr"; exit 2 }
        print "== 残留候補（0 件で合格）=="
        n = 0
        for (p in b) {
          if (!(p in a)) { print "消えた   " p | c; n++ }
          else if (a[p] != b[p]) { print "変わった " p "  (" b[p] " -> " a[p] ")" | c; n++ }
        }
        for (p in a) if (!(p in b)) { print "増えた   " p | c; n++ }
        fflush(); close(c)
        print "残留候補: " n " 件"
        print "== 更新日時だけ変わった通常ファイル（1 件ずつ理由を説明できること）=="
        m = 0; d = 0
        for (p in b) if ((p in a) && a[p] == b[p] && am[p] != bm[p]) { if (bt[p] == "d") d++; else { print p | c; m++ } }
        fflush(); close(c)
        print "更新日時だけ変わった通常ファイル: " m " 件 ／ ディレクトリ: " d " 件"
        print "差分行総数: " (t + 0)
      }' /var/tmp/part4-chapter-manifest.diff; then
    echo "差分の表示に失敗しました。構築前・章末の manifest と /var/tmp/part4-chapter-manifest.diff は残してあります。表示された理由を確認してください" >&2
  fi
else
  echo "差分を採れませんでした（diff の終了コード $diff_rc）。構築前 manifest /tmp/part4-manifest-before.tsv があるか確認してください" >&2
fi

（形の例です。M・K・T には実行したときの件数が入ります。更新日時だけ変わった通常ファイルの行と件数は、台・章によって変わります。合格の条件は「残留候補: 0 件」です）
== 残留候補（0 件で合格）==
残留候補: 0 件
== 更新日時だけ変わった通常ファイル（1 件ずつ理由を説明できること）==
（該当するパスが 1 行ずつ並びます）
更新日時だけ変わった通常ファイル: M 件 ／ ディレクトリ: K 件
差分行総数: T

rm -f /tmp/part4-packages-before.tsv /tmp/part4-packages-after.tsv
sudo rm -f /tmp/part4-manifest-before.tsv /tmp/part4-manifest-after.tsv /var/tmp/part4-chapter-manifest.diff
test ! -e /var/tmp/part4-chapter-manifest.diff