<?php
// Validate only the cloned, designated account envelopes. Never modify users or privileges.
ini_set('zend.exception_ignore_args', '1');
set_exception_handler(static function (Throwable $e): void {
    fwrite(STDERR, 'QA holder compatibility check stopped: '.get_class($e).PHP_EOL); exit(1);
});
$app=(static fn($p)=>require $p)(__DIR__.'/portal-service-followup-runtime.php');
$db=Illuminate\Support\Facades\DB::connection(); $db->getPdo()->exec('BEGIN READ ONLY');
foreach ([2=>'nala@tempo.co.mz',13=>'onala@me.com'] as $id=>$email) {
    $user=App\Models\User::findOrFail($id);
    throw_unless(strtolower($user->email)===$email,RuntimeException::class);
    app(App\Services\PortalSuperusers::class)->validateBootstrapHolder($user);
}
$db->getPdo()->exec('ROLLBACK');
$proof=['result'=>'passed','at'=>gmdate('c'),'target'=>config('database.connections.pgsql.database').':55441',
    'cloned_designated_ids'=>[2,13],'normal_envelope_readable_and_valid_for_consolidated_bootstrap'=>true,
    'secrets_in_output'=>false,'users_or_privileges_modified'=>false,'active_writes'=>0,
    'scope'=>'Existing destination accounts cloned into QA; not an active bootstrap or manual MFA confirmation'];
file_put_contents(dirname(__DIR__).'/storage/app/private/investmoz-v2/portal-audit/consolidated-holder-compatibility-qa.json',json_encode($proof,JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR));
echo json_encode($proof,JSON_THROW_ON_ERROR).PHP_EOL;