<?php

// Read-only audit of the exact browser clone, preserving the subsequent final restore clone.
$root = dirname(__DIR__);
$dir = $root.'/storage/app/private/investmoz-v2/portal-audit';
$browser = json_decode(file_get_contents($dir.'/country-production-browser-target.json'), true, 512, JSON_THROW_ON_ERROR);
$target = $browser['target'];
if ((int) $target['port'] !== 55441 || ! preg_match('/^country_candidate_\d{8}_\d{6}_test$/D', $target['database'])) {
    throw new RuntimeException('QA browser target refused');
}
$pdo = new PDO('pgsql:host=127.0.0.1;port=55441;dbname='.$target['database'], 'postgres', '', [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$pdo->exec('BEGIN READ ONLY');
$identity = $pdo->query("SELECT current_database() AS database,inet_server_port() AS port,current_setting('transaction_read_only') AS read_only")->fetch(PDO::FETCH_ASSOC);
if ($identity['database'] !== $target['database'] || (int) $identity['port'] !== 55441 || $identity['read_only'] !== 'on') {
    throw new RuntimeException('QA actual identity refused');
}
$receipts = $pdo->query("SELECT after_data FROM audit_events WHERE source_system='organization-country-installation' AND action='install'")->fetchAll(PDO::FETCH_COLUMN);
$results = array_map(fn ($json) => json_decode($json, true, 512, JSON_THROW_ON_ERROR)['result'], $receipts);
$cold = array_values(array_filter($results, fn ($r) => $r['changed'] && $r['new_columns'] === 2));
if (count($cold) !== 1 || count(array_filter($results, fn ($r) => $r['new_tables'] !== 0 || $r['flags_changed'])) !== 0) {
    throw new RuntimeException('Cold installation audit differs');
}
$oldProof = json_decode(file_get_contents($root.'/storage/app/private/investmoz-v2/organization-country-installation/'.$target['database'].'/backup-proof.json'), true, 512, JSON_THROW_ON_ERROR);
$link = json_decode(file_get_contents($dir.'/country-candidate-backup-latest.json'), true, 512, JSON_THROW_ON_ERROR);
$finalProof = json_decode(file_get_contents($link['path']), true, 512, JSON_THROW_ON_ERROR);
if ($oldProof['tables'] !== $finalProof['tables'] || $oldProof['code_hash'] !== $finalProof['code_hash'] || $oldProof['active_manifest_sha256'] !== $finalProof['active_manifest_sha256']) {
    throw new RuntimeException('Final source snapshot differs from browser source');
}
$org = json_decode(file_get_contents($browser['runtime'].'/organization-qa.json'), true, 512, JSON_THROW_ON_ERROR)['id'];
$statement = $pdo->prepare('SELECT incorporation_country_code AS country,version_no AS version FROM organizations WHERE id=?');
$statement->execute([$org]);
$country = $statement->fetch(PDO::FETCH_ASSOC);
if ($country['country'] !== 'PT' || (int) $country['version'] < 2) {
    throw new RuntimeException('Visible master save was not persisted');
}
$pdo->exec('ROLLBACK');
$result = ['result' => 'passed', 'at' => gmdate('c'), 'browser_target' => $identity, 'final_restore_target' => $finalProof['restored_target'], 'browser_and_final_source_snapshots_equal' => true,
    'code_hash' => $finalProof['code_hash'], 'cold_installation_audited_once' => $cold[0], 'audit_receipts' => count($receipts), 'master_country_recovered' => $country, 'active_writes' => 0];
file_put_contents($dir.'/country-production-persistence-20261011.json', json_encode($result, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
echo json_encode($result, JSON_THROW_ON_ERROR).PHP_EOL;