<?php
// Final per-criterion SQL receipts, guarded isolated QA, read-only transaction.
use App\Models\Opportunity;
use App\Services\OpportunityCanonicalContract;
use App\Services\PortalProfileAccess;
use Illuminate\Support\Facades\DB;
$root=dirname(__DIR__);$dir=$root.'/storage/app/private/investmoz-v2/portal-audit';$plan=json_decode(file_get_contents($dir.'/portal-stability-latest.json'),true,512,JSON_THROW_ON_ERROR);putenv('STABILITY_QA_MODE=consumers');$app=require $plan['source'].'/tools/portal-stability-runtime.php';
$proof=DB::transaction(function()use($dir){DB::statement('SET TRANSACTION READ ONLY');$rows=[];
foreach([30,31,32,33,34,35]as$id){$r=Opportunity::findOrFail($id);$snapshot=app(OpportunityCanonicalContract::class)->validateSubmission($r);$c=$r->workflow_context;$rows[]=['id'=>$id,'category'=>$r->opportunity_category,'state'=>app(PortalProfileAccess::class)->state($r),'version'=>$r->management_version,'valid_current_submission'=>true,'current_hash'=>$snapshot['hash'],'approval_hash'=>$c['approval']['hash']??null,'publication_hash'=>$c['publication']['hash']??null,'approval_actor'=>$c['approval']['actor_id']??null,'publication_actor'=>$c['publication']['actor_id']??null,'reopened'=>$c['materiality']['reopened']??[],'retained'=>$c['materiality']['retained']??[],'conditions'=>array_values($c['conditions']??[]),'publication_scope'=>$r->publicationPresentation(),'original_decision_history_preserved'=>count($c['decision_history']??[])];}
$doc=DB::table('opportunity_documents')->where('id','0d804850-a437-4ae6-8c9e-50acf7569bbc')->first();$file=DB::table('documents')->where('id',$doc->document_id)->first();throw_unless(!$doc->deleted_at&&$file->malware_scan_status==='clean'&&$file->sha256===$file->malware_scanned_sha256,RuntimeException::class,'Real restored original not verified.');
$events=DB::table('audit_events')->where('source_system','opportunity-resources')->where('after_data->resource_id',$doc->id)->orderBy('occurred_at')->get(['action','actor_user_id','occurred_at']);
$activeFiles=json_decode(file_get_contents($dir.'/functional-active-files-before-20261011.json'),true,512,JSON_THROW_ON_ERROR);foreach($activeFiles as$name=>$hash)throw_unless(hash_file('sha256',dirname(__DIR__).'/'.$name)===$hash,RuntimeException::class,'Active baseline changed.');
return ['result'=>'passed','at'=>gmdate('c'),'target'=>DB::selectOne('select current_database() as database, inet_server_port() as port'),'categories'=>$rows,'restored_document'=>['resource_id'=>$doc->id,'document_id'=>$file->id,'sha256'=>$file->sha256,'scan_status'=>$file->malware_scan_status,'encryption'=>$file->storage_encryption,'events'=>$events],'existing_incomplete_drafts'=>DB::table('opportunities')->where('owner_user_id',21)->whereRaw("COALESCE(workflow_context->>'working_state',status)='draft'")->get(['id','opportunity_category'])->all(),'ClamD_real'=>app(App\Services\Malware\MalwareScanner::class)->health(),'GD_WebP'=>function_exists('imagewebp'),'installed'=>DB::table('migrations')->whereIn('migration',['2026_10_09_030000_extend_opportunity_resources','2026_10_10_040000_create_portal_profile_authorization'])->pluck('migration')->all(),'workflow_without_190000_availability'=>!config('investor_path.enabled'),'active_critical_files_preserved'=>true,'active_writes'=>0];});
file_put_contents($dir.'/functional-final-persistence-qa-20261011.json',json_encode($proof,JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE|JSON_THROW_ON_ERROR));echo json_encode(['result'=>'passed','categories'=>count($proof['categories']),'ClamD_real'=>$proof['ClamD_real'],'GD_WebP'=>$proof['GD_WebP'],'existing_incomplete_drafts'=>$proof['existing_incomplete_drafts'],'active_critical_files_preserved'=>true,'active_writes'=>0],JSON_THROW_ON_ERROR).PHP_EOL;