<?php
$book='8085';require __DIR__.'/sgf-single-bootstrap.php';$pointer=json_decode(file_get_contents($s['root'].'/payable-due-backup-pointer.json'),true);$before=json_decode(file_get_contents($pointer['root'].'/preservation-private.json'),true);$checks=[];$ok=function($v,$name)use(&$checks){if(!$v)throw new LogicException($name);$checks[]=$name;};$identical=[];$allowed=[];
foreach(['host','native']as$name){$db=$name==='host'?$host:$native;foreach($before[$name]as$table=>$json){$order=in_array($table,['sr_outbox','sr_deliveries'],true)?'event_id':($table==='sc_catalogue_meta'?'policy':'id');$rows=$db->table($table)->orderBy($order)->get();$old=json_decode($json,true);if(($name==='host'&&$table==='permission_grants')||($name==='native'&&$table==='audit_logs')){$byId=collect($old)->keyBy('id');$original=$rows->filter(fn($v)=>$byId->has($v->id))->values();$ok($original->toJson()===$json,'old '.$name.'.'.$table.' identical');$new=$rows->reject(fn($v)=>$byId->has($v->id))->values();$ok($new->count()===2,'only two authorized appended '.$name.'.'.$table);if($table==='permission_grants')$ok($new->map(fn($v)=>['user_id'=>$v->user_id,'permission'=>$v->permission,'tenant_id'=>$v->tenant_id,'company_id'=>$v->company_id,'unit_id'=>$v->unit_id])->all()===[['user_id'=>13,'permission'=>'supplier_payables.due.prepare','tenant_id'=>1,'company_id'=>2,'unit_id'=>2],['user_id'=>14,'permission'=>'supplier_payables.due.review','tenant_id'=>1,'company_id'=>2,'unit_id'=>2]],'exact approved two grants only');else$ok($new->every(fn($v)=>$v->action==='sgf.finance.due.command'),'only approved due command audits appended');$allowed[]=$name.'.'.$table;}else{$ok($rows->toJson()===$json,'identical '.$name.'.'.$table);$identical[]=$name.'.'.$table;}}}
foreach(['binding'=>'binding.json','single_binding'=>'single-bindings.json','stock_binding'=>'stock-binding.json']as$key=>$file)$ok(hash_file('sha256',$s['root'].'/'.$file)===$before[$key],$file.' unchanged');
$versions=$native->table('pd_due_versions')->orderBy('version')->get();$ok($versions->count()===2&&$versions[0]->host_actor_id===13&&$versions[1]->host_actor_id===14&&$versions[1]->state==='approved','one preparation and distinct approval only');$ok($native->table('pd_due_commands')->count()===2,'exactly two command receipts');$ok($native->table('pa_obligations')->where('id',$versions[0]->obligation_id)->value('principal_minor')===10000,'principal100 preserved');$ok($native->table('gl_journals')->count()===27,'journals27 preserved');
$public=$native->select("SELECT c.relname FROM pg_class c CROSS JOIN LATERAL aclexplode(coalesce(c.relacl,CASE WHEN c.relkind='S' THEN acldefault('S',c.relowner) ELSE acldefault('r',c.relowner) END)) a WHERE c.relnamespace='public'::regnamespace AND c.relname LIKE 'pd_due_%' AND a.grantee=0");$ok($public===[],'no PUBLIC rights on new tables or sequences');$function=$native->select("SELECT a.* FROM pg_proc p CROSS JOIN LATERAL aclexplode(coalesce(p.proacl,acldefault('f',p.proowner))) a WHERE p.pronamespace='public'::regnamespace AND p.proname='pd_due_append_only' AND a.grantee=0");$ok($function===[],'no PUBLIC function execution');
file_put_contents($work.'/payable-due-preservation.json',json_encode(['passed'=>true,'checks'=>$checks,'identical_original_tables'=>$identical,'original_rows_preserved_with_authorized_append'=>$allowed,'new_grants'=>2,'new_command_receipts'=>2,'new_demo'=>false,'financial_effects'=>0,'cache_cleared'=>false,'protected_six_targeted'=>false],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'checks'=>count($checks),'identical_tables'=>count($identical),'preserved_plus_append'=>count($allowed),'proof'=>$work.'/payable-due-preservation.json']).PHP_EOL;