<?php
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Str;
use App\Shared\Context\CompanyContext;
$output=$s['root'].'/cost-security.json';if(file_exists($output))throw new LogicException('Completed security proof preserved');$before=$sourceFingerprint();$checks=0;$ok=function($v,$m)use(&$checks){$checks++;if(!$v)throw new LogicException($m);};
foreach(['unit','company','tenant'] as $kind){DB::beginTransaction();try{
    $u=$enter('read');$company=$kind==='unit'?DB::table('companies')->where('id',$scope['company_id'])->first():($kind==='company'?DB::table('companies')->where('tenant_id',$scope['tenant_id'])->where('id','<>',$scope['company_id'])->first():DB::table('companies')->where('tenant_id','<>',$scope['tenant_id'])->first());$unit=DB::table('units')->insertGetId(['tenant_id'=>$company->tenant_id,'company_id'=>$company->id,'name'=>'Rollback-only eligible foreign '.$kind,'created_at'=>now(),'updated_at'=>now()]);if($kind!=='unit')DB::table('company_memberships')->insert(['tenant_id'=>$company->tenant_id,'company_id'=>$company->id,'user_id'=>$u->id]);foreach(['company.view'=>null,'unit.view'=>$unit,'workshop.view'=>$unit,'direct_costs.view'=>$unit,'general_ledger.view'=>$unit] as $right=>$v)Tests\Support\IdentityFixture::grant($u->id,$company->tenant_id,$company->id,$right,$v);app(CompanyContext::class)->selectFor($u->id,$company->tenant_id,$company->id,$unit);$caught=false;try{$ledger->costs($u,$g['order_id']);}catch(DomainException|Symfony\Component\HttpKernel\Exception\HttpException){$caught=true;}$ok($caught,'Eligible foreign '.$kind.' must not read original cost/order');
}finally{while(DB::transactionLevel())DB::rollBack();$enter('read');}}
foreach(['workshop.view','direct_costs.view','general_ledger.view'] as $right){DB::beginTransaction();try{$u=$enter('read');DB::table('permission_grants')->where($scope)->where('user_id',$u->id)->where('permission',$right)->delete();$caught=false;try{$ledger->costs($u,$g['order_id']);}catch(Symfony\Component\HttpKernel\Exception\HttpException|Illuminate\Auth\Access\AuthorizationException){$caught=true;}$ok($caught,'Revoked '.$right.' refused before returning evidence');}finally{DB::rollBack();$enter('read');}}
DB::beginTransaction();try{
    $old=DB::table('wo_entries')->where('id',$g['time_id'])->first();$d=json_decode($old->data,true,32,JSON_THROW_ON_ERROR);unset($d['policy']);$d=array_replace($d,['version'=>2,'previous_id'=>$old->id,'correction_reason'=>'Rollback-only unverified successor must suspend cost eligibility.','revision'=>(int)DB::selectOne('SELECT sgf_wo_revision(?) v',[$g['order_id']])->v]);$u=$enter('technician');$new=app(App\Modules\Workshop\WorkshopWorkflow::class)->record($g['order_id'],$u->id,$d,(string)Str::uuid());$ok(!DB::table('wo_decisions')->where('entry_id',$new['id'])->exists(),'Actual successor workshop entry remains unverified');$u=$enter('read');$w=$ledger->costs($u,$g['order_id']);$ok($w['cost']['source']===null&&$w['cost']['pending']!==null&&!$w['cost']['facts']['conference']['current'],'Unverified successor leaves source visibly pending, never inherits old verification');$caught=false;try{app(App\Modules\Accounting\CostLedgerSource::class)->source($u,$g['order_id']);}catch(DomainException){$caught=true;}$ok($caught,'Posting source cannot use unverified/outdated origins even for the same amount');
}finally{while(DB::transactionLevel())DB::rollBack();$enter('read');}
$ok($sourceFingerprint()===$before,'Rights, technical entries, costs and outbox restored exactly');file_put_contents($output,json_encode(['passed'=>true,'checks'=>$checks,'eligible_foreign_unit_company_tenant_refused'=>true,'three_live_view_rights_rechecked'=>true,'actual_unverified_successor_refused'=>true,'no_inherited_verification'=>true,'rollback_only'=>true,'source_outbox_rights_unchanged'=>true],JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR));echo "Cost security: $checks checks, foreign eligible contexts and revoked rights refused; actual unverified successor leaves pending source; rollback preserves originals.\n";