<?php
use Illuminate\Support\Str;
use Tempo\Finance\GeneralLedger\CycleSchema;
$output=$s['root'].'/ledger-cycle-security.json';if(file_exists($output))throw new LogicException('Completed security proof preserved');$checks=0;
$ok=function($v,$why)use(&$checks){$checks++;if(!$v)throw new LogicException($why);};
$refuse=function(Closure $fn)use($ok){$caught=false;try{$fn();}catch(DomainException|Symfony\Component\HttpKernel\Exception\HttpException){$caught=true;}$ok($caught,'Independent current authority required');};
$before=$financialFingerprint();DB::beginTransaction();try{
    $p=$command('prepare','prepare',$g['body']);$command('validate','validate',['proposal_id'=>$p['proposal_id'],'revision'=>$p['revision'],'decision'=>'approved','reason'=>'Independent recognition for security probes.']);$j=$command('prepare','post',['proposal_id'=>$p['proposal_id'],'revision'=>$p['revision'],'reason'=>'Preserved original within rollback security scenario.']);
    $c=$command('prepare','correct-prepare',['journal_id'=>$j['journal_id'],'journal_on'=>'2026-10-29','period_key'=>'QA-2026-10','reason'=>'Explicit correction security snapshot.']);$review=['correction_id'=>$c['correction_id'],'revision'=>$c['revision'],'decision'=>'approved','reason'=>'Independent exact correction security decision.'];
    DB::beginTransaction();try{DB::table('permission_grants')->insert($scope+['user_id'=>$f['actors']['prepare'],'permission'=>'general_ledger.correct_validate','created_at'=>now(),'updated_at'=>now()]);$refuse(fn()=>$command('prepare','correct-validate',$review));}finally{DB::rollBack();}
    DB::beginTransaction();try{DB::table('pa_access')->where($scope)->where(['user_id'=>$f['actors']['validate'],'action'=>'view'])->update(['person'=>'sgf-history-person-'.$f['actors']['prepare']]);$refuse(fn()=>$command('validate','correct-validate',$review));}finally{DB::rollBack();}
    DB::beginTransaction();try{DB::table('permission_grants')->where($scope)->where(['user_id'=>$f['actors']['validate'],'permission'=>'general_ledger.correct_validate'])->delete();$refuse(fn()=>$command('validate','correct-validate',$review));}finally{DB::rollBack();}
    $group=DB::table('gl_corrections')->where('id',$c['correction_id'])->first();$first=DB::table('gl_proposals')->where('id',$group->reverse_proposal_id)->first();
    DB::beginTransaction();try{DB::table('permission_grants')->where($scope)->where(['user_id'=>$f['actors']['validate'],'permission'=>'general_ledger.correct_validate'])->delete();$refuse(fn()=>$command('validate','validate',['proposal_id'=>$first->id,'revision'=>$first->revision,'decision'=>'approved','reason'=>'Individual route cannot bypass corrective right.']));}finally{DB::rollBack();}
    $command('validate','correct-validate',$review);
    DB::beginTransaction();try{
        (new ReflectionMethod(Tempo\Finance\GeneralLedger\PayableJournal::class,'post'))->invoke($ledger->engine($enter('prepare')),['proposal_id'=>$first->id,'revision'=>$first->revision],'Orphan reversal must never commit.');
        $caught=false;try{DB::statement('SET CONSTRAINTS gl_cycle_pair IMMEDIATE');}catch(Illuminate\Database\QueryException $e){$caught=str_contains($e->getMessage(),'GL_CORRECTION_PAIR_REQUIRED');}$ok($caught,'Database refuses standalone corrective journal at transaction boundary');
    }finally{DB::rollBack();}
    $ok(DB::table('gl_journals')->count()===1,'Orphan journal rolled back');
    $body=['correction_id'=>$c['correction_id'],'revision'=>$c['revision'],'reason'=>'Apply atomic pair for rollback-only integrity checks.'];
    DB::beginTransaction();try{DB::table('permission_grants')->where($scope)->where(['user_id'=>$f['actors']['prepare'],'permission'=>'general_ledger.correct_post'])->delete();$refuse(fn()=>$command('prepare','correct-post',$body));}finally{DB::rollBack();}
    $key=(string)Str::uuid();try{$command('prepare','correct-post',$body,$key,function($at){if($at==='after_receipt')throw new RuntimeException('QA post-receipt fault');});throw new LogicException('Fault required');}catch(RuntimeException $e){$ok($e->getMessage()==='QA post-receipt fault','Recovery fault reached receipt boundary');}
    $ok(DB::table('gl_journals')->count()===1&&!DB::table('gl_correction_results')->exists(),'Receipt failure rolls back pair, result and audit');
    $result=$command('prepare','correct-post',$body,$key);$ok($result['state']==='corrected'&&DB::table('gl_journals')->count()===3,'Same-key recovery succeeds once after rollback');
    $p=$command('prepare','period-prepare',['period_key'=>'QA-2026-10','reason'=>'Prepare complete period for security probes.']);$r=['check_id'=>$p['check_id'],'revision'=>$p['revision'],'decision'=>'approved','reason'=>'Independent rollback-only period review.'];
    DB::beginTransaction();try{DB::table('permission_grants')->insert($scope+['user_id'=>$f['actors']['prepare'],'permission'=>'general_ledger.period_validate','created_at'=>now(),'updated_at'=>now()]);$refuse(fn()=>$command('prepare','period-validate',$r));}finally{DB::rollBack();}
    $command('validate','period-validate',$r);$close=['check_id'=>$p['check_id'],'revision'=>$p['revision'],'reason'=>'Close rollback-only artificial period.'];
    DB::beginTransaction();try{DB::table('permission_grants')->where($scope)->where(['user_id'=>$f['actors']['prepare'],'permission'=>'general_ledger.period_close'])->delete();$refuse(fn()=>$command('prepare','period-close',$close));}finally{DB::rollBack();}
    $command('prepare','period-close',$close);
    foreach(CycleSchema::TABLES as $table){DB::beginTransaction();try{$caught=false;try{DB::table($table)->where('id',DB::table($table)->value('id'))->update(['reason'=>'Forbidden mutation']);}catch(Illuminate\Database\QueryException $e){$caught=str_contains($e->getMessage(),'GL_APPEND_ONLY');}$ok($caught,'Append-only cycle table '.$table);}finally{DB::rollBack();}}
}finally{while(DB::transactionLevel()>0)DB::rollBack();}
$ok($financialFingerprint()===$before&&!DB::table('gl_journals')->exists(),'All security probes rolled back without resets');
file_put_contents($output,json_encode(['passed'=>true,'checks'=>$checks,'self_and_same_person_refused'=>true,'revoked_corrective_and_close_rights_refused'=>true,'individual_route_cannot_bypass_rights'=>true,'orphan_pair_refused_by_database'=>true,'post_receipt_failure_recovered'=>true,'five_new_tables_append_only'=>true,'rollback_only'=>true],JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR));echo "Cycle security: $checks checks; all probes reverted.\n";