<?php
declare(strict_types=1);try {require __DIR__.'/bootstrap.php';$original=$own();$p=json_decode(file_get_contents($runtime.'/private-report.json'),true);$green=json_decode(file_get_contents($runtime.'/private-green-report.json'),true);$final=json_decode(file_get_contents($runtime.'/private-final-report.json'),true);$check($snapshot()===$p['before']&&$snapshot()===$green['before']&&$snapshot()===$final['before'],'All seven protected original tables unchanged');
$counts=['activities'=>count($original['action']),'addresses'=>count($original['address']),'files'=>count($original['file']),'settings'=>count($original['setting'])];$check($counts===($lane==='B'?['activities'=>2,'addresses'=>4,'files'=>8,'settings'=>2]:['activities'=>4,'addresses'=>8,'files'=>8,'settings'=>2]),'Exact capped retained write set');foreach($original['action'] as $r)$check((int)$r['is_delete']===1&&strpos($r['title'],$marker)!==false&&in_array((int)$r['store_id'],$tenants,true),'Only marker-owned activities softdeleted');foreach($original['setting'] as $r)$check($r['describe']==='本地二维码验收 '.$marker&&json_decode($r['values'],true)===['default'=>'local','engine'=>['local'=>null]],'Exact retained own local-only settings');
$files=[];$pngSha=hash('sha256',base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII='));foreach($original['file'] as $r){$path=$root.'/public/uploads/'.$r['file_path'];$check(strpos(realpath($path),realpath($root.'/public/uploads').'/')===0&&hash_file('sha256',$path)===$pngSha&&filesize($path)===(int)$r['file_size'],'Original file path/size/exact private PNG');$check($r['storage']==='local'&&(int)$r['channel']===30&&(int)$r['file_type']===10&&in_array((int)$r['store_id'],$tenants,true),'Private local file original metadata');$files[]=['file_id'=>(int)$r['file_id'],'relative'=>$r['file_path'],'sha256'=>hash_file('sha256',$path),'size'=>filesize($path),'private'=>true];}
$leaves=[];foreach(file($runtime.'/external-leaves.jsonl',FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES) as $l){$v=json_decode($l,true);if($v['scenario']==='PROBE')continue;$check($v['network_sent']===false,'No network sent');if($v['kind']==='wx_png'){$params=$v['params'];$check(hash('sha256',json_encode($params,JSON_UNESCAPED_UNICODE))===$v['params_sha256'],'Exact original outgoing params hash');$check($params['page']==='pages/home/home'&&$params['env_version']==='develop'&&$params['width']===430,'Original overridden Wx page/env/width');$scene=$params['scene'];}elseif($v['kind']==='qr_png'){$scene=$v['text'];$check(hash('sha256',$scene)===$v['text_sha256']&&$v['file_private'],'Original QR text hash/private target');}else{$leaves[]=['kind'=>'token','network_sent'=>false];continue;}$parts=explode(':',$scene);$check(count($parts)===2,'Actual action:address scene');$addr=array_values(array_filter($original['address'],static function($r)use($parts){return (int)$r['id']===(int)$parts[1]&&(int)$r['action_id']===(int)$parts[0];}));$check(count($addr)===1&&strpos($addr[0]['address'],$marker)!==false,'Leaf scene belongs exact owned original address');if($v['kind']==='qr_png')$check($v['file']===$parts[0].'_'.$parts[1].'.png','Exact original filename belongs action/address');$leaves[]=['scenario'=>$v['scenario'],'kind'=>$v['kind'],'scene_sha256'=>hash('sha256',$scene),'own_action_address'=>true,'network_sent'=>false];}
$audit=[];foreach(file($runtime.'/private-sql.jsonl',FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES)?:[] as $l){$v=json_decode($l,true);$sql=$v['sql'];if(!preg_match('/^\s*(INSERT|UPDATE|DELETE|MERGE|REPLACE|CREATE|DROP|ALTER)\b/i',$sql,$m))continue;$op=strtoupper($m[1]);$table=null;if(preg_match('/(?:INTO|UPDATE)\s+["`]?yoshop_(sign_action|sign_address|upload_file)["`]?\b/i',$sql,$t))$table=$t[1];$check($table!==null&&in_array($op,['INSERT','UPDATE'],true),'Only approved business DML');$rows=$original[$table==='sign_action'?'action':($table==='sign_address'?'address':'file')];$ids=array_map('intval',array_column($rows,$table==='upload_file'?'file_id':'id'));$scope=false;if($op==='INSERT'){$allow=$table==='sign_address'?array_column($original['action'],'id'):array_values($tenants);foreach($allow as $id)if(preg_match('/\b'.(int)$id.'\b/',$sql))$scope=true;}else{$where=preg_split('/\bWHERE\b/i',$sql)[1]??'';foreach($ids as $id)if(preg_match('/["`]?id["`]?\s*=\s*[\x27]?'.$id.'\b/i',$where))$scope=true;}$check($scope,'Actual own DML scope');$audit[]=['scenario'=>$v['scenario'],'op'=>$op,'table'=>$table,'own_scope'=>true,'sha256'=>hash('sha256',$sql)];}
$check(count($audit)===($lane==='B'?26:40),'Exact actual DML count including failed partial chain');$check(count(array_filter($audit,static function($v){return strpos($v['scenario'],'PILOT_SG_F_')===0;}))===0,'Final patch six-read no DML');$out=['lane'=>$lane,'retained_counts'=>$counts,'protected_original'=>$snapshot(),'exact_original_rows'=>$original,'local_files'=>$files,'external_leaves'=>$leaves,'leaf_counts'=>array_count_values(array_column($leaves,'kind')),'business_DML'=>$audit,'own_fixture_DML'=>2,'global_DML'=>0,'DDL'=>0,'final_read_DML'=>0,'partial_failed_chain_retained'=>$lane==='C'?['activity_ids'=>array_values($p['owned']),'address_count'=>4,'file_count'=>0]:null,'source_sha256'=>$boundary['hashes']];file_put_contents(__DIR__.'/final-audit-'.$lane.'.json',json_encode($out,JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES|JSON_PRESERVE_ZERO_FRACTION));echo json_encode(['lane'=>$lane,'retained'=>$counts,'business_DML'=>count($audit),'fixture_DML'=>2,'global_DML'=>0,'all_private_PNG_files'=>count($files),'all_leaf_params_and_ownership_verified'=>true]),"\n";
} catch(Throwable $e) { echo json_encode(['audit_error'=>$e->getMessage(),'file'=>$e->getFile(),'line'=>$e->getLine()]),"\n";exit(1); }