/**
 * RESTART-SURVIVAL + producer-path verify — CBS enforcement-audit persistence (CBS-2, 2026-07-24).
 *
 * Fires the REAL producer path — coreBankingGateway.freezeAccount() — OUTSIDE any request/tenant
 * context, so resolveTenantId() falls back to the deployment tenant ("default"): the background /
 * fail-closed path most likely to silently swallow a 42501 in production and never be noticed.
 * freezeAccount awaits persistKillSwitch + persistTransactionLog (through withTenantRls), so by the
 * time it returns the durable writes have run. It prints the transactionId (= aegisReference, the
 * join key). A SEPARATE process (docker exec psql) then reads the DB by that id — a fresh process
 * reading what a dead one wrote through the real write path is exactly a restart, and it proves no
 * process-local state is involved. records-never-decide: freezeAccount returns SUCCESS even if the
 * persist failed, so the DB read (not the return value) is the proof.
 */
import { coreBankingGateway } from "../server/lib/core-banking-gateway";

async function main() {
  const acct = process.argv[2] || "VERIFY-ACC-CBS2";
  // No tenantContext.run(...) wrapper on purpose — this is the background path (tenant = "default").
  const res = await coreBankingGateway.freezeAccount(acct, "CBS-2 restart-survival verify", "verify-tester");
  console.log(JSON.stringify({
    status: res.status,
    transactionId: res.transactionId, // = aegisReference, the join key into both tables
    cbsReference: res.cbsReference,
    account: acct,
  }));
  process.exit(res.status === "SUCCESS" ? 0 : 1);
}

main().catch((e) => {
  console.error("VERIFY ERROR:", e?.message || e);
  process.exit(2);
});