/**
 * AS/CYBER/CLIENTDATA-ISOLATION Batch 1a — behavioral verification (DEV ONLY).
 *
 * Three CLIENTDATA tables newly given STANDARD symmetric tenant isolation this
 * batch (tenant_id text NOT NULL + RLS via TENANT_TABLES membership → the
 * generated tenant_isolation policy USING/WITH CHECK (tenant_id =
 * current_tenant_id())):
 *   suspicious_activity_reports  (writer: regulator-gateway.createSAR → regulator-gateway-db.saveSAR)
 *   kyc_agent_decisions          (writer: kyc-agent-engine-db.saveKycDecision   — required tenantId)
 *   kyc_life_events              (writer: kyc-agent-engine-db.saveKycLifeEvent   — required tenantId)
 *
 * Per the architect's APPROVE-WITH-CHANGES, this harness proves the FOUR changes
 * behaviorally, all as the RLS-subject role aegis_app (Rule 17), paired POS/NEG
 * (Rule 18):
 *
 *   (1) SAR reads are DB-backed under the request-tenant context — proven through
 *       the SAR API (regulatorGateway.getSARs / getSAR, exactly what the routes
 *       call), NOT a raw table read:
 *         SAR-L1  POS  : own-tenant SAR row (inserted via the DB belt, so it is
 *                        NOT in the in-memory Map) is returned by getSARs() under
 *                        its owner's context — i.e. getSARs reads the DB, not the Map.
 *         SAR-G1/G2    : getSARs() under A includes A's SAR + excludes B's; under
 *                        B includes B's + excludes A's (symmetric, RLS-filtered).
 *         SAR-G3       : a PRE-EXISTING tenant-A SAR (the demo-seed row) is visible
 *                        to A but NOT to B — the old global-Map read would have
 *                        leaked it to B; the DB-backed RLS read does not.
 *         SAR-G4/G5    : getSAR(id) is found only under the owner's context and
 *                        undefined cross-tenant (point read, symmetric); the read
 *                        path decrypts PII correctly (round-trips encryptPii).
 *
 *   (2) saveSAR durable-write fix — createSAR writes the durable row FIRST under an
 *       explicit tenant context (swallow removed) before any Map mutation:
 *         SAR-CR1 POS  : createSAR(tenant A) is durably persisted and the DB-backed
 *                        read returns it (decrypted) under A.
 *         SAR-CR2 NEG  : that createSAR row is NOT visible to tenant B (tenant stamped
 *                        + RLS-isolated).
 *
 *   (3) updateSAR returns an affected-row count so callers distinguish a real
 *       update from a cross-tenant / not-found miss:
 *         SAR-UP1 POS  : updateSAR(own row) under A → rowCount = 1.
 *         SAR-UP2 NEG  : updateSAR(A's row) under B → rowCount = 0 (RLS USING filters
 *                        the row out — silent cross-tenant miss).
 *         SAR-UP3 NEG  : updateSAR(nonexistent id) under A → rowCount = 0.
 *
 *   (4) KYC pair RLS enrollment + required tenantId param — driven THROUGH the real
 *       writers (saveKycDecision / saveKycLifeEvent), which take a required tenantId
 *       and run through the `db` proxy (NOT GUC-self-consistent, so a foreign-tenant
 *       arg can actually reach WITH CHECK):
 *         KD/LE-L1 POS : writer(own tenant) persists + readable by owner.
 *         KD/LE-L2 NEG : tenant B does NOT see tenant A's row (RLS USING).
 *         KD/LE-L3 NEG : writer with tenantId=B under GUC=A → REJECTED (42501)
 *                        (the required param flows through to WITH CHECK).
 *         KD/LE-L5 NEG : DB belt — a direct insert with tenant_id=NULL is rejected
 *                        by the DB (NOT NULL + WITH CHECK), so even a future
 *                        unguarded writer cannot persist a null-tenant row.
 *       (No L4 fail-closed-guard leg: these writers have no runtime "tenantId
 *       required" throw — the param is a TS-required compile-time guard only; an
 *       empty/foreign tenant is caught by WITH CHECK, proven by L3.)
 *
 * Role discipline (Rule 17): every DB-touching leg runs as aegis_app via appPool.
 * runAsTenant() pins an appPool client, sets the tenant GUC LOCAL, and activates
 * tenantContext so the module `db` Proxy resolves to the GUC-set client (mirrors
 * tenant-middleware). A0 asserts current_user='aegis_app' so the isolation proof
 * is not hollow-green (the owner role bypasses RLS). createSAR / updateSAR run via
 * runWithTenantContext / runAsTenant, which use pool === appPool (aegis_app) too.
 * Synthetic, self-cleaning rows; opaque non-PII content. NO secret values printed.
 *
 * Tenant substrate note: tenants.id IS a slug-string; tenant B's id ('stanbic-ug-001')
 * is NOT its slug ('stanbic-ug'), so both A and B are resolved by slug → .id.
 *
 * Run: npx tsx scripts/vf-clientdata-iso-batch1a-proof.ts
 */
import { eq } from "drizzle-orm";
import { appPool, ddlPool, tenantContext, makeClientRunner, db } from "../server/db";
import {
  suspiciousActivityReports,
  kycAgentDecisions,
  kycLifeEvents,
} from "../shared/schema-persistence";
import { encryptPii } from "../server/lib/pii-encryption";
import * as regulatorGateway from "../server/lib/regulator-gateway";
import { updateSAR as dbUpdateSAR } from "../server/lib/regulator-gateway-db";
import { saveKycDecision, saveKycLifeEvent } from "../server/lib/kyc-agent-engine-db";

let pass = 0;
let fail = 0;
const lines: string[] = [];
function check(name: string, cond: boolean, detail = "") {
  if (cond) {
    pass++;
    lines.push(`  PASS  ${name}${detail ? ` — ${detail}` : ""}`);
  } else {
    fail++;
    lines.push(`  FAIL  ${name}${detail ? ` — ${detail}` : ""}`);
  }
}

// Replicate the request path so module-`db`-proxy code runs as aegis_app under
// the tenant GUC (mirrors tenant-middleware).
async function runAsTenant<T>(tenantId: string, fn: () => Promise<T>): Promise<T> {
  const client = await appPool.connect();
  try {
    await client.query("BEGIN");
    await client.query("SELECT set_config('app.current_tenant_id', $1, true)", [tenantId]);
    const runner = makeClientRunner(client);
    const out = await tenantContext.run({ runner, tenantId }, fn);
    await client.query("COMMIT");
    return out;
  } catch (e) {
    try { await client.query("ROLLBACK"); } catch { /* noop */ }
    throw e;
  } finally {
    client.release();
  }
}

const MARK = "vf-cd1a";
const PLATFORM_CTX = { type: "platform" as const };
const RLS_ERR = /42501|policy|row-level/i;
const NULL_ERR = /23502|42501|null|policy|row-level/i;
const HASH = "0".repeat(64);

// SAR insert values (mirrors saveSAR's encryption of subjectName/subjectId/description).
const sarVals = (tag: string, tenantId: string) => ({
  id: `${MARK}-sar-${tag}`,
  tenantId,
  referenceNumber: `${MARK}-ref-${tag}`,
  status: "DRAFT",
  priority: "ROUTINE",
  subjectType: "INDIVIDUAL",
  subjectName: encryptPii(`${MARK}-name-${tag}`, PLATFORM_CTX),
  subjectId: encryptPii(`${MARK}-nin-${tag}`, PLATFORM_CTX),
  activityType: "STRUCTURING",
  activityDate: new Date(),
  currency: "UGX",
  description: encryptPii(`${MARK}-desc-${tag}`, PLATFORM_CTX),
  proofChainHash: HASH,
  preparedBy: MARK,
});

const KD_CUST = `${MARK}-kd-cust`;
const LE_ID = `${MARK}-le-a`;
const LE_CUST = `${MARK}-le-cust`;

async function cleanup(tenantA: string, tenantB: string, dynamicSarId: string | null) {
  await runAsTenant(tenantA, async () => {
    await db.delete(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-a`));
    if (dynamicSarId) await db.delete(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, dynamicSarId));
    await db.delete(kycAgentDecisions).where(eq(kycAgentDecisions.customerId, KD_CUST));
    await db.delete(kycLifeEvents).where(eq(kycLifeEvents.id, LE_ID));
  });
  await runAsTenant(tenantB, async () => {
    await db.delete(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-b`));
    // SAR-L3 attempts an insert of `${MARK}-sar-xt` with tenant_id=B under GUC=A.
    // With RLS enabled it is rejected (never persists), but a pre-RLS run could
    // have leaked it as a tenant-B row — delete it here so re-runs are idempotent.
    await db.delete(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-xt`));
  });
}

async function main() {
  const tRows = (await appPool.query("SELECT id, slug FROM tenants ORDER BY slug")).rows as Array<{ id: string; slug: string }>;
  const tenantA = tRows.find((r) => r.slug === "aegis-sovereign")?.id;
  const tenantB = tRows.find((r) => r.slug === "stanbic-ug")?.id;
  if (!tenantA || !tenantB) throw new Error(`could not resolve tenants A/B from ${JSON.stringify(tRows)}`);

  // Defensive pre-clean (a prior aborted run could leave unique-referenceNumber rows).
  await cleanup(tenantA, tenantB, null);

  lines.push("== A0. Role discipline — proofs run as the RLS-subject role, not the owner ==");
  const who = await runAsTenant(tenantA, async () => (await db.execute(`SELECT current_user AS u`)) as any);
  const currentUser = (who.rows?.[0]?.u ?? who[0]?.u) as string;
  check(
    "A0 runAsTenant connects as aegis_app (non-bypass RLS-subject role) [role discipline]",
    currentUser === "aegis_app",
    `current_user=${currentUser}`,
  );

  // ── suspicious_activity_reports ──────────────────────────────────────────
  lines.push("== SAR. suspicious_activity_reports ==");

  // L1 POS — DB belt insert (NOT createSAR, so the row is NOT in the in-memory Map).
  await runAsTenant(tenantA, async () => db.insert(suspiciousActivityReports).values(sarVals("a", tenantA)));
  const sarSeenByA = await runAsTenant(tenantA, async () =>
    db.select().from(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-a`))
  );
  check(
    "SAR-L1 own-tenant SAR row persists + readable by owner [RLS POS]",
    sarSeenByA.length === 1 && sarSeenByA[0].tenantId === tenantA,
    `rows=${sarSeenByA.length} tenant matches A=${sarSeenByA[0]?.tenantId === tenantA}`,
  );

  // Synthetic SAR for tenant B (for the symmetric gateway cross-tenant proof).
  await runAsTenant(tenantB, async () => db.insert(suspiciousActivityReports).values(sarVals("b", tenantB)));

  // L2 NEG — RLS USING (raw select): B does not see A's row.
  const sarSeenByB = await runAsTenant(tenantB, async () =>
    db.select().from(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-a`))
  );
  check("SAR-L2 tenant B does NOT see tenant A's SAR [RLS USING NEG]", sarSeenByB.length === 0, `tenantB rows=${sarSeenByB.length}`);

  // L3 NEG — RLS WITH CHECK (DB belt): tenant_id=B under GUC=A → rejected.
  let sarXt = false, sarXtErr = "";
  try {
    await runAsTenant(tenantA, async () => db.insert(suspiciousActivityReports).values(sarVals("xt", tenantB)));
  } catch (e: any) { sarXt = true; sarXtErr = String(e?.code ?? e?.message ?? e); }
  check("SAR-L3 direct insert tenant_id=B under GUC=A rejected [RLS WITH CHECK NEG]", sarXt && RLS_ERR.test(sarXtErr), `rejected=${sarXt} err=${sarXtErr}`);

  // L5 NEG — DB belt null tenant.
  let sarNull = false, sarNullErr = "";
  try {
    await runAsTenant(tenantA, async () => db.insert(suspiciousActivityReports).values({ ...sarVals("null", tenantA), tenantId: null as any }));
  } catch (e: any) { sarNull = true; sarNullErr = String(e?.code ?? e?.message ?? e); }
  check("SAR-L5 direct NULL-tenant insert rejected by DB belt [NOT NULL + WITH CHECK NEG]", sarNull && NULL_ERR.test(sarNullErr), `rejected=${sarNull} err=${sarNullErr}`);

  // ── (1) SAR API DB-backed read proof (getSARs / getSAR) ──────────────────
  lines.push("== SAR-API. getSARs / getSAR — DB-backed, RLS-filtered (proven via the SAR API, not raw table) ==");
  const aSars = await runAsTenant(tenantA, () => regulatorGateway.getSARs());
  const bSars = await runAsTenant(tenantB, () => regulatorGateway.getSARs());
  const aIds = new Set(aSars.map((s) => s.id));
  const bIds = new Set(bSars.map((s) => s.id));
  check(
    "SAR-G1 getSARs() under A includes own belt-inserted SAR + excludes B's [DB-backed read POS + xtenant NEG]",
    aIds.has(`${MARK}-sar-a`) && !aIds.has(`${MARK}-sar-b`),
    `A sees sar-a=${aIds.has(`${MARK}-sar-a`)} A sees sar-b=${aIds.has(`${MARK}-sar-b`)}`,
  );
  check(
    "SAR-G2 getSARs() under B includes own SAR + excludes A's [DB-backed read POS + xtenant NEG]",
    bIds.has(`${MARK}-sar-b`) && !bIds.has(`${MARK}-sar-a`),
    `B sees sar-b=${bIds.has(`${MARK}-sar-b`)} B sees sar-a=${bIds.has(`${MARK}-sar-a`)}`,
  );
  // A pre-existing tenant-A row (the demo seed) — visible to A, NOT to B. The old
  // global-Map read would have leaked it to B; the DB-backed RLS read does not.
  const demoId = aSars.map((s) => s.id).find((id) => id !== `${MARK}-sar-a` && id !== `${MARK}-sar-b`);
  check(
    "SAR-G3 pre-existing tenant-A SAR visible to A but NOT B [old global-Map leak discriminator]",
    demoId != null && aIds.has(demoId) && !bIds.has(demoId),
    `demoId=${demoId ?? "none"} A=${demoId ? aIds.has(demoId) : false} B=${demoId ? bIds.has(demoId) : false}`,
  );
  // Point read, symmetric + decrypt round-trip.
  const getA_A = await runAsTenant(tenantA, () => regulatorGateway.getSAR(`${MARK}-sar-a`));
  const getA_B = await runAsTenant(tenantB, () => regulatorGateway.getSAR(`${MARK}-sar-a`));
  check(
    "SAR-G4 getSAR(A-row) found+decrypted under A, undefined under B [point read RLS + PII round-trip]",
    getA_A?.id === `${MARK}-sar-a` && getA_A?.subjectName === `${MARK}-name-a` && getA_B === undefined,
    `underA.id=${getA_A?.id} decrypted=${getA_A?.subjectName === `${MARK}-name-a`} underB=${getA_B === undefined ? "undefined" : "FOUND"}`,
  );
  const getB_B = await runAsTenant(tenantB, () => regulatorGateway.getSAR(`${MARK}-sar-b`));
  const getB_A = await runAsTenant(tenantA, () => regulatorGateway.getSAR(`${MARK}-sar-b`));
  check(
    "SAR-G5 getSAR(B-row) found under B, undefined under A [point read RLS, symmetric]",
    getB_B?.id === `${MARK}-sar-b` && getB_A === undefined,
    `underB.id=${getB_B?.id} underA=${getB_A === undefined ? "undefined" : "FOUND"}`,
  );

  // ── (2) saveSAR durable-write fix — via createSAR ────────────────────────
  lines.push("== SAR-CR. createSAR — durable write FIRST under tenant context (swallow removed) ==");
  const created = await regulatorGateway.createSAR({
    tenantId: tenantA,
    subjectType: "INDIVIDUAL",
    subjectName: `${MARK}-created-name`,
    subjectId: `${MARK}-created-nin`,
    activityType: "STRUCTURING",
    activityDate: new Date(),
    amount: 1000,
    currency: "UGX",
    description: `${MARK}-created-desc`,
    proofChainHash: HASH,
    preparedBy: MARK,
  });
  const dynamicSarId = created.id;
  const createdSeenByA = await runAsTenant(tenantA, () => regulatorGateway.getSAR(created.id));
  check(
    "SAR-CR1 createSAR row durably persisted + DB-backed read returns it (decrypted) under A [durable-write fix POS]",
    createdSeenByA?.id === created.id && createdSeenByA?.subjectName === `${MARK}-created-name`,
    `found=${createdSeenByA?.id === created.id} decrypted=${createdSeenByA?.subjectName === `${MARK}-created-name`}`,
  );
  const createdSeenByB = await runAsTenant(tenantB, () => regulatorGateway.getSAR(created.id));
  check(
    "SAR-CR2 createSAR row NOT visible to tenant B [tenant-stamp + RLS isolation NEG]",
    createdSeenByB === undefined,
    `underB=${createdSeenByB === undefined ? "undefined" : "FOUND"}`,
  );

  // ── (3) updateSAR affected-row count ─────────────────────────────────────
  lines.push("== SAR-UP. updateSAR — affected-row count distinguishes real update vs xtenant/not-found ==");
  const upOwn = await runAsTenant(tenantA, () => dbUpdateSAR(created.id, { status: "PENDING_REVIEW" }));
  check("SAR-UP1 updateSAR own-tenant row → rowCount=1 [row-count POS]", upOwn === 1, `rowCount=${upOwn}`);
  const upXt = await runAsTenant(tenantB, () => dbUpdateSAR(created.id, { status: "PENDING_REVIEW" }));
  check("SAR-UP2 updateSAR cross-tenant (B targeting A's row) → rowCount=0 [RLS USING no-op, NEG]", upXt === 0, `rowCount=${upXt}`);
  const upMiss = await runAsTenant(tenantA, () => dbUpdateSAR(`${MARK}-nonexistent`, { status: "PENDING_REVIEW" }));
  check("SAR-UP3 updateSAR nonexistent id → rowCount=0 [not-found, NEG]", upMiss === 0, `rowCount=${upMiss}`);

  // ── (4a) kyc_agent_decisions — saveKycDecision (required tenantId, real writer) ──
  lines.push("== KD. kyc_agent_decisions — saveKycDecision (required tenantId param) ==");
  // L1 POS — through the real writer.
  await runAsTenant(tenantA, () =>
    saveKycDecision({ tenantId: tenantA, customerId: KD_CUST, agentId: MARK, agentType: "VERIFICATION", decision: "PASS", confidence: 0.9, evidence: "{}", signatureHash: HASH })
  );
  const kdSeenByA = await runAsTenant(tenantA, async () =>
    db.select().from(kycAgentDecisions).where(eq(kycAgentDecisions.customerId, KD_CUST))
  );
  check("KD-L1 saveKycDecision(own tenant) persists + readable by owner [RLS POS via real writer]", kdSeenByA.length === 1 && kdSeenByA[0].tenantId === tenantA, `rows=${kdSeenByA.length} tenant matches A=${kdSeenByA[0]?.tenantId === tenantA}`);

  // L2 NEG
  const kdSeenByB = await runAsTenant(tenantB, async () =>
    db.select().from(kycAgentDecisions).where(eq(kycAgentDecisions.customerId, KD_CUST))
  );
  check("KD-L2 tenant B does NOT see tenant A's KYC decision [RLS USING NEG]", kdSeenByB.length === 0, `tenantB rows=${kdSeenByB.length}`);

  // L3 NEG — real writer, tenantId=B under GUC=A.
  let kdXt = false, kdXtErr = "";
  try {
    await runAsTenant(tenantA, () =>
      saveKycDecision({ tenantId: tenantB, customerId: `${MARK}-kd-xt`, agentId: MARK, agentType: "VERIFICATION", decision: "PASS", confidence: 0.5, evidence: "{}", signatureHash: HASH })
    );
  } catch (e: any) { kdXt = true; kdXtErr = String(e?.code ?? e?.message ?? e); }
  check("KD-L3 saveKycDecision tenant_id=B under GUC=A rejected [RLS WITH CHECK NEG via real writer]", kdXt && RLS_ERR.test(kdXtErr), `rejected=${kdXt} err=${kdXtErr}`);

  // L5 NEG — DB belt null tenant.
  let kdNull = false, kdNullErr = "";
  try {
    await runAsTenant(tenantA, async () =>
      db.insert(kycAgentDecisions).values({ tenantId: null as any, customerId: `${MARK}-kd-null`, agentId: MARK, agentType: "VERIFICATION", decision: "PASS", confidence: "0.5", evidence: "{}", signatureHash: HASH })
    );
  } catch (e: any) { kdNull = true; kdNullErr = String(e?.code ?? e?.message ?? e); }
  check("KD-L5 direct NULL-tenant insert rejected by DB belt [NOT NULL + WITH CHECK NEG]", kdNull && NULL_ERR.test(kdNullErr), `rejected=${kdNull} err=${kdNullErr}`);

  // ── (4b) kyc_life_events — saveKycLifeEvent (required tenantId, real writer) ──
  lines.push("== LE. kyc_life_events — saveKycLifeEvent (required tenantId param) ==");
  // L1 POS
  await runAsTenant(tenantA, () =>
    saveKycLifeEvent({ tenantId: tenantA, id: LE_ID, customerId: LE_CUST, eventType: "ADDRESS_CHANGE", details: "{}", triggerReVerification: false })
  );
  const leSeenByA = await runAsTenant(tenantA, async () =>
    db.select().from(kycLifeEvents).where(eq(kycLifeEvents.id, LE_ID))
  );
  check("LE-L1 saveKycLifeEvent(own tenant) persists + readable by owner [RLS POS via real writer]", leSeenByA.length === 1 && leSeenByA[0].tenantId === tenantA, `rows=${leSeenByA.length} tenant matches A=${leSeenByA[0]?.tenantId === tenantA}`);

  // L2 NEG
  const leSeenByB = await runAsTenant(tenantB, async () =>
    db.select().from(kycLifeEvents).where(eq(kycLifeEvents.id, LE_ID))
  );
  check("LE-L2 tenant B does NOT see tenant A's KYC life event [RLS USING NEG]", leSeenByB.length === 0, `tenantB rows=${leSeenByB.length}`);

  // L3 NEG — real writer, tenantId=B under GUC=A.
  let leXt = false, leXtErr = "";
  try {
    await runAsTenant(tenantA, () =>
      saveKycLifeEvent({ tenantId: tenantB, id: `${MARK}-le-xt`, customerId: `${MARK}-le-cust-xt`, eventType: "ADDRESS_CHANGE", details: "{}", triggerReVerification: false })
    );
  } catch (e: any) { leXt = true; leXtErr = String(e?.code ?? e?.message ?? e); }
  check("LE-L3 saveKycLifeEvent tenant_id=B under GUC=A rejected [RLS WITH CHECK NEG via real writer]", leXt && RLS_ERR.test(leXtErr), `rejected=${leXt} err=${leXtErr}`);

  // L5 NEG — DB belt null tenant.
  let leNull = false, leNullErr = "";
  try {
    await runAsTenant(tenantA, async () =>
      db.insert(kycLifeEvents).values({ id: `${MARK}-le-null`, tenantId: null as any, customerId: `${MARK}-le-cust-null`, eventType: "ADDRESS_CHANGE", details: "{}", triggerReVerification: false })
    );
  } catch (e: any) { leNull = true; leNullErr = String(e?.code ?? e?.message ?? e); }
  check("LE-L5 direct NULL-tenant insert rejected by DB belt [NOT NULL + WITH CHECK NEG]", leNull && NULL_ERR.test(leNullErr), `rejected=${leNull} err=${leNullErr}`);

  // ── cleanup + verify zero ────────────────────────────────────────────────
  await cleanup(tenantA, tenantB, dynamicSarId);
  const leftSarA = await runAsTenant(tenantA, async () => db.select().from(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-a`)));
  const leftSarDyn = await runAsTenant(tenantA, async () => db.select().from(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, dynamicSarId)));
  const leftSarB = await runAsTenant(tenantB, async () => db.select().from(suspiciousActivityReports).where(eq(suspiciousActivityReports.id, `${MARK}-sar-b`)));
  const leftKd = await runAsTenant(tenantA, async () => db.select().from(kycAgentDecisions).where(eq(kycAgentDecisions.customerId, KD_CUST)));
  const leftLe = await runAsTenant(tenantA, async () => db.select().from(kycLifeEvents).where(eq(kycLifeEvents.id, LE_ID)));
  check(
    "ZZ cleanup removed all synthetic rows [hygiene]",
    leftSarA.length === 0 && leftSarDyn.length === 0 && leftSarB.length === 0 && leftKd.length === 0 && leftLe.length === 0,
    `sarA=${leftSarA.length} sarDyn=${leftSarDyn.length} sarB=${leftSarB.length} kd=${leftKd.length} le=${leftLe.length}`,
  );

  lines.push("");
  lines.push(`RESULT: ${pass} PASS / ${fail} FAIL  (total ${pass + fail})`);
  console.log(lines.join("\n"));

  await appPool.end().catch(() => {});
  await ddlPool.end().catch(() => {});
  process.exit(fail === 0 ? 0 : 1);
}

main().catch((e) => {
  console.error(lines.join("\n"));
  console.error("HARNESS ERROR:", e);
  process.exit(2);
});