Finish RPF-WP-0019 apps-pg controls and recovery

docs/placement-policy.md

@@ -79,43 +79,40 @@ triggers. It is not the same role as the operator of the cluster.
 | `user-engine` | `user-engine-pg` | P2 | `net-kingdom` | this repo | not assessed here |
 | `target-revenue` | `target-revenue-pg` | P2 | `target-revenue` | this repo | not assessed here |
 | `forgejo` | `forgejo-db` | P2 | this repo | — | single consumer |
-| `vergabe` | `apps-pg` | P1 | `vergabe-teilnahme` | this repo | **absent** |
-| `coulomb_social` | `apps-pg` | P1 | `coulomb-social` | this repo | **absent** |
+| `vergabe` | `apps-pg` | P1 | `vergabe-teilnahme` | this repo | 14 live boundary/control probes |
+| `coulomb_social` | `apps-pg` | P1 | `coulomb-social` | this repo | 14 live boundary/control probes |
 
-### 3.1 Two of these P1 levels are asserted without evidence
+### 3.1 The two apps-pg P1 levels are now evidenced
 
 §13.1 claims a level only with its artifact present. The P1–P4 artifact is
 *"provisioning declaration plus the platform's isolation probes"*.
 
 `platform-pg` has them — `rapp-postgres` runs 19 adversarial probes against the
-consumer boundary. **`apps-pg` has none.** `scripts/capture-apps-pg-evidence.py`
-captures *capacity* evidence for `resource-control`; it makes no isolation
-assertion. So the P1 levels recorded above for `vergabe` and `coulomb_social`
-are, as of 2026-08-17, **provisioning declarations without probes** — stated
-here rather than quietly carried, because a table of levels that mixes
-evidenced and unevidenced entries without saying which is which is the failure
-§13.1 exists to prevent.
+consumer boundary. Since 2026-08-20, `apps-pg` has a repeatable 14-assertion
+live harness too. It uses both real consumer credentials, denies cross-database
+and bootstrap connections, verifies the timeouts and role allowance, fills
+one consumer's allowance, proves the next connection is rejected, and keeps
+the peer available. Evidence:
+`docs/evidence/RPF-WP-0019-isolation-2026-08-20.md`.
 
-Recorded as owed by this repo. Until the probes exist, those two rows should be
-read as *intended* placement, not *verified* placement.
-
-### 3.2 `apps-pg` cannot produce the noisy-neighbour artifact at all
+### 3.2 `apps-pg` noisy-neighbour artifact and its limit
 
 Worth separating from the gap above, because it is not a matter of writing a
 missing test. §13's P1–P2 noisy-neighbour artifact requires a per-consumer
 usage baseline, a saturation run, and **evidence that the governance controls
 bind — that the greedy consumer is held at its limits.**
 
-`apps-pg` has no per-consumer governance controls. Its connection pool is not
-partitioned, there is no per-consumer connection allowance, no statement
-timeout and no resource limit on the pod. There is nothing that could be shown
-to bind, so a run against it could only demonstrate that a saturating consumer
-degrades its co-residents — which §13.4 explicitly rejects as an artifact that
-"can only fail, or that passes by being run gently enough".
+RPF-WP-0019 supplied the missing 20-connection role allowances, 15-second
+timeouts, database ACL boundary, and Burstable pod envelope before running the
+artifact. Saturating `coulomb_social` bound at 20 and rejected an excess
+connection while five `vergabe` queries remained available. Five-query
+operator-path wall time rose from 5,285ms to 8,146ms (54.1%).
 
-The honest sequence is therefore: **controls first, artifact second.** Writing
-the probe before the limits exist would produce an overclaim wearing the
-costume of evidence. Tracked as `RPF-WP-0019`.
+Both consumers are `interactive`, but neither publishes a numeric database
+latency objective, and the measurement includes five separate `kubectl exec`
+and `psql` startups. The artifact therefore evidences P1 boundary and continued
+availability, not a latency SLO or CPU/memory fairness. That limit is part of
+the artifact rather than silently promoted into a stronger claim.
 
 **The consuming repo is the placement owner; this repo co-signs.** The
 consumer knows its latency requirement, its erasure horizon and its compliance