chore(consistency): renormalize lifecycle state [auto]

Updated by fix-consistency on 2026-08-18:
  - workplan status: ready → active

workplans/TEN-WP-0009-postgres-production-store.md

@@ -4,7 +4,7 @@ type: workplan
 title: "PostgreSQL as the production store, SQLite for dev and test"
 domain: infotech
 repo: tenant-engine
-status: ready
+status: active
 owner: claude
 topic_slug: tenant-lifecycle
 created: "2026-08-16"
@@ -123,7 +123,7 @@ building a fleet drift-detector because we got bitten. Raised with
 
 ```task
 id: TEN-WP-0009-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "b4701256-f235-4474-9dcf-7cb09f62b873"
 ```
@@ -208,6 +208,13 @@ move-to-dedicated trigger list and runbook are recorded.
 Status 2026-08-17: **accepted.** `consumers/tenant-engine.yaml` merged at
 `deda11e`. Provisioning is operator-gated as RAPP-IN-0004; nothing applied yet.
 
+2026-08-18 repository readiness: desired runtime and migration manifests now
+consume separate file-projected leases, label the client namespace, and admit
+egress only to the real `databases/platform-pg` destination (an earlier draft
+incorrectly selected namespace `railiance-platform`). The published retention
+policy replaces the declaration's placeholder. T01 remains progress because
+consumer/lease provisioning and backup evidence are live operator gates.
+
 **They caught a real defect in our proposal.** The declaration had a single
 `statementTimeout` field that the renderer applied to the migration role, the
 runtime role, *and* the database — so our 5s would have given us 5s DDL and
@@ -334,7 +341,7 @@ path. Asked.
 
 ```task
 id: TEN-WP-0009-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d7428bc1-2e5f-4a4c-93f5-9368ebb691d5"
 ```
@@ -368,11 +375,19 @@ SQLite-only dev is meant to stay dependency-light.
 
 Done when all three backends pass the same conformance suites unchanged.
 
+Completed 2026-08-18. `PostgresTenantStore` implements the full protocol with
+bounded pooling, per-checkout credential-file rotation, row locking and atomic
+receipt/version/event transactions. The existing lifecycle and guardrail
+conformance suites run against PostgreSQL when
+`TENANT_ENGINE_TEST_DATABASE_URL` is present. A disposable PostgreSQL 16 run
+passed 88 shared conformance cases; the full source suite passes 260 with 28
+environment-gated PostgreSQL cases skipped when no database is supplied.
+
 ## T03 - Backend selection that fails closed
 
 ```task
 id: TEN-WP-0009-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "89c121c6-8bc5-4abe-80f0-d11406aeffc2"
 ```
@@ -397,11 +412,16 @@ store am I actually using" is cheap to answer and expensive to guess.
 Done when misconfiguration is a startup failure with a clear message, covered
 by tests.
 
+Completed 2026-08-18. URL-file selects PostgreSQL, path selects SQLite, both
+refuse startup, and neither retains the in-memory test default. `/health`
+reports and pings the active backend so store selection and credential failure
+are externally visible without disclosing a DSN.
+
 ## T04 - Migrate production data
 
 ```task
 id: TEN-WP-0009-T04
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "51a83eae-9e9f-4676-bc1d-9c2d884bac0d"
 ```
@@ -433,11 +453,19 @@ Keep the SQLite file and its PVC until T05's soak passes. It is the rollback.
 Done when a verified copy is live in PostgreSQL and the comparison evidence is
 recorded here.
 
+2026-08-18 repository readiness: `tenant-engine-transfer` now refuses a
+non-empty target, copies all seven tables in one transaction, preserves
+identity sequence values and nullable legacy timestamps, compares every source
+and target row, and emits non-secret counts/SHA-256 digests plus requested
+tenant lifecycle/version checks. Its PostgreSQL 16 integration test exercises
+all tables and the next event sequence. The live scale-to-zero/export/import is
+not performed and T04 remains progress.
+
 ## T05 - Cut over the deployment
 
 ```task
 id: TEN-WP-0009-T05
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "03aeae3b-5e0f-4c77-a763-787ae08078f5"
 ```
@@ -466,6 +494,13 @@ Done when production runs on PostgreSQL, `make verify-pin` passes, and the
 TEN-WP-0007 T04 verification list still passes end to end against the live
 service.
 
+2026-08-18 desired state: PVC/mount removed, `RollingUpdate` selected,
+file-projected runtime and caller credentials added, and egress narrowed to
+`databases/platform-pg`, flex-auth and DNS. A separate migration Job has its
+own lease and NetworkPolicy. Replicas deliberately remain one. The manifests
+are not applied and the pinned old digest does not yet contain this code, so
+T05 remains progress and no live PostgreSQL claim is made.
+
 ## T06 - Tell the fleet, and close the loop on TEN-WP-0008
 
 ```task