the-custodian/docs/changes/netkingdom-target-2026-10-16/group-postgres-r1/final-integration-r1/workplan.patch

diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md
--- a/workplans/NK-WP-0048-security-case-types.md
+++ b/workplans/NK-WP-0048-security-case-types.md
@@ -691,31 +691,30 @@
 ```task
 id: NK-WP-0048-T14
 status: progress
-depends_on: [NK-WP-0048-T20]
+depends_on: [NK-WP-0048-T20, NK-WP-0048-T21]
 priority: high
 state_hub_task_id: "fce95440-a25b-5f27-8ef3-a3d182099113"
 ```
 
-Owner: NetKingdom. Next action: specify a CNPG-backed journal through the
-existing `rapp-postgres` database-per-consumer contract, or obtain an explicit
-scoped governed exception to accepted ADR-0015 before any production SQLite
-proposal. The implemented SQLite backend supplies local/disposable proof only;
-a new PVC is not an admitted production path. Prepare the native writer-isolation
-contract for the existing identity-provisioner, and bind the
-existing protected owner callbacks to the accepted case/source/principal,
-per-attempt evidence and session revocation. Identify the actual deployment and
-custody owner through the existing ADR-0015 routes before proposing a rollout;
-an existing service token, caller-supplied JSON or provenance receipt establishes
-no new authorization.
-
-2026-10-17 refinement: T20 extracts the completed durable provenance source
-candidate and disposable LLDAP compatibility proof from this task. The source
-returns exact creation inventories, retains prestate/intents across process
-restart and refuses detected shared-member/group-identity drift. Its publication
-and projection are still pending the coordinator's separate integration receipt.
-This narrows T14 without closing its original externally referenced native gate.
-The task remains `todo` because preparation of the native contracts can proceed;
-no missing owner assent is represented as received.
+Owner: NetKingdom. Next action: bind the completed T21 PostgreSQL journal to
+an admitted dedicated CNPG consumer through the existing `rapp-postgres`
+database-per-consumer contract. Identify the actual deployment/package and
+custody owner, admitted placement/capacity and role/renewable lease/TLS target;
+implement the independently retained exact content checkpoint and authoritative
+tenant/case/source/principal callbacks before enabling governed group operations.
+The injection-only backend and fixture callbacks do not supply production scope
+or authorization. Existing service tokens, caller-supplied JSON and provenance
+receipts confer no new grant. The default production endpoint remains disabled
+without the trusted integration. SQLite remains local/disposable only; any
+production exception requires explicit scoped governance under ADR-0015.
+
+2026-10-17 refinement: T20 retains the historical durable SQLite source and
+actual disposable LLDAP proof. T21 extracts the completed PostgreSQL source and
+bounded real disposable SQL compatibility proof. T14 remains `progress` for
+native CNPG admission/recovery, protected owner integration and exclusion of all
+external LDAP writers. Separate source publication/projection and independent
+cleanup receipts belong to coordinator follow-through; no missing native assent
+is represented as received.
 
 Completion still requires independently reviewed/admitted ADR-0015-conforming
 CNPG storage (or an explicit governed exception), backup/lost-store recovery and
@@ -994,3 +993,73 @@
 decisions. No package, database, credential, rollout or owner assent was created.
 Custodian evidence: group-provenance-r1/native-storage-proposal-r1; final source,
 projection and cleanup review: resume-integration-r1/publication-verification.json.
+
+
+## T21 — Implement the PostgreSQL journal and prove disposable SQL compatibility
+
+```task
+id: NK-WP-0048-T21
+status: done
+depends_on: [NK-WP-0048-T20]
+priority: high
+```
+
+Completed 2026-10-17: bounded source preparation and actual disposable PostgreSQL
+compatibility only. T14 retains native storage, custody, callbacks, authorization,
+all-writer isolation and production admission. Coordinator source publication and
+projection remain separate follow-through; no source revision or task UUID is
+invented here. T20 remains the historical local SQLite/actual LLDAP proof.
+
+The eight-path source candidate adds an injection-only PostgreSQL implementation
+behind the existing owner journal seam, with explicit trusted tenant/directory/
+case/source/principal/epoch binding and independent continuity callbacks. It
+persists bounded intent/created-only receipts, exact-one version updates, durable
+active fences, and a content-bound journal chain. SQL commits precede independent
+exact-marker acknowledgment; lost replies/checkpoints poison continuation and
+retain uncertainty. A counter-only checkpoint is explicitly insufficient for
+divergent clones. Migration does not create database/schema/credential, admit an
+epoch or clear quarantine; production HTTP activation is absent pending trusted
+callbacks. Pinned psycopg package/image-copy closure is included, without claiming
+an image build or native dependency admission.
+
+Candidate base `6cb43c0cc55212363a5406b02db046e2384a7c40`; final eight-path patch
+`sha256:5549d2982b61ff70aba4b3928fecd5639db0f1a732ab2f8630f678e7acf4d34d`.
+All 82 source tests pass, alongside 13 fixture plan/diagnostic checks and two
+source-backed snapshot regressions. Counts overlap the same source and fixture;
+they are not additive native acceptance or completion percentages.
+
+The independently reviewed R5 fixture ran the actual SQL migration/backend and
+existing provisioner path against cached pinned disposable PostgreSQL. Directory
+operations deliberately used the existing synthetic LLDAP test double. All
+manifest-declared phase oracles passed: creation-only inventory and DDL refusal;
+separate-process replay/revoke with complete preexisting/shared visible-state
+preservation; foreign-context refusal; concurrent exactly-once reservation and
+stale version refusal; actual database fork with divergent bodies at the same
+counter and fresh-object rejection of the losing exact checkpoint; retained
+uncertainty after checkpoint/directory/SQL response loss; and actual pg_dump/
+pg_restore rollback refusal against the independently retained fixture checkpoint.
+The checkpoint is fixture-only, not an admitted native owner evidence holder.
+
+Only generated credentials/state were used, with two nonroot/read-only containers
+on private loopback, bounded tmpfs/CPU/memory/PIDs/lifetimes, no host ports/mounts,
+no pulls and no production contact. The safe receipt reports both exact owned
+containers absent, with no daemon uncertainty. Independent final pinned-daemon
+cleanup verification remains coordinator follow-through.
+
+Failed R2/R3/R4 receipts and source revisions remain retained. R2's helper failure
+subphase is unknown; R3 exposed a real backend bug where replacing nested receipt
+objects lost the created ID held by ensure, fixed by acknowledging only the backend
+version after commit/checkpoint. R4 verified that fix through actual SQL bootstrap,
+then exposed fixture snapshot aliasing and empty deleted-group backing entries;
+source-backed regressions corrected the snapshot without weakening complete
+visible-prestate equality, and reject nonempty orphan membership. These refinements
+belong to one trial, not extra native acceptance successes.
+
+Custodian evidence: `docs/changes/netkingdom-target-2026-10-16/group-postgres-r1/`;
+exact source/pre/postimages and retained predecessors; native R5 manifest
+`sha256:d51f90816616848b93bcdc482e10a98d07061deb01eeed9e50700fc6e68b6051`;
+`final-integration-r1/typed-execution-evidence.json` and byte-exact safe receipt
+(original `/tmp/nk48-postgres-native-review-sguj7t8p/result.json`). No CNPG native
+storage/HA/backup/lease/TLS/capacity/restore admission, authoritative protected
+callbacks, real LDAP writer fencing/CAS/ABA exclusion, owner assent or production
+endpoint activation is claimed. Those remain live T14 work.