From 05d0fbc885d455829a10103b25b504e768a62339 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:47:04 +0900
Subject: [PATCH 01/64] test: require commercially compatible sync PostgreSQL
 boundary

---
 tests/test_postgres_sync_driver_contract.py | 73 +++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 tests/test_postgres_sync_driver_contract.py

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
new file mode 100644
index 000000000..b550ded96
--- /dev/null
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -0,0 +1,73 @@
+"""Commercial-license and compatibility contract for synchronous PostgreSQL tooling.
+
+LineageWeave's runtime uses asyncpg, but seed/admin/schema tooling still needs a
+small synchronous DB-API boundary.  This contract prevents that boundary from
+silently reintroducing the former psycopg2-binary dependency and locks the
+behaviour that generated database/role identifiers and PostgreSQL DSNs rely on.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+from lineageweave.postgres_sync import connection_kwargs_from_dsn, sql
+
+
+_REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+_FORBIDDEN_IMPORT = re.compile(r"(?m)^\s*(?:import\s+psycopg2\b|from\s+psycopg2\b)")
+
+
+def test_sync_postgres_driver_is_not_psycopg2() -> None:
+    """Executable Python and dependency metadata must not retain psycopg2."""
+    roots = (
+        _REPOSITORY_ROOT / "lineageweave",
+        _REPOSITORY_ROOT / "scripts",
+        _REPOSITORY_ROOT / "tests",
+        _REPOSITORY_ROOT / "backend",
+    )
+    offenders: list[str] = []
+    for root in roots:
+        for path in root.rglob("*.py"):
+            if path == Path(__file__):
+                continue
+            if _FORBIDDEN_IMPORT.search(path.read_text(encoding="utf-8")):
+                offenders.append(str(path.relative_to(_REPOSITORY_ROOT)))
+
+    pyproject = (_REPOSITORY_ROOT / "pyproject.toml").read_text(encoding="utf-8")
+    assert "psycopg2-binary" not in pyproject
+    assert "pg8000" in pyproject
+    assert offenders == []
+
+
+def test_generated_identifier_quoting_is_postgresql_safe() -> None:
+    """Generated database and role names stay identifiers, never SQL text."""
+    statement = sql.SQL("create database {}").format(sql.Identifier('tenant"archive'))
+    assert statement == 'create database "tenant""archive"'
+
+
+def test_dsn_query_options_are_mapped_without_silent_loss() -> None:
+    """Supported libpq-style DSN options survive the pg8000 adapter boundary."""
+    kwargs = connection_kwargs_from_dsn(
+        "postgresql://alice:p%40ss@db.example:6543/archive"
+        "?connect_timeout=7&application_name=lineageweave-test&sslmode=disable"
+    )
+
+    assert kwargs["user"] == "alice"
+    assert kwargs["password"] == "p@ss"
+    assert kwargs["host"] == "db.example"
+    assert kwargs["port"] == 6543
+    assert kwargs["database"] == "archive"
+    assert kwargs["timeout"] == 7.0
+    assert kwargs["application_name"] == "lineageweave-test"
+    assert kwargs["ssl_context"] is False
+
+
+def test_unknown_dsn_query_option_fails_closed() -> None:
+    """A connection option must never disappear merely because drivers differ."""
+    with pytest.raises(ValueError, match="unsupported PostgreSQL DSN option"):
+        connection_kwargs_from_dsn(
+            "postgresql://alice:secret@db.example/archive?target_session_attrs=read-write"
+        )

From 76153aa085468fad478de4ce1bee912ec5b37ae1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:48:21 +0900
Subject: [PATCH 02/64] feat: add pg8000 synchronous PostgreSQL adapter

---
 lineageweave/postgres_sync.py | 251 ++++++++++++++++++++++++++++++++++
 1 file changed, 251 insertions(+)
 create mode 100644 lineageweave/postgres_sync.py

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
new file mode 100644
index 000000000..7fd49eec5
--- /dev/null
+++ b/lineageweave/postgres_sync.py
@@ -0,0 +1,251 @@
+"""Synchronous PostgreSQL adapter for admin, seed, and schema tooling.
+
+The application runtime uses ``asyncpg``.  A few administrative and integration
+paths still need a blocking DB-API connection, chiefly to create ephemeral test
+databases and to run the synthetic seed.  This module keeps that secondary
+boundary provider-specific in one place and deliberately exposes only the
+behaviour LineageWeave needs.
+
+Connection URIs are parsed explicitly because pg8000 accepts keyword arguments
+rather than libpq DSN strings.  Unsupported query options fail closed instead
+of disappearing during the driver migration.  Generated SQL identifiers are
+quoted locally; values must continue to use DB-API parameters.
+"""
+
+from __future__ import annotations
+
+import ssl
+from dataclasses import dataclass
+from types import SimpleNamespace
+from typing import Any, Mapping
+from urllib.parse import parse_qsl, unquote, urlsplit
+
+import pg8000.dbapi as _dbapi
+
+
+class DatabaseError(_dbapi.DatabaseError):
+    """Base class for translated server errors carrying PostgreSQL SQLSTATE."""
+
+
+class OperationalError(_dbapi.InterfaceError):
+    """Connection/setup error used by reachability probes."""
+
+
+class CheckViolation(DatabaseError):
+    """PostgreSQL SQLSTATE 23514: a CHECK constraint rejected the statement."""
+
+
+class ExclusionViolation(DatabaseError):
+    """PostgreSQL SQLSTATE 23P01: an exclusion constraint rejected the statement."""
+
+
+class RaiseException(DatabaseError):
+    """PostgreSQL SQLSTATE P0001: server-side ``RAISE EXCEPTION``."""
+
+
+errors = SimpleNamespace(
+    CheckViolation=CheckViolation,
+    ExclusionViolation=ExclusionViolation,
+    RaiseException=RaiseException,
+)
+
+
+def _quote_identifier(value: str) -> str:
+    if not isinstance(value, str) or not value:
+        raise ValueError("PostgreSQL identifier must be a non-empty string")
+    if "\x00" in value:
+        raise ValueError("PostgreSQL identifier must not contain NUL")
+    return '"' + value.replace('"', '""') + '"'
+
+
+@dataclass(frozen=True)
+class _Identifier:
+    value: str
+
+    def __str__(self) -> str:
+        return _quote_identifier(self.value)
+
+
+class _SQL(str):
+    def format(self, *args: object, **kwargs: object) -> str:
+        positional = tuple(str(value) for value in args)
+        named = {key: str(value) for key, value in kwargs.items()}
+        return str(self).format(*positional, **named)
+
+
+sql = SimpleNamespace(SQL=_SQL, Identifier=_Identifier)
+
+
+def _ssl_context_for_mode(mode: str) -> ssl.SSLContext | bool | None:
+    normalized = mode.lower()
+    if normalized == "disable":
+        return False
+    if normalized == "prefer":
+        return None
+    if normalized == "require":
+        return True
+    if normalized == "verify-ca":
+        context = ssl.create_default_context()
+        context.check_hostname = False
+        return context
+    if normalized == "verify-full":
+        return ssl.create_default_context()
+    raise ValueError(f"unsupported PostgreSQL sslmode: {mode}")
+
+
+def connection_kwargs_from_dsn(
+    dsn: str,
+    *,
+    connect_timeout: float | int | None = None,
+) -> dict[str, Any]:
+    """Translate one PostgreSQL URI into explicit pg8000 connection arguments.
+
+    ``connect_timeout`` passed by the caller takes precedence over the URI's
+    ``connect_timeout`` query value, matching the old call sites.  Query
+    options are allow-listed because silently discarding a libpq option could
+    weaken transport security or alter session semantics.
+    """
+
+    parsed = urlsplit(dsn)
+    if parsed.scheme not in {"postgres", "postgresql"}:
+        raise ValueError("PostgreSQL DSN must use postgres:// or postgresql://")
+    if parsed.username is None:
+        raise ValueError("PostgreSQL DSN must include a user")
+    if not parsed.path or parsed.path == "/":
+        raise ValueError("PostgreSQL DSN must include a database name")
+
+    kwargs: dict[str, Any] = {
+        "user": unquote(parsed.username),
+        "host": parsed.hostname or "localhost",
+        "port": parsed.port or 5432,
+        "database": unquote(parsed.path.lstrip("/")),
+    }
+    if parsed.password is not None:
+        kwargs["password"] = unquote(parsed.password)
+
+    startup_params: dict[str, str] = {}
+    query = dict(parse_qsl(parsed.query, keep_blank_values=True))
+    supported = {"connect_timeout", "application_name", "sslmode", "options"}
+    unknown = sorted(set(query) - supported)
+    if unknown:
+        raise ValueError(f"unsupported PostgreSQL DSN option: {unknown[0]}")
+
+    timeout_value = connect_timeout
+    if timeout_value is None and "connect_timeout" in query:
+        try:
+            timeout_value = float(query["connect_timeout"])
+        except ValueError as exc:
+            raise ValueError("PostgreSQL connect_timeout must be numeric") from exc
+    if timeout_value is not None:
+        timeout = float(timeout_value)
+        if timeout <= 0:
+            raise ValueError("PostgreSQL connect_timeout must be positive")
+        kwargs["timeout"] = timeout
+
+    if "application_name" in query:
+        if not query["application_name"]:
+            raise ValueError("PostgreSQL application_name must not be empty")
+        kwargs["application_name"] = query["application_name"]
+    if "sslmode" in query:
+        kwargs["ssl_context"] = _ssl_context_for_mode(query["sslmode"])
+    if "options" in query:
+        startup_params["options"] = query["options"]
+    if startup_params:
+        kwargs["startup_params"] = startup_params
+    return kwargs
+
+
+def _sqlstate(error: BaseException) -> str | None:
+    for arg in getattr(error, "args", ()):
+        if isinstance(arg, Mapping):
+            state = arg.get("C")
+            if isinstance(state, str):
+                return state
+    return None
+
+
+def _translated_error(error: BaseException) -> BaseException:
+    state = _sqlstate(error)
+    translated_type = {
+        "23514": CheckViolation,
+        "23P01": ExclusionViolation,
+        "P0001": RaiseException,
+    }.get(state)
+    if translated_type is None:
+        return error
+    return translated_type(*getattr(error, "args", ()))
+
+
+class Cursor:
+    """Thin cursor wrapper that preserves the SQLSTATE-specific test contract."""
+
+    def __init__(self, inner: Any) -> None:
+        self._inner = inner
+
+    def execute(self, operation: str, args: object | None = None, **kwargs: object) -> Any:
+        try:
+            if args is None:
+                return self._inner.execute(operation, **kwargs)
+            return self._inner.execute(operation, args, **kwargs)
+        except _dbapi.DatabaseError as exc:
+            translated = _translated_error(exc)
+            if translated is exc:
+                raise
+            raise translated from exc
+
+    def executemany(self, operation: str, param_sets: object) -> Any:
+        try:
+            return self._inner.executemany(operation, param_sets)
+        except _dbapi.DatabaseError as exc:
+            translated = _translated_error(exc)
+            if translated is exc:
+                raise
+            raise translated from exc
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._inner, name)
+
+    def __enter__(self) -> "Cursor":
+        self._inner.__enter__()
+        return self
+
+    def __exit__(self, exc_type: object, exc: object, traceback: object) -> object:
+        return self._inner.__exit__(exc_type, exc, traceback)
+
+
+class Connection:
+    """Connection proxy that keeps pg8000 isolated from repository call sites."""
+
+    def __init__(self, inner: Any) -> None:
+        self._inner = inner
+
+    @property
+    def autocommit(self) -> bool:
+        return bool(self._inner.autocommit)
+
+    @autocommit.setter
+    def autocommit(self, value: bool) -> None:
+        self._inner.autocommit = value
+
+    def cursor(self, *args: object, **kwargs: object) -> Cursor:
+        return Cursor(self._inner.cursor(*args, **kwargs))
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._inner, name)
+
+    def __enter__(self) -> "Connection":
+        self._inner.__enter__()
+        return self
+
+    def __exit__(self, exc_type: object, exc: object, traceback: object) -> object:
+        return self._inner.__exit__(exc_type, exc, traceback)
+
+
+def connect(dsn: str, *, connect_timeout: float | int | None = None) -> Connection:
+    """Open the repository's synchronous pg8000 connection boundary."""
+
+    kwargs = connection_kwargs_from_dsn(dsn, connect_timeout=connect_timeout)
+    try:
+        return Connection(_dbapi.connect(**kwargs))
+    except _dbapi.InterfaceError as exc:
+        raise OperationalError(*getattr(exc, "args", ())) from exc

From f359de178418969a39b049fc46d7337a124dbb59 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:48:37 +0900
Subject: [PATCH 03/64] build: replace psycopg2 with pg8000

---
 pyproject.toml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 7744aef87..d821370e3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -33,7 +33,9 @@ build-backend = "setuptools.build_meta"
 
 [project.optional-dependencies]
 dev = [
-  "psycopg2-binary>=2.9.12",
+  # Pure-Python BSD-3-Clause DB-API driver used only by the synchronous
+  # seed/admin/schema tooling boundary. Runtime persistence remains asyncpg.
+  "pg8000==1.31.5",
   "coverage>=7.6",
   "pyjwt[crypto]>=2.8.0",
   "pytest>=8.0",
@@ -67,4 +69,4 @@ include = ["lineageweave*", "backend*"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests", "backend/tests"]
-pythonpath = ["."]
+pythonpath = ["."]
\ No newline at end of file

From 33fc33d415a592daac644b5729b83c228cc9efae Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:49:42 +0900
Subject: [PATCH 04/64] test: collect pg8000-backed optional PostgreSQL suites
 safely

---
 lineageweave/optional_extra_collection.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lineageweave/optional_extra_collection.py b/lineageweave/optional_extra_collection.py
index dd108932c..3be38a1bf 100644
--- a/lineageweave/optional_extra_collection.py
+++ b/lineageweave/optional_extra_collection.py
@@ -2,7 +2,7 @@
 
 OpenCode coverage-evidence runs in a networkless sandbox that supplies
 pytest and coverage but not LineageWeave's optional backend extras
-(``asyncpg``, ``psycopg2``, ``redis``, ``fast_mlsirm``, ``numpy``). Hosted CI
+(``asyncpg``, ``pg8000``, ``redis``, ``fast_mlsirm``, ``numpy``). Hosted CI
 installs those extras and collects every suite. This helper keeps
 collection from failing with ``ModuleNotFoundError`` when extras are
 absent, without skipping anything when they are present.
@@ -17,7 +17,7 @@
 
 OPTIONAL_EXTRA_MODULES: tuple[str, ...] = (
     "asyncpg",
-    "psycopg2",
+    "pg8000",
     "redis",
     "fast_mlsirm",
     "numpy",

From c1d466f86a58c8a68a1add6cb058bd4cfab62c70 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:50:16 +0900
Subject: [PATCH 05/64] test: run PROV-O schema contract through pg8000 adapter

---
 tests/test_prov_o_schema.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/tests/test_prov_o_schema.py b/tests/test_prov_o_schema.py
index 733c96076..77358ea91 100644
--- a/tests/test_prov_o_schema.py
+++ b/tests/test_prov_o_schema.py
@@ -14,8 +14,8 @@
 
 import pytest
 
-psycopg2 = pytest.importorskip("psycopg2")
-sql = pytest.importorskip("psycopg2.sql")
+from lineageweave import postgres_sync as sync_postgres
+from lineageweave.postgres_sync import sql
 
 _ADMIN_DSN = os.environ.get(
     "LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN", "postgresql://localhost/postgres"
@@ -30,10 +30,10 @@
 def _postgres_available() -> bool:
     """Return whether the configured PostgreSQL admin database is reachable."""
     try:
-        connection = psycopg2.connect(_ADMIN_DSN, connect_timeout=2)
+        connection = sync_postgres.connect(_ADMIN_DSN, connect_timeout=2)
         connection.close()
         return True
-    except psycopg2.OperationalError:
+    except sync_postgres.OperationalError:
         return False
 
 
@@ -53,7 +53,7 @@ def _dsn_for_database(admin_dsn: str, database_name: str) -> str:
 def prov_schema_db():
     """Yield a freshly migrated database and drop it after the test."""
     database_name = f"lineageweave_prov_{uuid.uuid4().hex[:12]}"
-    admin_connection = psycopg2.connect(_ADMIN_DSN)
+    admin_connection = sync_postgres.connect(_ADMIN_DSN)
     admin_connection.autocommit = True
     with admin_connection.cursor() as cursor:
         cursor.execute(
@@ -61,7 +61,7 @@ def prov_schema_db():
         )
     try:
         database_dsn = _dsn_for_database(_ADMIN_DSN, database_name)
-        connection = psycopg2.connect(database_dsn)
+        connection = sync_postgres.connect(database_dsn)
         try:
             with connection.cursor() as cursor:
                 for migration_path in _MIGRATION_PATHS:
@@ -117,7 +117,7 @@ def test_database_accepts_valid_generation_and_rejects_wrong_domain(prov_schema_
             "values (%s, 'prov_was_generated_by', %s)",
             (entity_id, activity_id),
         )
-        with pytest.raises(psycopg2.errors.RaiseException, match="violates PROV-O domain"):
+        with pytest.raises(sync_postgres.errors.RaiseException, match="violates PROV-O domain"):
             cursor.execute(
                 "insert into provenance_assertion "
                 "(subject_resource_id, relation_code, object_resource_id) "
@@ -135,7 +135,7 @@ def test_database_rejects_literal_for_object_property(prov_schema_db) -> None:
             "insert into provenance_literal_value (lexical_value) values ('bad') returning literal_id"
         )
         literal_id = cursor.fetchone()[0]
-        with pytest.raises(psycopg2.errors.RaiseException, match="requires object_resource_id"):
+        with pytest.raises(sync_postgres.errors.RaiseException, match="requires object_resource_id"):
             cursor.execute(
                 "insert into provenance_assertion "
                 "(subject_resource_id, relation_code, object_literal_id) "
@@ -154,7 +154,7 @@ def test_database_requires_xsd_datetime_for_event_time(prov_schema_db) -> None:
             "values ('2026-08-14T04:00:00Z') returning literal_id"
         )
         literal_id = cursor.fetchone()[0]
-        with pytest.raises(psycopg2.errors.RaiseException, match="violates datatype"):
+        with pytest.raises(sync_postgres.errors.RaiseException, match="violates datatype"):
             cursor.execute(
                 "insert into provenance_assertion "
                 "(subject_resource_id, relation_code, object_literal_id) "
@@ -192,7 +192,7 @@ def test_database_rejects_invalid_xsd_datetime(prov_schema_db, lexical_value: st
             lexical_value,
             "http://www.w3.org/2001/XMLSchema#dateTime",
         )
-        with pytest.raises(psycopg2.errors.RaiseException, match="lexical xsd:dateTime"):
+        with pytest.raises(sync_postgres.errors.RaiseException, match="lexical xsd:dateTime"):
             cursor.execute(
                 "insert into provenance_assertion "
                 "(subject_resource_id, relation_code, object_literal_id) "
@@ -231,7 +231,7 @@ def test_referenced_contract_rows_are_immutable(prov_schema_db) -> None:
             "values (%s, 'prov_was_generated_by', %s)",
             (entity_id, activity_id),
         )
-        with pytest.raises(psycopg2.errors.RaiseException, match="types are immutable"):
+        with pytest.raises(sync_postgres.errors.RaiseException, match="types are immutable"):
             cursor.execute(
                 "delete from provenance_resource_type "
                 "where resource_id = %s and class_code = 'prov_activity'",
@@ -252,7 +252,7 @@ def test_referenced_contract_rows_are_immutable(prov_schema_db) -> None:
             "values (%s, 'prov_started_at_time', %s)",
             (activity_id, literal_id),
         )
-        with pytest.raises(psycopg2.errors.RaiseException, match="literal values are immutable"):
+        with pytest.raises(sync_postgres.errors.RaiseException, match="literal values are immutable"):
             cursor.execute(
                 "update provenance_literal_value set datatype_iri = null "
                 "where literal_id = %s",

From 3d4881e0409be54bd28db21bef46e3809ad12619 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:50:49 +0900
Subject: [PATCH 06/64] test: migrate analysis authorization DB fixture to
 pg8000 adapter

---
 tests/test_analysis_run_authorization.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/test_analysis_run_authorization.py b/tests/test_analysis_run_authorization.py
index 8bfe62642..5404b1723 100644
--- a/tests/test_analysis_run_authorization.py
+++ b/tests/test_analysis_run_authorization.py
@@ -7,10 +7,10 @@
 from pathlib import Path
 from urllib.parse import urlsplit, urlunsplit
 
-import psycopg2
 import pytest
-from psycopg2 import sql
 
+from lineageweave import postgres_sync as sync_postgres
+from lineageweave.postgres_sync import sql
 from backend.app.analysis_run_ingestion import (
     _COUNTS_BY_RUN_SQL,
     _RUN_DETAIL_SQL,
@@ -40,9 +40,9 @@ def test_visible_run_sql_is_parameterized_literals() -> None:
 def _postgres_available() -> bool:
     """Return whether the configured administrator DSN is reachable."""
     try:
-        psycopg2.connect(_ADMIN_DSN, connect_timeout=2).close()
+        sync_postgres.connect(_ADMIN_DSN, connect_timeout=2).close()
         return True
-    except psycopg2.OperationalError:
+    except sync_postgres.OperationalError:
         return False
 
 
@@ -58,14 +58,14 @@ def authz_db():
     if not _postgres_available():
         pytest.skip("a reachable PostgreSQL administrator DSN is required")
     database_name = f"lineageweave_authz_{uuid.uuid4().hex[:12]}"
-    admin_connection = psycopg2.connect(_ADMIN_DSN)
+    admin_connection = sync_postgres.connect(_ADMIN_DSN)
     admin_connection.autocommit = True
     with admin_connection.cursor() as cursor:
         cursor.execute(
             sql.SQL("create database {}").format(sql.Identifier(database_name))
         )
     try:
-        connection = psycopg2.connect(_database_dsn(database_name))
+        connection = sync_postgres.connect(_database_dsn(database_name))
         try:
             connection.autocommit = True
             with connection.cursor() as cursor:

From 71ca95d7045dd9df2ba4a057c9a50d1dfbf2d32b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:51:13 +0900
Subject: [PATCH 07/64] test: migrate reconstruction fixture to pg8000 adapter

---
 ...test_analysis_run_reconstruction_schema.py | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/tests/test_analysis_run_reconstruction_schema.py b/tests/test_analysis_run_reconstruction_schema.py
index 30a2b6579..a965afe8d 100644
--- a/tests/test_analysis_run_reconstruction_schema.py
+++ b/tests/test_analysis_run_reconstruction_schema.py
@@ -10,6 +10,9 @@
 
 import pytest
 
+from lineageweave import postgres_sync as sync_postgres
+from lineageweave.postgres_sync import sql
+
 _ROOT = Path(__file__).resolve().parents[1]
 _INITIAL_MIGRATION = _ROOT / "migrations" / "0001_initial_schema.sql"
 _REGISTRY_MIGRATION = _ROOT / "migrations" / "0018_analysis_run_registry.sql"
@@ -80,11 +83,9 @@ def test_reconstruction_migration_is_normalized_and_wired() -> None:
 def _postgres_available() -> bool:
     """Return whether the configured administrator DSN is reachable."""
     try:
-        import psycopg2
-
-        psycopg2.connect(_ADMIN_DSN, connect_timeout=2).close()
+        sync_postgres.connect(_ADMIN_DSN, connect_timeout=2).close()
         return True
-    except Exception:
+    except sync_postgres.OperationalError:
         return False
 
 
@@ -99,17 +100,18 @@ def reconstruction_db():
     """Yield a throwaway registry+reconstruction database."""
     if not _postgres_available():
         pytest.skip("a reachable PostgreSQL administrator DSN is required")
-    import psycopg2
 
     database_name = f"lineageweave_recon_{uuid.uuid4().hex[:12]}"
-    admin = psycopg2.connect(_ADMIN_DSN)
+    admin = sync_postgres.connect(_ADMIN_DSN)
     admin.autocommit = True
     try:
         with admin.cursor() as cursor:
-            cursor.execute(f'create database "{database_name}"')
+            cursor.execute(
+                sql.SQL("create database {}").format(sql.Identifier(database_name))
+            )
     finally:
         admin.close()
-    conn = psycopg2.connect(_database_dsn(database_name))
+    conn = sync_postgres.connect(_database_dsn(database_name))
     conn.autocommit = True
     try:
         with conn.cursor() as cursor:
@@ -120,7 +122,7 @@ def reconstruction_db():
         yield conn
     finally:
         conn.close()
-        admin = psycopg2.connect(_ADMIN_DSN)
+        admin = sync_postgres.connect(_ADMIN_DSN)
         admin.autocommit = True
         try:
             with admin.cursor() as cursor:
@@ -129,7 +131,9 @@ def reconstruction_db():
                     "where datname = %s and pid <> pg_backend_pid()",
                     (database_name,),
                 )
-                cursor.execute(f'drop database "{database_name}"')
+                cursor.execute(
+                    sql.SQL("drop database {}").format(sql.Identifier(database_name))
+                )
         finally:
             admin.close()
 

From 062cf60789cfe249a3040df064ff6ba984fa5f7b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:54:41 +0900
Subject: [PATCH 08/64] test: preserve DSN options in synthetic cleanup fixture

---
 tests/test_synthetic_seed_cleanup.py | 39 ++++++++++++++--------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/tests/test_synthetic_seed_cleanup.py b/tests/test_synthetic_seed_cleanup.py
index 6d2ab3405..20b9f5ecb 100644
--- a/tests/test_synthetic_seed_cleanup.py
+++ b/tests/test_synthetic_seed_cleanup.py
@@ -18,11 +18,13 @@
 import subprocess
 import uuid
 from pathlib import Path
+from urllib.parse import urlsplit, urlunsplit
 
 import asyncpg
-import psycopg2
 import pytest
 
+from lineageweave import postgres_sync as sync_postgres
+from lineageweave.postgres_sync import sql
 from lineageweave.synthetic_seed_cleanup import cleanup_synthetic_seed
 
 _ADMIN_DSN = os.environ.get(
@@ -33,13 +35,19 @@
 
 def _postgres_available() -> bool:
     try:
-        conn = psycopg2.connect(_ADMIN_DSN, connect_timeout=2)
+        conn = sync_postgres.connect(_ADMIN_DSN, connect_timeout=2)
         conn.close()
         return True
-    except psycopg2.OperationalError:
+    except sync_postgres.OperationalError:
         return False
 
 
+def _database_dsn(database_name: str) -> str:
+    """Replace only the database path while retaining query options."""
+    parsed = urlsplit(_ADMIN_DSN)
+    return urlunsplit(parsed._replace(path=f"/{database_name}"))
+
+
 pytestmark = pytest.mark.skipif(
     not _postgres_available(),
     reason=f"no reachable PostgreSQL server at {_ADMIN_DSN} (set LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN)",
@@ -50,17 +58,16 @@ def _postgres_available() -> bool:
 def migrated_db():
     """A freshly migrated, throwaway database, dropped afterward."""
     db_name = f"lineageweave_cleanup_test_{uuid.uuid4().hex[:12]}"
-    admin_conn = psycopg2.connect(_ADMIN_DSN)
+    admin_conn = sync_postgres.connect(_ADMIN_DSN)
     admin_conn.autocommit = True
     with admin_conn.cursor() as cur:
-        cur.execute(f'create database "{db_name}"')
+        cur.execute(sql.SQL("create database {}").format(sql.Identifier(db_name)))
     admin_conn.close()
 
-    db_dsn = _ADMIN_DSN.rsplit("/", 1)[0] + f"/{db_name}"
-    # psql, not psycopg2 cur.execute(), matches docker/postgres-init/migrate.sh:
-    # a few migrations use CREATE INDEX CONCURRENTLY, which errors under
-    # psycopg2's implicit multi-statement transaction wrapping but not under
-    # psql's one-statement-at-a-time execution of a -f file.
+    db_dsn = _database_dsn(db_name)
+    # psql, not one DB-API execute(), matches docker/postgres-init/migrate.sh:
+    # a few migrations use CREATE INDEX CONCURRENTLY, which must run outside
+    # an implicit multi-statement transaction.
     for migration in sorted(_MIGRATIONS_DIR.glob("*.sql")):
         subprocess.run(
             ["psql", "-X", "-v", "ON_ERROR_STOP=1", db_dsn, "-f", str(migration)],
@@ -69,14 +76,14 @@ def migrated_db():
 
     yield db_dsn
 
-    admin_conn = psycopg2.connect(_ADMIN_DSN)
+    admin_conn = sync_postgres.connect(_ADMIN_DSN)
     admin_conn.autocommit = True
     with admin_conn.cursor() as cur:
         cur.execute(
             "select pg_terminate_backend(pid) from pg_stat_activity where datname = %s",
             (db_name,),
         )
-        cur.execute(f'drop database "{db_name}"')
+        cur.execute(sql.SQL("drop database {}").format(sql.Identifier(db_name)))
     admin_conn.close()
 
 
@@ -122,7 +129,6 @@ async def run() -> dict[str, int]:
                 demo_pu,
             )
 
-            # The synthetic seed post: no source_* evidence at all.
             synthetic_post = await conn.fetchval(
                 "insert into source_post "
                 "(author_account_id, corporate_entity_id, process_unit_id, post_title, post_body, "
@@ -133,8 +139,6 @@ async def run() -> dict[str, int]:
                 demo_entity,
                 demo_pu,
             )
-            # A real, imported post sharing the same DEMO-CORP-01 entity (the
-            # entangled-scope shape this repo actually hit).
             real_post = await conn.fetchval(
                 "insert into source_post "
                 "(author_account_id, corporate_entity_id, process_unit_id, post_title, post_body, "
@@ -145,8 +149,6 @@ async def run() -> dict[str, int]:
                 demo_entity,
                 demo_pu,
             )
-            # A second synthetic post that an analysis run has already
-            # reconstructed over -- must be reported as blocked, never deleted.
             blocked_synthetic_post = await conn.fetchval(
                 "insert into source_post "
                 "(author_account_id, corporate_entity_id, process_unit_id, post_title, post_body, "
@@ -209,9 +211,6 @@ async def run() -> dict[str, int]:
                 blocked_synthetic_post,
             )
 
-            # The real post cites the synthetic post as internal corroborating
-            # evidence -- deleting the synthetic post must null this citation,
-            # never delete the real post's counterparty row.
             counterparty_relationship_type = await conn.fetchval(
                 "select lookup_code from common_lookup_value "
                 "where lookup_category = 'entity_relationship_type' limit 1"

From 5e64e4509a6bc8b0e70cde2b2366f489d1e16f06 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 03:59:30 +0900
Subject: [PATCH 09/64] test: cover pg8000 optional-extra collection boundary

---
 tests/test_optional_extra_collection.py | 30 +++++++++++++++++--------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/tests/test_optional_extra_collection.py b/tests/test_optional_extra_collection.py
index 252980b38..2c61e8a0c 100644
--- a/tests/test_optional_extra_collection.py
+++ b/tests/test_optional_extra_collection.py
@@ -17,8 +17,8 @@ def test_missing_optional_extra_modules_returns_absent_names() -> None:
     """Names whose find_spec is None are reported; present names are not."""
 
     def fake_find_spec(name: str) -> object | None:
-        """Model one unavailable optional module and one installed module."""
-        if name == "asyncpg":
+        """Model one unavailable optional module and installed siblings."""
+        if name == "pg8000":
             return None
         return object()
 
@@ -26,7 +26,7 @@ def fake_find_spec(name: str) -> object | None:
         "lineageweave.optional_extra_collection.importlib.util.find_spec",
         side_effect=fake_find_spec,
     ):
-        assert missing_optional_extra_modules(("asyncpg", "redis")) == ("asyncpg",)
+        assert missing_optional_extra_modules(("pg8000", "redis")) == ("pg8000",)
 
 
 def test_collection_path_does_not_skip_when_no_extras_are_missing(
@@ -57,11 +57,16 @@ def test_collection_path_skips_only_backend_tests_with_transitive_missing_import
 def test_collection_path_skips_files_that_import_a_missing_extra(
     tmp_path: Path,
 ) -> None:
-    """A test that imports fast_mlsirm is ignored only when that extra is absent."""
-    path = tmp_path / "test_post_evaluation.py"
-    path.write_text("from fast_mlsirm import LLMJudgeResult\n", encoding="utf-8")
-    assert collection_path_requires_missing_extras(path, ("fast_mlsirm",)) is True
-    assert collection_path_requires_missing_extras(path, ("asyncpg",)) is False
+    """Direct optional imports are skipped only when that exact module is absent."""
+    psychometrics = tmp_path / "test_post_evaluation.py"
+    psychometrics.write_text("from fast_mlsirm import LLMJudgeResult\n", encoding="utf-8")
+    assert collection_path_requires_missing_extras(psychometrics, ("fast_mlsirm",)) is True
+    assert collection_path_requires_missing_extras(psychometrics, ("asyncpg",)) is False
+
+    postgres = tmp_path / "test_postgres_sync.py"
+    postgres.write_text("import pg8000.dbapi\n", encoding="utf-8")
+    assert collection_path_requires_missing_extras(postgres, ("pg8000",)) is True
+    assert collection_path_requires_missing_extras(postgres, ("asyncpg",)) is False
 
 
 def test_collection_path_does_not_match_comments_or_import_prefixes(
@@ -121,11 +126,18 @@ def test_collection_path_skips_known_transitive_optional_importers(
     seed.write_text("from scripts.seed_demo_data import seed\n", encoding="utf-8")
     assert collection_path_requires_missing_extras(seed, ("redis",)) is False
 
+    sync_postgres = tmp_path / "test_sync_postgres.py"
+    sync_postgres.write_text(
+        "from lineageweave.postgres_sync import connect\n",
+        encoding="utf-8",
+    )
+    assert collection_path_requires_missing_extras(sync_postgres, ("pg8000",)) is True
+
 
 def test_helper_test_module_is_never_ignored(tmp_path: Path) -> None:
     """The collection-helper tests must run in the sandbox that lacks extras."""
     path = tmp_path / "test_optional_extra_collection.py"
-    path.write_text("import asyncpg\n", encoding="utf-8")
+    path.write_text("import pg8000\n", encoding="utf-8")
     assert collection_path_requires_missing_extras(path, OPTIONAL_EXTRA_MODULES) is False
 
 

From a6bca54e009937a6f437617d34449482e515589a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:02:04 +0900
Subject: [PATCH 10/64] test: migrate Voice history DB contract to pg8000
 adapter

---
 tests/test_source_post_voice_history_live.py | 30 +++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/tests/test_source_post_voice_history_live.py b/tests/test_source_post_voice_history_live.py
index 4ae774d2e..bfe9d6fe9 100644
--- a/tests/test_source_post_voice_history_live.py
+++ b/tests/test_source_post_voice_history_live.py
@@ -15,10 +15,11 @@
 from pathlib import Path
 from urllib.parse import urlsplit, urlunsplit
 
-import psycopg2
-import psycopg2.errors
 import pytest
 
+from lineageweave import postgres_sync as sync_postgres
+from lineageweave.postgres_sync import sql
+
 _ADMIN_DSN = os.environ.get(
     "LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN", "postgresql://localhost/postgres"
 )
@@ -56,10 +57,10 @@
 
 def _postgres_available() -> bool:
     try:
-        conn = psycopg2.connect(_ADMIN_DSN, connect_timeout=2)
+        conn = sync_postgres.connect(_ADMIN_DSN, connect_timeout=2)
         conn.close()
         return True
-    except psycopg2.OperationalError:
+    except sync_postgres.OperationalError:
         return False
 
 
@@ -92,17 +93,19 @@ def _apply_migrations(database_dsn: str) -> None:
 def voice_history_dsn():
     """Throwaway database with the full product schema, dropped afterward."""
     database_name = f"lineageweave_voice_hist_{uuid.uuid4().hex[:12]}"
-    admin_conn = psycopg2.connect(_ADMIN_DSN)
+    admin_conn = sync_postgres.connect(_ADMIN_DSN)
     admin_conn.autocommit = True
     with admin_conn.cursor() as cursor:
-        cursor.execute(f'create database "{database_name}"')
+        cursor.execute(
+            sql.SQL("create database {}").format(sql.Identifier(database_name))
+        )
     admin_conn.close()
     database_dsn = _database_dsn(database_name)
     try:
         _apply_migrations(database_dsn)
         yield database_dsn
     finally:
-        admin_conn = psycopg2.connect(_ADMIN_DSN)
+        admin_conn = sync_postgres.connect(_ADMIN_DSN)
         admin_conn.autocommit = True
         with admin_conn.cursor() as cursor:
             cursor.execute(
@@ -110,12 +113,14 @@ def voice_history_dsn():
                 "where datname = %s and pid <> pg_backend_pid()",
                 (database_name,),
             )
-            cursor.execute(f'drop database "{database_name}"')
+            cursor.execute(
+                sql.SQL("drop database {}").format(sql.Identifier(database_name))
+            )
         admin_conn.close()
 
 
 def _connect(database_dsn: str):
-    connection = psycopg2.connect(database_dsn)
+    connection = sync_postgres.connect(database_dsn)
     connection.autocommit = True
     return connection
 
@@ -403,7 +408,10 @@ def test_gist_exclusion_rejects_overlapping_primary_intervals(
             )
             opened_at = cursor.fetchone()[0]
             with pytest.raises(
-                (psycopg2.errors.ExclusionViolation, psycopg2.errors.RaiseException)
+                (
+                    sync_postgres.errors.ExclusionViolation,
+                    sync_postgres.errors.RaiseException,
+                )
             ):
                 cursor.execute(
                     """
@@ -433,7 +441,7 @@ def test_concurrent_primary_updates_serialize_non_overlapping_history(
     errors: list[Exception] = []
 
     def _update(next_code: str) -> None:
-        connection = psycopg2.connect(voice_history_dsn)
+        connection = sync_postgres.connect(voice_history_dsn)
         try:
             barrier.wait(timeout=10)
             with connection.cursor() as cursor:

From c612f463659a8552308959b79c38efbf60539ead Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:03:29 +0900
Subject: [PATCH 11/64] test: require SQLSTATE parity for migrated schema
 fixtures

---
 tests/test_postgres_sync_driver_contract.py | 33 +++++++++++++++++++--
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index b550ded96..a0f510cb5 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -1,9 +1,10 @@
 """Commercial-license and compatibility contract for synchronous PostgreSQL tooling.
 
 LineageWeave's runtime uses asyncpg, but seed/admin/schema tooling still needs a
-small synchronous DB-API boundary.  This contract prevents that boundary from
+small synchronous DB-API boundary. This contract prevents that boundary from
 silently reintroducing the former psycopg2-binary dependency and locks the
-behaviour that generated database/role identifiers and PostgreSQL DSNs rely on.
+behaviour that generated database/role identifiers, PostgreSQL DSNs, and
+constraint/security assertions rely on.
 """
 
 from __future__ import annotations
@@ -13,7 +14,13 @@
 
 import pytest
 
-from lineageweave.postgres_sync import connection_kwargs_from_dsn, sql
+from lineageweave.postgres_sync import (
+    DatabaseError,
+    _translated_error,
+    connection_kwargs_from_dsn,
+    errors,
+    sql,
+)
 
 
 _REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
@@ -71,3 +78,23 @@ def test_unknown_dsn_query_option_fails_closed() -> None:
         connection_kwargs_from_dsn(
             "postgresql://alice:secret@db.example/archive?target_session_attrs=read-write"
         )
+
+
+@pytest.mark.parametrize(
+    ("sqlstate", "expected_type"),
+    (
+        ("23502", errors.NotNullViolation),
+        ("23505", errors.UniqueViolation),
+        ("23514", errors.CheckViolation),
+        ("23P01", errors.ExclusionViolation),
+        ("42501", errors.InsufficientPrivilege),
+        ("P0001", errors.RaiseException),
+    ),
+)
+def test_schema_fixture_sqlstates_keep_typed_error_contract(
+    sqlstate: str,
+    expected_type: type[BaseException],
+) -> None:
+    """Migrated tests still distinguish integrity, privilege, and trigger failures."""
+    translated = _translated_error(DatabaseError({"C": sqlstate, "M": "synthetic"}))
+    assert isinstance(translated, expected_type)

From a23de60dcaba182ed40dc9a282fb762c9caaa656 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:04:14 +0900
Subject: [PATCH 12/64] fix: preserve SQLSTATE error semantics across pg8000
 migration

---
 lineageweave/postgres_sync.py | 32 ++++++++++++++++++++++++++------
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 7fd49eec5..071a830f5 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -1,15 +1,17 @@
 """Synchronous PostgreSQL adapter for admin, seed, and schema tooling.
 
-The application runtime uses ``asyncpg``.  A few administrative and integration
+The application runtime uses ``asyncpg``. A few administrative and integration
 paths still need a blocking DB-API connection, chiefly to create ephemeral test
-databases and to run the synthetic seed.  This module keeps that secondary
+databases and to run the synthetic seed. This module keeps that secondary
 boundary provider-specific in one place and deliberately exposes only the
 behaviour LineageWeave needs.
 
 Connection URIs are parsed explicitly because pg8000 accepts keyword arguments
-rather than libpq DSN strings.  Unsupported query options fail closed instead
-of disappearing during the driver migration.  Generated SQL identifiers are
-quoted locally; values must continue to use DB-API parameters.
+rather than libpq DSN strings. Unsupported query options fail closed instead
+of disappearing during the driver migration. Generated SQL identifiers are
+quoted locally; values must continue to use DB-API parameters. Server errors
+used as executable schema/security contracts are translated by SQLSTATE so the
+tests retain their semantic assertions without depending on a driver taxonomy.
 """
 
 from __future__ import annotations
@@ -31,6 +33,14 @@ class OperationalError(_dbapi.InterfaceError):
     """Connection/setup error used by reachability probes."""
 
 
+class NotNullViolation(DatabaseError):
+    """PostgreSQL SQLSTATE 23502: a mandatory column was omitted or nulled."""
+
+
+class UniqueViolation(DatabaseError):
+    """PostgreSQL SQLSTATE 23505: a uniqueness constraint rejected the statement."""
+
+
 class CheckViolation(DatabaseError):
     """PostgreSQL SQLSTATE 23514: a CHECK constraint rejected the statement."""
 
@@ -39,13 +49,20 @@ class ExclusionViolation(DatabaseError):
     """PostgreSQL SQLSTATE 23P01: an exclusion constraint rejected the statement."""
 
 
+class InsufficientPrivilege(DatabaseError):
+    """PostgreSQL SQLSTATE 42501: the current role lacks the required privilege."""
+
+
 class RaiseException(DatabaseError):
     """PostgreSQL SQLSTATE P0001: server-side ``RAISE EXCEPTION``."""
 
 
 errors = SimpleNamespace(
+    NotNullViolation=NotNullViolation,
+    UniqueViolation=UniqueViolation,
     CheckViolation=CheckViolation,
     ExclusionViolation=ExclusionViolation,
+    InsufficientPrivilege=InsufficientPrivilege,
     RaiseException=RaiseException,
 )
 
@@ -101,7 +118,7 @@ def connection_kwargs_from_dsn(
     """Translate one PostgreSQL URI into explicit pg8000 connection arguments.
 
     ``connect_timeout`` passed by the caller takes precedence over the URI's
-    ``connect_timeout`` query value, matching the old call sites.  Query
+    ``connect_timeout`` query value, matching the old call sites. Query
     options are allow-listed because silently discarding a libpq option could
     weaken transport security or alter session semantics.
     """
@@ -167,8 +184,11 @@ def _sqlstate(error: BaseException) -> str | None:
 def _translated_error(error: BaseException) -> BaseException:
     state = _sqlstate(error)
     translated_type = {
+        "23502": NotNullViolation,
+        "23505": UniqueViolation,
         "23514": CheckViolation,
         "23P01": ExclusionViolation,
+        "42501": InsufficientPrivilege,
         "P0001": RaiseException,
     }.get(state)
     if translated_type is None:

From da64b7c31296ca785c0040ceebcb4e62bbd6b834 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:47:07 +0900
Subject: [PATCH 13/64] test(postgres): reject duplicate DSN options

---
 tests/test_postgres_sync_driver_contract.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index a0f510cb5..136325788 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -80,6 +80,14 @@ def test_unknown_dsn_query_option_fails_closed() -> None:
         )
 
 
+def test_duplicate_dsn_query_option_fails_closed() -> None:
+    """Conflicting duplicate options must not be collapsed by query parsing."""
+    with pytest.raises(ValueError, match="duplicate PostgreSQL DSN option: sslmode"):
+        connection_kwargs_from_dsn(
+            "postgresql://alice:secret@db.example/archive?sslmode=require&sslmode=disable"
+        )
+
+
 @pytest.mark.parametrize(
     ("sqlstate", "expected_type"),
     (

From 2b7dde418c6c6556e5fc25f5440cb18baa5d1067 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:47:44 +0900
Subject: [PATCH 14/64] fix(postgres): reject duplicate DSN options

---
 lineageweave/postgres_sync.py | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 071a830f5..232aa334a 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -120,7 +120,9 @@ def connection_kwargs_from_dsn(
     ``connect_timeout`` passed by the caller takes precedence over the URI's
     ``connect_timeout`` query value, matching the old call sites. Query
     options are allow-listed because silently discarding a libpq option could
-    weaken transport security or alter session semantics.
+    weaken transport security or alter session semantics. Duplicate options
+    are rejected because collapsing conflicting values would make the selected
+    connection policy depend on parser ordering rather than explicit intent.
     """
 
     parsed = urlsplit(dsn)
@@ -141,7 +143,13 @@ def connection_kwargs_from_dsn(
         kwargs["password"] = unquote(parsed.password)
 
     startup_params: dict[str, str] = {}
-    query = dict(parse_qsl(parsed.query, keep_blank_values=True))
+    query_items = parse_qsl(parsed.query, keep_blank_values=True)
+    seen_query_options: set[str] = set()
+    for option_name, _ in query_items:
+        if option_name in seen_query_options:
+            raise ValueError(f"duplicate PostgreSQL DSN option: {option_name}")
+        seen_query_options.add(option_name)
+    query = dict(query_items)
     supported = {"connect_timeout", "application_name", "sslmode", "options"}
     unknown = sorted(set(query) - supported)
     if unknown:

From 74433b6e6310fd0e69faa002bbc0b76a8cd9b223 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:48:30 +0900
Subject: [PATCH 15/64] test(postgres): reject raw SQL interpolation

---
 tests/test_postgres_sync_driver_contract.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 136325788..399fa13e2 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -55,6 +55,12 @@ def test_generated_identifier_quoting_is_postgresql_safe() -> None:
     assert statement == 'create database "tenant""archive"'
 
 
+def test_generated_sql_rejects_raw_interpolation() -> None:
+    """Dynamic SQL fragments must use an explicit safe composable wrapper."""
+    with pytest.raises(TypeError, match="SQL interpolation requires"):
+        sql.SQL("create database {}").format('tenant"; drop database archive; --')
+
+
 def test_dsn_query_options_are_mapped_without_silent_loss() -> None:
     """Supported libpq-style DSN options survive the pg8000 adapter boundary."""
     kwargs = connection_kwargs_from_dsn(

From 5c2dbf8fc40e397ad10ac11d8e1f7af1c13ace31 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:49:23 +0900
Subject: [PATCH 16/64] fix(postgres): restrict SQL interpolation

---
 lineageweave/postgres_sync.py | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 232aa334a..1d08be2c7 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -83,10 +83,24 @@ def __str__(self) -> str:
         return _quote_identifier(self.value)
 
 
+def _render_sql_composable(value: object) -> str:
+    """Render only the adapter's explicitly safe dynamic SQL fragment types.
+
+    Raw strings are rejected because accepting them would turn ``SQL.format``
+    into an injection-capable text interpolation API. Callers must wrap dynamic
+    database and role names with ``Identifier``; static SQL fragments may use
+    ``SQL`` explicitly.
+    """
+
+    if isinstance(value, (_Identifier, _SQL)):
+        return str(value)
+    raise TypeError("SQL interpolation requires sql.Identifier or sql.SQL")
+
+
 class _SQL(str):
     def format(self, *args: object, **kwargs: object) -> str:
-        positional = tuple(str(value) for value in args)
-        named = {key: str(value) for key, value in kwargs.items()}
+        positional = tuple(_render_sql_composable(value) for value in args)
+        named = {key: _render_sql_composable(value) for key, value in kwargs.items()}
         return str(self).format(*positional, **named)
 
 

From 0ebbd6608b0ee867acad968a2befa85c45476bb4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 04:56:17 +0900
Subject: [PATCH 17/64] test(lock): require PostgreSQL driver lock convergence

---
 tests/test_postgres_sync_driver_contract.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 399fa13e2..c0fedfd3b 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -49,6 +49,14 @@ def test_sync_postgres_driver_is_not_psycopg2() -> None:
     assert offenders == []
 
 
+def test_lockfile_matches_synchronous_postgres_driver_contract() -> None:
+    """The reproducible environment must resolve the same driver as pyproject."""
+    lockfile = (_REPOSITORY_ROOT / "uv.lock").read_text(encoding="utf-8")
+    assert 'name = "psycopg2"' not in lockfile
+    assert 'name = "psycopg2-binary"' not in lockfile
+    assert 'name = "pg8000"' in lockfile
+
+
 def test_generated_identifier_quoting_is_postgresql_safe() -> None:
     """Generated database and role names stay identifiers, never SQL text."""
     statement = sql.SQL("create database {}").format(sql.Identifier('tenant"archive'))

From a30cedb3b3a3f7a1b00eecb16e8d7803612af18b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 05:18:20 +0900
Subject: [PATCH 18/64] test(postgres): preserve connection failure contract

---
 tests/test_postgres_sync_driver_contract.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index c0fedfd3b..a2589a8d0 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -16,7 +16,9 @@
 
 from lineageweave.postgres_sync import (
     DatabaseError,
+    OperationalError,
     _translated_error,
+    connect,
     connection_kwargs_from_dsn,
     errors,
     sql,
@@ -102,6 +104,22 @@ def test_duplicate_dsn_query_option_fails_closed() -> None:
         )
 
 
+def test_connect_translates_server_startup_failure_to_operational_error(monkeypatch) -> None:
+    """Server-side startup refusal must preserve the old reachability-probe contract."""
+    failure = DatabaseError({"C": "28P01", "M": "password authentication failed"})
+
+    def fail_connect(**_: object) -> None:
+        raise failure
+
+    monkeypatch.setattr("lineageweave.postgres_sync._dbapi.connect", fail_connect)
+
+    with pytest.raises(OperationalError) as raised:
+        connect("postgresql://alice:secret@db.example/archive")
+
+    assert raised.value.args == failure.args
+    assert raised.value.__cause__ is failure
+
+
 @pytest.mark.parametrize(
     ("sqlstate", "expected_type"),
     (

From 1763fbe63a1abec9fc1498e9833758f8a2e61e68 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 05:19:07 +0900
Subject: [PATCH 19/64] fix(postgres): classify startup refusals as operational

---
 lineageweave/postgres_sync.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 1d08be2c7..ce0ad1373 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -284,10 +284,16 @@ def __exit__(self, exc_type: object, exc: object, traceback: object) -> object:
 
 
 def connect(dsn: str, *, connect_timeout: float | int | None = None) -> Connection:
-    """Open the repository's synchronous pg8000 connection boundary."""
+    """Open the repository's synchronous pg8000 connection boundary.
+
+    pg8000 reports transport failures as ``InterfaceError`` and PostgreSQL
+    startup refusals such as authentication/database errors as ``DatabaseError``.
+    Both occur before a connection exists and therefore preserve the historical
+    ``OperationalError`` contract used by reachability probes.
+    """
 
     kwargs = connection_kwargs_from_dsn(dsn, connect_timeout=connect_timeout)
     try:
         return Connection(_dbapi.connect(**kwargs))
-    except _dbapi.InterfaceError as exc:
+    except (_dbapi.InterfaceError, _dbapi.DatabaseError) as exc:
         raise OperationalError(*getattr(exc, "args", ())) from exc

From c4f88302a4b8e889f7e29a4ca6220c09791aff7f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 05:21:53 +0900
Subject: [PATCH 20/64] test(postgres): preserve libpq default user semantics

---
 tests/test_postgres_sync_driver_contract.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index a2589a8d0..76a184a42 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -88,6 +88,17 @@ def test_dsn_query_options_are_mapped_without_silent_loss() -> None:
     assert kwargs["ssl_context"] is False
 
 
+def test_dsn_without_user_preserves_libpq_os_user_default(monkeypatch) -> None:
+    """Existing admin DSNs without a username still use the local OS account."""
+    monkeypatch.setattr("lineageweave.postgres_sync.getpass.getuser", lambda: "ci-runner")
+
+    kwargs = connection_kwargs_from_dsn("postgresql://localhost/postgres")
+
+    assert kwargs["user"] == "ci-runner"
+    assert kwargs["host"] == "localhost"
+    assert kwargs["database"] == "postgres"
+
+
 def test_unknown_dsn_query_option_fails_closed() -> None:
     """A connection option must never disappear merely because drivers differ."""
     with pytest.raises(ValueError, match="unsupported PostgreSQL DSN option"):

From 6e9fffd1426be28802432ba96b5312de076bb4ba Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 05:22:31 +0900
Subject: [PATCH 21/64] fix(postgres): retain default OS user for admin DSNs

---
 lineageweave/postgres_sync.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index ce0ad1373..2599755c9 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -16,6 +16,7 @@
 
 from __future__ import annotations
 
+import getpass
 import ssl
 from dataclasses import dataclass
 from types import SimpleNamespace
@@ -137,18 +138,25 @@ def connection_kwargs_from_dsn(
     weaken transport security or alter session semantics. Duplicate options
     are rejected because collapsing conflicting values would make the selected
     connection policy depend on parser ordering rather than explicit intent.
+
+    Libpq-style URIs may omit the username and then use the operating-system
+    account. Several repository PostgreSQL test fixtures rely on that default,
+    so the adapter resolves it explicitly before entering pg8000's required
+    ``user`` argument rather than changing fixture connection semantics.
     """
 
     parsed = urlsplit(dsn)
     if parsed.scheme not in {"postgres", "postgresql"}:
         raise ValueError("PostgreSQL DSN must use postgres:// or postgresql://")
-    if parsed.username is None:
-        raise ValueError("PostgreSQL DSN must include a user")
     if not parsed.path or parsed.path == "/":
         raise ValueError("PostgreSQL DSN must include a database name")
 
+    user = unquote(parsed.username) if parsed.username is not None else getpass.getuser()
+    if not user:
+        raise ValueError("PostgreSQL user could not be resolved")
+
     kwargs: dict[str, Any] = {
-        "user": unquote(parsed.username),
+        "user": user,
         "host": parsed.hostname or "localhost",
         "port": parsed.port or 5432,
         "database": unquote(parsed.path.lstrip("/")),

From 70554ce14e6eaaa39540713a399e17d03b0a0814 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 05:24:46 +0900
Subject: [PATCH 22/64] test(collection): detect package-imported postgres
 adapter

---
 tests/test_optional_extra_collection.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/test_optional_extra_collection.py b/tests/test_optional_extra_collection.py
index 2c61e8a0c..772f3cc2e 100644
--- a/tests/test_optional_extra_collection.py
+++ b/tests/test_optional_extra_collection.py
@@ -134,6 +134,17 @@ def test_collection_path_skips_known_transitive_optional_importers(
     assert collection_path_requires_missing_extras(sync_postgres, ("pg8000",)) is True
 
 
+def test_collection_path_tracks_submodule_imported_from_package(tmp_path: Path) -> None:
+    """Package-style submodule imports still expose their transitive optional driver."""
+    sync_postgres = tmp_path / "test_sync_postgres_package_import.py"
+    sync_postgres.write_text(
+        "from lineageweave import postgres_sync as sync_postgres\n",
+        encoding="utf-8",
+    )
+
+    assert collection_path_requires_missing_extras(sync_postgres, ("pg8000",)) is True
+
+
 def test_helper_test_module_is_never_ignored(tmp_path: Path) -> None:
     """The collection-helper tests must run in the sandbox that lacks extras."""
     path = tmp_path / "test_optional_extra_collection.py"

From 81e1b017c6fa51cceb37bb1d2438d55fbf127a09 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 05:25:05 +0900
Subject: [PATCH 23/64] fix(collection): traverse imported local submodules

---
 lineageweave/optional_extra_collection.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/lineageweave/optional_extra_collection.py b/lineageweave/optional_extra_collection.py
index 3be38a1bf..5d5bda122 100644
--- a/lineageweave/optional_extra_collection.py
+++ b/lineageweave/optional_extra_collection.py
@@ -28,7 +28,14 @@
 
 
 def _imported_module_names(source: str) -> frozenset[str]:
-    """Return exact top-level module paths from syntactically valid imports."""
+    """Return exact top-level module paths from syntactically valid imports.
+
+    For ``from package import submodule`` both the package and candidate
+    submodule path are retained. The local-source resolver later decides
+    whether that candidate is a real repository module, which lets collection
+    tracing follow imports such as ``from lineageweave import postgres_sync``
+    without mistaking ordinary imported attributes for modules.
+    """
     try:
         tree = ast.parse(source)
     except (SyntaxError, ValueError):
@@ -39,6 +46,12 @@ def _imported_module_names(source: str) -> frozenset[str]:
             imported.update(alias.name for alias in node.names)
         elif isinstance(node, ast.ImportFrom) and node.module:
             imported.add(node.module)
+            if node.level == 0:
+                imported.update(
+                    f"{node.module}.{alias.name}"
+                    for alias in node.names
+                    if alias.name != "*"
+                )
     return frozenset(imported)
 
 

From ea3de30eccf2e7e9bb8f5a0ed9e4efa216e62e14 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:18:01 +0900
Subject: [PATCH 24/64] test(postgres): reject silently discarded DSN fragments

---
 tests/test_postgres_sync_driver_contract.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 76a184a42..4d83d2802 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -107,6 +107,14 @@ def test_unknown_dsn_query_option_fails_closed() -> None:
         )
 
 
+def test_dsn_fragment_fails_closed_instead_of_being_silently_discarded() -> None:
+    """URI fragments are outside libpq's connection grammar and must not disappear."""
+    with pytest.raises(ValueError, match="must not include a fragment"):
+        connection_kwargs_from_dsn(
+            "postgresql://alice:secret@db.example/archive#sslmode=require"
+        )
+
+
 def test_duplicate_dsn_query_option_fails_closed() -> None:
     """Conflicting duplicate options must not be collapsed by query parsing."""
     with pytest.raises(ValueError, match="duplicate PostgreSQL DSN option: sslmode"):

From e70d7ad8d3547d9ab9ae275ee4b9d7a6284cea76 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:18:31 +0900
Subject: [PATCH 25/64] fix(postgres): reject unsupported DSN fragments

---
 lineageweave/postgres_sync.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 2599755c9..1880c337f 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -148,6 +148,8 @@ def connection_kwargs_from_dsn(
     parsed = urlsplit(dsn)
     if parsed.scheme not in {"postgres", "postgresql"}:
         raise ValueError("PostgreSQL DSN must use postgres:// or postgresql://")
+    if parsed.fragment:
+        raise ValueError("PostgreSQL DSN must not include a fragment")
     if not parsed.path or parsed.path == "/":
         raise ValueError("PostgreSQL DSN must include a database name")
 

From ba197bfd06f9ee44b234cebda0d5d691c6424f18 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:20:23 +0900
Subject: [PATCH 26/64] test(ci): preserve resolver candidate for stale uv lock

---
 tests/test_postgres_sync_driver_contract.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 4d83d2802..a7089212e 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -27,6 +27,7 @@
 
 _REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
 _FORBIDDEN_IMPORT = re.compile(r"(?m)^\s*(?:import\s+psycopg2\b|from\s+psycopg2\b)")
+_UPLOAD_ARTIFACT_SHA = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
 
 
 def test_sync_postgres_driver_is_not_psycopg2() -> None:
@@ -59,6 +60,20 @@ def test_lockfile_matches_synchronous_postgres_driver_contract() -> None:
     assert 'name = "pg8000"' in lockfile
 
 
+def test_ci_preserves_resolver_output_when_committed_lock_is_stale() -> None:
+    """A stale frozen lock must fail closed while preserving the resolver candidate."""
+    workflow = (_REPOSITORY_ROOT / ".github" / "workflows" / "tests.yml").read_text(
+        encoding="utf-8"
+    )
+
+    lock_check = workflow.index("uv lock --check")
+    frozen_sync = workflow.index("uv sync --frozen --extra dev --extra backend")
+    assert lock_check < frozen_sync
+    assert f"actions/upload-artifact@{_UPLOAD_ARTIFACT_SHA}" in workflow
+    assert "uv-lock-candidate-${{ github.sha }}" in workflow
+    assert "if-no-files-found: error" in workflow
+
+
 def test_generated_identifier_quoting_is_postgresql_safe() -> None:
     """Generated database and role names stay identifiers, never SQL text."""
     statement = sql.SQL("create database {}").format(sql.Identifier('tenant"archive'))

From 86c1cb05f9a9bea2c16605205c0c5cf5eae04945 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:20:57 +0900
Subject: [PATCH 27/64] ci: preserve resolver output for stale dependency locks

---
 .github/workflows/tests.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 648b5e090..4e23495a1 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -52,6 +52,28 @@ jobs:
           version: "0.11.28"
           enable-cache: false
 
+      - name: Verify committed universal lock
+        id: lock
+        shell: bash
+        run: |
+          set -u
+          if uv lock --check; then
+            echo "stale=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          uv lock
+          echo "stale=true" >> "$GITHUB_OUTPUT"
+          exit 1
+
+      - name: Preserve resolver-generated lock candidate
+        if: failure() && steps.lock.outputs.stale == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: uv-lock-candidate-${{ github.sha }}
+          path: uv.lock
+          if-no-files-found: error
+          retention-days: 1
+
       - name: Select pinned Rust toolchain
         run: |
           rustup toolchain install 1.97.1 --profile minimal

From 9c1bdee264aa81a4bf37c76afa5de24272ad16b2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:22:33 +0900
Subject: [PATCH 28/64] test(postgres): reject non-finite connection deadlines

---
 tests/test_postgres_sync_driver_contract.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index a7089212e..ac57049b4 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -103,6 +103,15 @@ def test_dsn_query_options_are_mapped_without_silent_loss() -> None:
     assert kwargs["ssl_context"] is False
 
 
+@pytest.mark.parametrize("timeout_value", ("nan", "inf", "-inf"))
+def test_dsn_connect_timeout_must_be_finite(timeout_value: str) -> None:
+    """Non-finite timeouts must not disable or destabilize the network deadline."""
+    with pytest.raises(ValueError, match="finite positive"):
+        connection_kwargs_from_dsn(
+            f"postgresql://alice:secret@db.example/archive?connect_timeout={timeout_value}"
+        )
+
+
 def test_dsn_without_user_preserves_libpq_os_user_default(monkeypatch) -> None:
     """Existing admin DSNs without a username still use the local OS account."""
     monkeypatch.setattr("lineageweave.postgres_sync.getpass.getuser", lambda: "ci-runner")

From fa7feeba741b39a789578a50208b82bfa74e2218 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:23:21 +0900
Subject: [PATCH 29/64] fix(postgres): bound connection deadlines to finite
 values

---
 lineageweave/postgres_sync.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 1880c337f..8e0da271d 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -17,6 +17,7 @@
 from __future__ import annotations
 
 import getpass
+import math
 import ssl
 from dataclasses import dataclass
 from types import SimpleNamespace
@@ -187,8 +188,8 @@ def connection_kwargs_from_dsn(
             raise ValueError("PostgreSQL connect_timeout must be numeric") from exc
     if timeout_value is not None:
         timeout = float(timeout_value)
-        if timeout <= 0:
-            raise ValueError("PostgreSQL connect_timeout must be positive")
+        if not math.isfinite(timeout) or timeout <= 0:
+            raise ValueError("PostgreSQL connect_timeout must be finite positive")
         kwargs["timeout"] = timeout
 
     if "application_name" in query:

From debbcac9ade9a72f329339e93daab387f0c3ef51 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:28:21 +0900
Subject: [PATCH 30/64] test(postgres): reject boolean connection deadlines

---
 tests/test_postgres_sync_driver_contract.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index ac57049b4..78549cfff 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -112,6 +112,15 @@ def test_dsn_connect_timeout_must_be_finite(timeout_value: str) -> None:
         )
 
 
+def test_explicit_connect_timeout_rejects_boolean_values() -> None:
+    """Boolean values must not become accidental one-second network deadlines."""
+    with pytest.raises(TypeError, match="real number"):
+        connection_kwargs_from_dsn(
+            "postgresql://alice:secret@db.example/archive",
+            connect_timeout=True,
+        )
+
+
 def test_dsn_without_user_preserves_libpq_os_user_default(monkeypatch) -> None:
     """Existing admin DSNs without a username still use the local OS account."""
     monkeypatch.setattr("lineageweave.postgres_sync.getpass.getuser", lambda: "ci-runner")

From 99bdd0e9aff27f6ca876d2fa05c94926f729b5b7 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:28:59 +0900
Subject: [PATCH 31/64] fix(postgres): require numeric connection deadlines

---
 lineageweave/postgres_sync.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 8e0da271d..4cecce985 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -187,6 +187,8 @@ def connection_kwargs_from_dsn(
         except ValueError as exc:
             raise ValueError("PostgreSQL connect_timeout must be numeric") from exc
     if timeout_value is not None:
+        if isinstance(timeout_value, bool):
+            raise TypeError("PostgreSQL connect_timeout must be a real number")
         timeout = float(timeout_value)
         if not math.isfinite(timeout) or timeout <= 0:
             raise ValueError("PostgreSQL connect_timeout must be finite positive")

From 1d239978c79320719584f0cda2a33829d644cdde Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:33:33 +0900
Subject: [PATCH 32/64] test(ci): reject invalid resolver-candidate publication

---
 tests/test_postgres_sync_driver_contract.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 78549cfff..df8ae0788 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -61,7 +61,7 @@ def test_lockfile_matches_synchronous_postgres_driver_contract() -> None:
 
 
 def test_ci_preserves_resolver_output_when_committed_lock_is_stale() -> None:
-    """A stale frozen lock must fail closed while preserving the resolver candidate."""
+    """A stale frozen lock must fail closed while preserving a valid resolver candidate."""
     workflow = (_REPOSITORY_ROOT / ".github" / "workflows" / "tests.yml").read_text(
         encoding="utf-8"
     )
@@ -69,6 +69,7 @@ def test_ci_preserves_resolver_output_when_committed_lock_is_stale() -> None:
     lock_check = workflow.index("uv lock --check")
     frozen_sync = workflow.index("uv sync --frozen --extra dev --extra backend")
     assert lock_check < frozen_sync
+    assert "set -euo pipefail" in workflow
     assert f"actions/upload-artifact@{_UPLOAD_ARTIFACT_SHA}" in workflow
     assert "uv-lock-candidate-${{ github.sha }}" in workflow
     assert "if-no-files-found: error" in workflow

From 777703591b0ba6f02c02c9f8d1caa5bf4c54cfb3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:34:34 +0900
Subject: [PATCH 33/64] ci: fail closed when lock resolution fails

---
 .github/workflows/tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 4e23495a1..efe5b9d43 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -56,7 +56,7 @@ jobs:
         id: lock
         shell: bash
         run: |
-          set -u
+          set -euo pipefail
           if uv lock --check; then
             echo "stale=false" >> "$GITHUB_OUTPUT"
             exit 0

From b6709c982f4b9e1bb8b45820d6c0bdb0edae882f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:47:40 +0900
Subject: [PATCH 34/64] test(postgres): reject explicit zero DSN port

---
 tests/test_postgres_sync_driver_contract.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index df8ae0788..0c4adf4db 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -104,6 +104,14 @@ def test_dsn_query_options_are_mapped_without_silent_loss() -> None:
     assert kwargs["ssl_context"] is False
 
 
+def test_explicit_zero_dsn_port_fails_closed() -> None:
+    """An explicit port zero must not silently become PostgreSQL's default port."""
+    with pytest.raises(ValueError, match="port"):
+        connection_kwargs_from_dsn(
+            "postgresql://alice:secret@db.example:0/archive"
+        )
+
+
 @pytest.mark.parametrize("timeout_value", ("nan", "inf", "-inf"))
 def test_dsn_connect_timeout_must_be_finite(timeout_value: str) -> None:
     """Non-finite timeouts must not disable or destabilize the network deadline."""

From c894ac2fc829a86de2612ff5a155e38f2b288ce3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:48:23 +0900
Subject: [PATCH 35/64] fix(postgres): fail closed on invalid DSN ports

---
 lineageweave/postgres_sync.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 4cecce985..85a9eff04 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -158,10 +158,17 @@ def connection_kwargs_from_dsn(
     if not user:
         raise ValueError("PostgreSQL user could not be resolved")
 
+    try:
+        port = parsed.port
+    except ValueError as exc:
+        raise ValueError("PostgreSQL port must be between 1 and 65535") from exc
+    if port is not None and not 1 <= port <= 65535:
+        raise ValueError("PostgreSQL port must be between 1 and 65535")
+
     kwargs: dict[str, Any] = {
         "user": user,
         "host": parsed.hostname or "localhost",
-        "port": parsed.port or 5432,
+        "port": 5432 if port is None else port,
         "database": unquote(parsed.path.lstrip("/")),
     }
     if parsed.password is not None:

From f0d7c225f7bc122159b910cb304f64dd6a8a57be Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:55:57 +0900
Subject: [PATCH 36/64] test(postgres): reject hostless DSN transport switch

---
 tests/test_postgres_sync_driver_contract.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 0c4adf4db..9c5a23e01 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -112,6 +112,12 @@ def test_explicit_zero_dsn_port_fails_closed() -> None:
         )
 
 
+def test_hostless_dsn_fails_closed_instead_of_switching_to_tcp() -> None:
+    """A libpq Unix-socket DSN must not silently become localhost TCP."""
+    with pytest.raises(ValueError, match="host"):
+        connection_kwargs_from_dsn("postgresql:///archive")
+
+
 @pytest.mark.parametrize("timeout_value", ("nan", "inf", "-inf"))
 def test_dsn_connect_timeout_must_be_finite(timeout_value: str) -> None:
     """Non-finite timeouts must not disable or destabilize the network deadline."""

From 874c39bc2a22d856655fdb340928d8d63c60eb87 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 2 Sep 2026 06:56:33 +0900
Subject: [PATCH 37/64] fix(postgres): preserve hostless DSN transport
 semantics

---
 lineageweave/postgres_sync.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 85a9eff04..073435b3c 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -144,6 +144,12 @@ def connection_kwargs_from_dsn(
     account. Several repository PostgreSQL test fixtures rely on that default,
     so the adapter resolves it explicitly before entering pg8000's required
     ``user`` argument rather than changing fixture connection semantics.
+
+    A URI without a host is different: libpq interprets it as a local Unix-
+    domain socket connection, while pg8000's omitted ``host`` defaults to
+    localhost TCP. The URI alone does not identify which Unix socket path
+    libpq would have selected, so this adapter rejects that ambiguous transport
+    rather than silently changing peer-authentication and network semantics.
     """
 
     parsed = urlsplit(dsn)
@@ -153,6 +159,8 @@ def connection_kwargs_from_dsn(
         raise ValueError("PostgreSQL DSN must not include a fragment")
     if not parsed.path or parsed.path == "/":
         raise ValueError("PostgreSQL DSN must include a database name")
+    if parsed.hostname is None:
+        raise ValueError("PostgreSQL DSN must include an explicit host")
 
     user = unquote(parsed.username) if parsed.username is not None else getpass.getuser()
     if not user:
@@ -167,7 +175,7 @@ def connection_kwargs_from_dsn(
 
     kwargs: dict[str, Any] = {
         "user": user,
-        "host": parsed.hostname or "localhost",
+        "host": parsed.hostname,
         "port": 5432 if port is None else port,
         "database": unquote(parsed.path.lstrip("/")),
     }

From 126887c551ebd452351a13d827ce2d84291f94b9 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 14:15:45 +0900
Subject: [PATCH 38/64] test(ci): preserve stale-lock fail-closed workflow
 contract

---
 .../test_dependency_lock_workflow_contract.py | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 tests/test_dependency_lock_workflow_contract.py

diff --git a/tests/test_dependency_lock_workflow_contract.py b/tests/test_dependency_lock_workflow_contract.py
new file mode 100644
index 000000000..c3d43ccec
--- /dev/null
+++ b/tests/test_dependency_lock_workflow_contract.py
@@ -0,0 +1,23 @@
+"""Regression contract for reproducible lockfile verification in hosted tests."""
+
+from pathlib import Path
+
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".github" / "workflows" / "tests.yml"
+
+
+def test_tests_workflow_fails_closed_on_stale_universal_lock() -> None:
+    """A stale uv.lock must fail before frozen install while preserving the resolver candidate."""
+
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    verify = workflow.index("- name: Verify committed universal lock")
+    preserve = workflow.index("- name: Preserve resolver-generated lock candidate")
+    install = workflow.index("- name: Install the committed universal lock")
+
+    assert verify < preserve < install
+    assert "if uv lock --check; then" in workflow
+    assert "uv lock\n" in workflow
+    assert "if: failure() && steps.lock.outputs.stale == 'true'" in workflow
+    assert "name: uv-lock-candidate-${{ github.sha }}" in workflow
+    assert "retention-days: 1" in workflow

From 3d0728ccab72abfe4c1be4f10a5d6443f42a7c9c Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 14:16:11 +0900
Subject: [PATCH 39/64] fix(ci): preserve stale-lock evidence after main
 convergence

---
 .github/workflows/tests.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5e58c7412..505900ec9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -58,6 +58,28 @@ jobs:
           version: "0.11.28"
           enable-cache: false
 
+      - name: Verify committed universal lock
+        id: lock
+        shell: bash
+        run: |
+          set -euo pipefail
+          if uv lock --check; then
+            echo "stale=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          uv lock
+          echo "stale=true" >> "$GITHUB_OUTPUT"
+          exit 1
+
+      - name: Preserve resolver-generated lock candidate
+        if: failure() && steps.lock.outputs.stale == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: uv-lock-candidate-${{ github.sha }}
+          path: uv.lock
+          if-no-files-found: error
+          retention-days: 1
+
       - name: Select pinned Rust toolchain
         run: |
           rustup toolchain install 1.97.1 --profile minimal

From b0218b1a7c5c710a0d045673e4e246e2a8530a48 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 14:17:34 +0900
Subject: [PATCH 40/64] test(ci): keep the existing stale-lock regression
 canonical

---
 .../test_dependency_lock_workflow_contract.py | 23 -------------------
 1 file changed, 23 deletions(-)
 delete mode 100644 tests/test_dependency_lock_workflow_contract.py

diff --git a/tests/test_dependency_lock_workflow_contract.py b/tests/test_dependency_lock_workflow_contract.py
deleted file mode 100644
index c3d43ccec..000000000
--- a/tests/test_dependency_lock_workflow_contract.py
+++ /dev/null
@@ -1,23 +0,0 @@
-"""Regression contract for reproducible lockfile verification in hosted tests."""
-
-from pathlib import Path
-
-
-WORKFLOW = Path(__file__).resolve().parents[1] / ".github" / "workflows" / "tests.yml"
-
-
-def test_tests_workflow_fails_closed_on_stale_universal_lock() -> None:
-    """A stale uv.lock must fail before frozen install while preserving the resolver candidate."""
-
-    workflow = WORKFLOW.read_text(encoding="utf-8")
-
-    verify = workflow.index("- name: Verify committed universal lock")
-    preserve = workflow.index("- name: Preserve resolver-generated lock candidate")
-    install = workflow.index("- name: Install the committed universal lock")
-
-    assert verify < preserve < install
-    assert "if uv lock --check; then" in workflow
-    assert "uv lock\n" in workflow
-    assert "if: failure() && steps.lock.outputs.stale == 'true'" in workflow
-    assert "name: uv-lock-candidate-${{ github.sha }}" in workflow
-    assert "retention-days: 1" in workflow

From ebef4f019d626cb5ef416bc3893c6b62d5171883 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 14:18:08 +0900
Subject: [PATCH 41/64] test(postgres): reject unrepresentable explicit connect
 timeout

---
 tests/test_postgres_sync_driver_contract.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 9c5a23e01..1043be6f9 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -136,6 +136,15 @@ def test_explicit_connect_timeout_rejects_boolean_values() -> None:
         )
 
 
+def test_explicit_connect_timeout_rejects_unrepresentable_integer() -> None:
+    """An integer too large for float conversion must fail through the validation contract."""
+    with pytest.raises(ValueError, match="finite positive"):
+        connection_kwargs_from_dsn(
+            "postgresql://alice:secret@db.example/archive",
+            connect_timeout=10**10000,
+        )
+
+
 def test_dsn_without_user_preserves_libpq_os_user_default(monkeypatch) -> None:
     """Existing admin DSNs without a username still use the local OS account."""
     monkeypatch.setattr("lineageweave.postgres_sync.getpass.getuser", lambda: "ci-runner")

From e6b95f08a9638d09361b32c4208d0921e87be8d4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 14:18:49 +0900
Subject: [PATCH 42/64] fix(postgres): fail closed on unrepresentable connect
 timeout

---
 lineageweave/postgres_sync.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 073435b3c..803830fc9 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -204,7 +204,10 @@ def connection_kwargs_from_dsn(
     if timeout_value is not None:
         if isinstance(timeout_value, bool):
             raise TypeError("PostgreSQL connect_timeout must be a real number")
-        timeout = float(timeout_value)
+        try:
+            timeout = float(timeout_value)
+        except OverflowError as exc:
+            raise ValueError("PostgreSQL connect_timeout must be finite positive") from exc
         if not math.isfinite(timeout) or timeout <= 0:
             raise ValueError("PostgreSQL connect_timeout must be finite positive")
         kwargs["timeout"] = timeout

From b389c48887e5b06ffb7936cea4bac88162f5111d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 14:26:47 +0900
Subject: [PATCH 43/64] docs(changelog): record synchronous PostgreSQL boundary
 hardening

---
 CHANGELOG.d/2.28.0-postgres-sync-driver.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 CHANGELOG.d/2.28.0-postgres-sync-driver.md

diff --git a/CHANGELOG.d/2.28.0-postgres-sync-driver.md b/CHANGELOG.d/2.28.0-postgres-sync-driver.md
new file mode 100644
index 000000000..c0a0c5dce
--- /dev/null
+++ b/CHANGELOG.d/2.28.0-postgres-sync-driver.md
@@ -0,0 +1,13 @@
+## 2.28.0 — Commercial-safe synchronous PostgreSQL boundary
+
+- Replace the synchronous seed/admin/schema `psycopg2-binary` dependency with
+  a pinned `pg8000` adapter while keeping runtime persistence on `asyncpg`.
+- Preserve generated-identifier quoting, SQLSTATE-specific schema/security
+  assertions, libpq-style DSN semantics that are representable by the adapter,
+  and fail closed on unsupported or ambiguous connection options.
+- Reject boolean, non-finite, non-positive, and float-unrepresentable explicit
+  connection timeouts through the adapter validation contract instead of
+  leaking arithmetic conversion errors.
+- Keep dependency-lock verification fail closed: a stale committed `uv.lock`
+  fails before frozen install/tests while the pinned resolver output is retained
+  as short-lived evidence for an exact, non-hand-edited lock update.

From 097b2d7004927c04402dfd37bb1afad401053499 Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Fri, 4 Sep 2026 13:37:53 +0900
Subject: [PATCH 44/64] fix(postgres): complete synchronous driver migration

Preserve the existing DB-API transaction, row, metadata, and typed-error contracts while replacing the remaining direct psycopg2 imports. Keep the live API fixture aligned with the migrations its handlers query so the backend suite reaches the migrated driver paths.

Signed-off-by: Codex <codex@openai.com>
---
 backend/app/main.py                         |   1 +
 backend/tests/test_api.py                   |  44 ++++++++-
 lineageweave/postgres_sync.py               |  39 ++++++--
 scripts/seed_demo_data.py                   |   3 +-
 tests/test_analysis_run_registry_schema.py  |   6 +-
 tests/test_person_mention_projection.py     |   4 +-
 tests/test_postgres_sync_driver_contract.py |  91 ++++++++++++++++++
 tests/test_schema.py                        |   3 +-
 uv.lock                                     | 100 +++++++++++---------
 9 files changed, 232 insertions(+), 59 deletions(-)

diff --git a/backend/app/main.py b/backend/app/main.py
index 122165990..5e9391a9a 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -147,6 +147,7 @@
 )
 from backend.app.occupational_construct_ingestion import (
     load_occupational_construct_assertions,
+    load_occupational_construct_evidence_status,
 )
 from backend.app.occupational_construct_search import (
     OccupationalConstructSearchError,
diff --git a/backend/tests/test_api.py b/backend/tests/test_api.py
index 520277031..5076efc49 100644
--- a/backend/tests/test_api.py
+++ b/backend/tests/test_api.py
@@ -23,10 +23,10 @@
 
 import asyncpg
 import jwt
-import psycopg2
 import pytest
 import redis
 
+from lineageweave import postgres_sync as psycopg2
 from lineageweave.http_client import HttpClientError, get_json, post_form
 from lineageweave.knowledge_graph import knowledge_graph_edges_for_post
 from lineageweave.post_summary import POST_SUMMARY_CONTRACT_VERSION
@@ -217,6 +217,40 @@
     / "migrations"
     / "0218_global_ask_public_verification.sql"
 )
+_TEPP_RECEIPT_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0217_analysis_run_tepp_receipt.sql"
+)
+_PROV_O_MIGRATION = (
+    Path(__file__).resolve().parents[2] / "migrations" / "0017_prov_o_standard_relations.sql"
+)
+_VOICE_TAXONOMY_MIGRATION = (
+    Path(__file__).resolve().parents[2] / "migrations" / "0235_voice_of_x_post_taxonomy.sql"
+)
+_ONTOLOGY_TRUTH_STATUS_MIGRATION = (
+    Path(__file__).resolve().parents[2] / "migrations" / "0175_ontology_truth_status.sql"
+)
+_CONVERSATION_EVIDENCE_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0233_source_conversation_turn_evidence.sql"
+)
+_SOURCE_POST_VOICE_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0237_source_post_voice_combination.sql"
+)
+_OCCUPATIONAL_CONSTRUCT_ASSERTION_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0238_occupational_construct_assertion.sql"
+)
+_OCCUPATIONAL_CONSTRUCT_EXTRACTION_MIGRATION = (
+    Path(__file__).resolve().parents[2]
+    / "migrations"
+    / "0240_occupational_construct_extraction_run.sql"
+)
 _GLOBAL_ASK_KNOWLEDGE_CUTOFF_MIGRATION = (
     Path(__file__).resolve().parents[2]
     / "migrations"
@@ -332,6 +366,7 @@ def seeded_db(demo_analyst_token):
     try:
         with conn.cursor() as cur:
             cur.execute(_MIGRATION_PATH.read_text())
+            cur.execute(_PROV_O_MIGRATION.read_text())
             cur.execute(_REGISTRY_MIGRATION.read_text())
             cur.execute(_RETENTION_MIGRATION.read_text())
             cur.execute(_RECONSTRUCTION_MIGRATION.read_text())
@@ -415,16 +450,23 @@ def seeded_db(demo_analyst_token):
             )
             conn.autocommit = False
             cur.execute(_GLOBAL_ASK_KNOWLEDGE_CUTOFF_MIGRATION.read_text())
+            cur.execute(_TEPP_RECEIPT_MIGRATION.read_text())
             cur.execute(_GLOBAL_ASK_PUBLIC_VERIFICATION_MIGRATION.read_text())
             cur.execute(_EVENT_OCCURRED_AT_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_AXIS_MIGRATION.read_text())
             cur.execute(_CHANNEL_EVIDENCE_MIGRATION.read_text())
+            cur.execute(_ONTOLOGY_TRUTH_STATUS_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_UNEXPLAINED_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_CROSS_SHARE_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_RECONSTRUCTION_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_UNEXPLAINED_SHARE_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_EXPLAINED_SHARE_MIGRATION.read_text())
             cur.execute(_LEFTOVER_MAP_COORDINATES_MIGRATION.read_text())
+            cur.execute(_CONVERSATION_EVIDENCE_MIGRATION.read_text())
+            cur.execute(_VOICE_TAXONOMY_MIGRATION.read_text())
+            cur.execute(_SOURCE_POST_VOICE_MIGRATION.read_text())
+            cur.execute(_OCCUPATIONAL_CONSTRUCT_ASSERTION_MIGRATION.read_text())
+            cur.execute(_OCCUPATIONAL_CONSTRUCT_EXTRACTION_MIGRATION.read_text())
             cur.execute(
                 "insert into common_lookup_value (lookup_category, lookup_code, lookup_label) values "
                 "('corporate_entity_level', 'group', 'Group'), "
diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 803830fc9..5c61861f9 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -43,6 +43,10 @@ class UniqueViolation(DatabaseError):
     """PostgreSQL SQLSTATE 23505: a uniqueness constraint rejected the statement."""
 
 
+class ForeignKeyViolation(DatabaseError):
+    """PostgreSQL SQLSTATE 23503: a foreign-key constraint rejected the statement."""
+
+
 class CheckViolation(DatabaseError):
     """PostgreSQL SQLSTATE 23514: a CHECK constraint rejected the statement."""
 
@@ -62,6 +66,7 @@ class RaiseException(DatabaseError):
 errors = SimpleNamespace(
     NotNullViolation=NotNullViolation,
     UniqueViolation=UniqueViolation,
+    ForeignKeyViolation=ForeignKeyViolation,
     CheckViolation=CheckViolation,
     ExclusionViolation=ExclusionViolation,
     InsufficientPrivilege=InsufficientPrivilege,
@@ -238,6 +243,7 @@ def _translated_error(error: BaseException) -> BaseException:
     state = _sqlstate(error)
     translated_type = {
         "23502": NotNullViolation,
+        "23503": ForeignKeyViolation,
         "23505": UniqueViolation,
         "23514": CheckViolation,
         "23P01": ExclusionViolation,
@@ -275,22 +281,32 @@ def executemany(self, operation: str, param_sets: object) -> Any:
                 raise
             raise translated from exc
 
+    def fetchone(self) -> tuple[Any, ...] | None:
+        """Return one DB-API row with the tuple shape existing callers expect."""
+        row = self._inner.fetchone()
+        return None if row is None else tuple(row)
+
+    def fetchall(self) -> list[tuple[Any, ...]]:
+        """Return all DB-API rows as tuples rather than pg8000's mutable lists."""
+        return [tuple(row) for row in self._inner.fetchall()]
+
     def __getattr__(self, name: str) -> Any:
         return getattr(self._inner, name)
 
     def __enter__(self) -> "Cursor":
-        self._inner.__enter__()
         return self
 
     def __exit__(self, exc_type: object, exc: object, traceback: object) -> object:
-        return self._inner.__exit__(exc_type, exc, traceback)
+        self._inner.close()
+        return False
 
 
 class Connection:
     """Connection proxy that keeps pg8000 isolated from repository call sites."""
 
-    def __init__(self, inner: Any) -> None:
+    def __init__(self, inner: Any, *, database: str) -> None:
         self._inner = inner
+        self.info = SimpleNamespace(dbname=database)
 
     @property
     def autocommit(self) -> bool:
@@ -303,15 +319,26 @@ def autocommit(self, value: bool) -> None:
     def cursor(self, *args: object, **kwargs: object) -> Cursor:
         return Cursor(self._inner.cursor(*args, **kwargs))
 
+    def close(self) -> None:
+        """Close the native connection, tolerating repeated cleanup calls."""
+        try:
+            self._inner.close()
+        except _dbapi.InterfaceError as exc:
+            if "connection is closed" not in str(exc).lower():
+                raise
+
     def __getattr__(self, name: str) -> Any:
         return getattr(self._inner, name)
 
     def __enter__(self) -> "Connection":
-        self._inner.__enter__()
         return self
 
     def __exit__(self, exc_type: object, exc: object, traceback: object) -> object:
-        return self._inner.__exit__(exc_type, exc, traceback)
+        if exc_type is None:
+            self._inner.commit()
+        else:
+            self._inner.rollback()
+        return False
 
 
 def connect(dsn: str, *, connect_timeout: float | int | None = None) -> Connection:
@@ -325,6 +352,6 @@ def connect(dsn: str, *, connect_timeout: float | int | None = None) -> Connecti
 
     kwargs = connection_kwargs_from_dsn(dsn, connect_timeout=connect_timeout)
     try:
-        return Connection(_dbapi.connect(**kwargs))
+        return Connection(_dbapi.connect(**kwargs), database=str(kwargs["database"]))
     except (_dbapi.InterfaceError, _dbapi.DatabaseError) as exc:
         raise OperationalError(*getattr(exc, "args", ())) from exc
diff --git a/scripts/seed_demo_data.py b/scripts/seed_demo_data.py
index ca1718751..51ab10fde 100644
--- a/scripts/seed_demo_data.py
+++ b/scripts/seed_demo_data.py
@@ -29,8 +29,7 @@
 # Allow `python3 scripts/seed_demo_data.py` from a checkout without install.
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 
-import psycopg2
-
+from lineageweave import postgres_sync as psycopg2
 from lineageweave.http_client import get_json, get_json_list, post_form
 from lineageweave.post_summary import ACTOR_TYPE_PERSON, POST_SUMMARY_CONTRACT_VERSION
 from lineageweave.tepp_client import AnalysisRunRequest, TeppClient, TeppNotAvailable
diff --git a/tests/test_analysis_run_registry_schema.py b/tests/test_analysis_run_registry_schema.py
index 4161f2452..e3612616e 100644
--- a/tests/test_analysis_run_registry_schema.py
+++ b/tests/test_analysis_run_registry_schema.py
@@ -9,10 +9,10 @@
 from pathlib import Path
 from urllib.parse import urlsplit, urlunsplit
 
-import psycopg2
-import psycopg2.errors
 import pytest
-from psycopg2 import sql
+
+from lineageweave import postgres_sync as psycopg2
+from lineageweave.postgres_sync import sql
 
 _ROOT = Path(__file__).resolve().parents[1]
 _INITIAL_MIGRATION = _ROOT / "migrations" / "0001_initial_schema.sql"
diff --git a/tests/test_person_mention_projection.py b/tests/test_person_mention_projection.py
index 7252fb8e8..80a3ce213 100644
--- a/tests/test_person_mention_projection.py
+++ b/tests/test_person_mention_projection.py
@@ -15,8 +15,6 @@
 import uuid
 
 import asyncpg
-import psycopg2
-from psycopg2 import sql
 import pytest
 
 from backend.app.keyman_ingestion import ingest_post_keymen
@@ -27,6 +25,8 @@
     related_for_start,
     visible_mention_post_ids,
 )
+from lineageweave import postgres_sync as psycopg2
+from lineageweave.postgres_sync import sql
 from backend.app import post_summary_ingestion as summary_ingestion
 from backend.app.post_summary_ingestion import (
     fetch_persisted_summary,
diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index 1043be6f9..b4ea61f8f 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -11,10 +11,14 @@
 
 import re
 from pathlib import Path
+from types import SimpleNamespace
 
+import pg8000.dbapi as _dbapi
 import pytest
 
 from lineageweave.postgres_sync import (
+    Connection,
+    Cursor,
     DatabaseError,
     OperationalError,
     _translated_error,
@@ -81,6 +85,92 @@ def test_generated_identifier_quoting_is_postgresql_safe() -> None:
     assert statement == 'create database "tenant""archive"'
 
 
+def test_cursor_context_manager_closes_a_dbapi_cursor_without_native_context_support() -> None:
+    """The compatibility wrapper owns close even when pg8000 has no cursor context manager."""
+
+    class NativeCursor:
+        closed = False
+
+        def close(self) -> None:
+            self.closed = True
+
+    native = NativeCursor()
+    with Cursor(native) as cursor:
+        assert cursor._inner is native
+
+    assert native.closed is True
+
+
+def test_cursor_rows_and_connection_info_preserve_existing_tooling_shapes(monkeypatch) -> None:
+    """The adapter keeps tuple rows and the database-name metadata callers consume."""
+
+    class NativeCursor:
+        def fetchone(self) -> list[object]:
+            return ["one", 1]
+
+        def fetchall(self) -> list[list[object]]:
+            return [["two", 2]]
+
+    cursor = Cursor(NativeCursor())
+    assert cursor.fetchone() == ("one", 1)
+    assert cursor.fetchall() == [("two", 2)]
+
+    native_connection = SimpleNamespace(autocommit=False)
+    monkeypatch.setattr(
+        "lineageweave.postgres_sync._dbapi.connect",
+        lambda **_kwargs: native_connection,
+    )
+    connection = connect("postgresql://alice:secret@db.example/archive")
+    assert connection.info.dbname == "archive"
+
+
+def test_connection_context_manages_transaction_without_closing() -> None:
+    """The compatibility context commits or rolls back but leaves lifetime to its owner."""
+
+    class NativeConnection:
+        autocommit = False
+        commits = 0
+        rollbacks = 0
+        closes = 0
+
+        def commit(self) -> None:
+            self.commits += 1
+
+        def rollback(self) -> None:
+            self.rollbacks += 1
+
+        def close(self) -> None:
+            self.closes += 1
+
+    native = NativeConnection()
+    connection = Connection(native, database="archive")
+    with connection:
+        pass
+    assert (native.commits, native.rollbacks, native.closes) == (1, 0, 0)
+
+    with pytest.raises(RuntimeError):
+        with connection:
+            raise RuntimeError("synthetic")
+    assert (native.commits, native.rollbacks, native.closes) == (1, 1, 0)
+
+
+def test_connection_close_is_idempotent_for_pg8000_cleanup() -> None:
+    """Nested cleanup helpers may safely close one connection more than once."""
+
+    class NativeConnection:
+        autocommit = False
+        closed = False
+
+        def close(self) -> None:
+            if self.closed:
+                raise _dbapi.InterfaceError("connection is closed")
+            self.closed = True
+
+    connection = Connection(NativeConnection(), database="archive")
+    connection.close()
+    connection.close()
+
+
 def test_generated_sql_rejects_raw_interpolation() -> None:
     """Dynamic SQL fragments must use an explicit safe composable wrapper."""
     with pytest.raises(TypeError, match="SQL interpolation requires"):
@@ -200,6 +290,7 @@ def fail_connect(**_: object) -> None:
     ("sqlstate", "expected_type"),
     (
         ("23502", errors.NotNullViolation),
+        ("23503", errors.ForeignKeyViolation),
         ("23505", errors.UniqueViolation),
         ("23514", errors.CheckViolation),
         ("23P01", errors.ExclusionViolation),
diff --git a/tests/test_schema.py b/tests/test_schema.py
index 94876295f..650b3ca84 100644
--- a/tests/test_schema.py
+++ b/tests/test_schema.py
@@ -22,11 +22,10 @@
 from urllib.parse import urlsplit, urlunsplit
 
 import asyncpg
-import psycopg2
-import psycopg2.errors
 import pytest
 
 from backend.app.post_chat_ingestion import gather_global_chat_sources
+from lineageweave import postgres_sync as psycopg2
 from lineageweave.occupational_construct_catalog import (
     catalog_content_sha256,
     sync_onet_construct_catalog,
diff --git a/uv.lock b/uv.lock
index f94e79cf4..286dc6800 100644
--- a/uv.lock
+++ b/uv.lock
@@ -37,6 +37,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]
 
+[[package]]
+name = "asn1crypto"
+version = "1.5.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/de/cf/d547feed25b5244fcb9392e288ff9fdc3280b10260362fc45d37a798a6ee/asn1crypto-1.5.1.tar.gz", hash = "sha256:13ae38502be632115abf8a24cbe5f4da52e3b5231990aff31123c805306ccb9c", size = 121080, upload-time = "2022-03-15T14:46:52.889Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c9/7f/09065fd9e27da0eda08b4d6897f1c13535066174cc023af248fc2a8d5e5a/asn1crypto-1.5.1-py2.py3-none-any.whl", hash = "sha256:db4e40728b728508912cbb3d44f19ce188f218e9eba635821bb4b68564f8fd67", size = 105045, upload-time = "2022-03-15T14:46:51.055Z" },
+]
+
 [[package]]
 name = "asyncpg"
 version = "0.31.0"
@@ -713,7 +722,7 @@ dev = [
     { name = "coverage" },
     { name = "httpx" },
     { name = "httpx2" },
-    { name = "psycopg2-binary" },
+    { name = "pg8000" },
     { name = "pyjwt", extra = ["crypto"] },
     { name = "pyshacl" },
     { name = "pytest" },
@@ -733,8 +742,8 @@ requires-dist = [
     { name = "opentelemetry-api", specifier = ">=1.30.0" },
     { name = "opentelemetry-exporter-otlp-proto-http", specifier = ">=1.30.0" },
     { name = "opentelemetry-sdk", specifier = ">=1.30.0" },
+    { name = "pg8000", marker = "extra == 'dev'", specifier = "==1.31.5" },
     { name = "pillow", specifier = ">=12.3.0" },
-    { name = "psycopg2-binary", marker = "extra == 'dev'", specifier = ">=2.9.12" },
     { name = "pyjwt", extras = ["crypto"], marker = "extra == 'backend'", specifier = ">=2.8.0" },
     { name = "pyjwt", extras = ["crypto"], marker = "extra == 'dev'", specifier = ">=2.8.0" },
     { name = "pyshacl", marker = "extra == 'dev'", specifier = ">=0.26.0" },
@@ -960,6 +969,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c", size = 129956, upload-time = "2026-08-04T18:15:27.159Z" },
 ]
 
+[[package]]
+name = "pg8000"
+version = "1.31.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "python-dateutil" },
+    { name = "scramp" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c8/9a/077ab21e700051e03d8c5232b6bcb9a1a4d4b6242c9a0226df2cfa306414/pg8000-1.31.5.tar.gz", hash = "sha256:46ebb03be52b7a77c03c725c79da2ca281d6e8f59577ca66b17c9009618cae78", size = 118933, upload-time = "2025-09-14T09:16:49.748Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/45/07/5fd183858dff4d24840f07fc845f213cd371a19958558607ba22035dadd7/pg8000-1.31.5-py3-none-any.whl", hash = "sha256:0af2c1926b153307639868d2ee5cef6cd3a7d07448e12736989b10e1d491e201", size = 57816, upload-time = "2025-09-14T09:16:47.798Z" },
+]
+
 [[package]]
 name = "pillow"
 version = "12.3.0"
@@ -1067,47 +1089,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/01/c3/629999e78d46c1115c11886d51c6bd68c17ce4a944f1ea3e153a91316a33/protobuf-7.36.0-py3-none-any.whl", hash = "sha256:53374d53fc29a67f7dbbf0ade47d7526a0f0137bf0f9c90e48d8a60790ef748c", size = 177024, upload-time = "2026-08-20T16:34:00.053Z" },
 ]
 
-[[package]]
-name = "psycopg2-binary"
-version = "2.9.12"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/2a/60/a3624f79acea344c16fbef3a94d28b89a8042ddfb8f3e4ca83f538671409/psycopg2_binary-2.9.12.tar.gz", hash = "sha256:5ac9444edc768c02a6b6a591f070b8aae28ff3a99be57560ac996001580f294c", size = 379686, upload-time = "2026-04-21T09:40:34.304Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e2/9f/ef4ef3c8e15083df90ca35265cfd1a081a2f0cc07bb229c6314c6af817f4/psycopg2_binary-2.9.12-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:5cdc05117180c5fa9c40eea8ea559ce64d73824c39d928b7da9fb5f6a9392433", size = 3712459, upload-time = "2026-04-20T23:34:30.549Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/01/3dd14e46ba48c1e1a6ec58ee599fa1b5efa00c246d5046cd903d0eeb1af1/psycopg2_binary-2.9.12-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d3227a3bc228c10d21011a99245edca923e4e8bf461857e869a507d9a41fe9f6", size = 3822936, upload-time = "2026-04-20T23:34:32.77Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/f7/0640e4901119d8a9f7a1784b927f494e2198e213ceb593753d1f2c8b1b30/psycopg2_binary-2.9.12-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:995ce929eede89db6254b50827e2b7fd61e50d11f0b116b29fffe4a2e53c4580", size = 4578676, upload-time = "2026-04-20T23:34:35.18Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/55/44df3965b5f297c50cc0b1b594a31c67d6127a9d133045b8a66611b14dfb/psycopg2_binary-2.9.12-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9fe06d93e72f1c048e731a2e3e7854a5bfaa58fc736068df90b352cefe66f03f", size = 4274917, upload-time = "2026-04-20T23:34:37.982Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/4b/74535248b1eac0c9336862e8617c765ac94dac76f9e25d7c4a79588c8907/psycopg2_binary-2.9.12-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:40e7b28b63aaf737cb3a1edc3a9bbc9a9f4ad3dcb7152e8c1130e4050eddcb7d", size = 5894843, upload-time = "2026-04-20T23:34:40.856Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/ba/f1bf8d2ae71868ad800b661099086ee52bc0f8d9f05be1acd8ebb06757cc/psycopg2_binary-2.9.12-cp312-cp312-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:89d19a9f7899e8eb0656a2b3a08e0da04c720a06db6e0033eab5928aabe60fa9", size = 4110556, upload-time = "2026-04-20T23:34:44.016Z" },
-    { url = "https://files.pythonhosted.org/packages/45/46/c15706c338403b7c420bcc0c2905aad116cc064545686d8bf85f1999ea00/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:612b965daee295ae2da8f8218ce1d274645dc76ef3f1abf6a0a94fd57eff876d", size = 3655714, upload-time = "2026-04-20T23:34:46.233Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/7c/a2d5dc09b64a4564db242a0fe418fde7d33f6f8259dd2c5b9d7def00fb5a/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:b9a339b79d37c1b45f3235265f07cdeb0cb5ad7acd2ac7720a5920989c17c24e", size = 3301154, upload-time = "2026-04-20T23:34:49.528Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/e8/cc8c9a4ce71461f9ec548d38cadc41dc184b34c73e6455450775a9334ccd/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:3471336e1acfd9c7fe507b8bad5af9317b6a89294f9eb37bd9a030bb7bebcdc6", size = 3048882, upload-time = "2026-04-20T23:34:51.86Z" },
-    { url = "https://files.pythonhosted.org/packages/19/6a/31e2296bc0787c5ab75d3d118e40b239db8151b5192b90b77c72bc9256e9/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7af18183109e23502c8b2ae7f6926c0882766f35b5175a4cd737ad825e4d7a1b", size = 3351298, upload-time = "2026-04-20T23:34:54.124Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/a8/75f4e3e11203b590150abed2cf7794b9c9c9f7eceddae955191138b44dde/psycopg2_binary-2.9.12-cp312-cp312-win_amd64.whl", hash = "sha256:398fcd4db988c7d7d3713e2b8e18939776fd3fb447052daae4f24fa39daede4c", size = 2757230, upload-time = "2026-04-20T23:34:56.242Z" },
-    { url = "https://files.pythonhosted.org/packages/91/bb/4608c96f970f6e0c56572e87027ef4404f709382a3503e9934526d7ba051/psycopg2_binary-2.9.12-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7c729a73c7b1b84de3582f73cdd27d905121dc2c531f3d9a3c32a3011033b965", size = 3712419, upload-time = "2026-04-20T23:34:58.754Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/af/48f76af9d50d61cf390f8cd657b503168b089e2e9298e48465d029fcc713/psycopg2_binary-2.9.12-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4413d0caef93c5cf50b96863df4c2efe8c269bf2267df353225595e7e15e8df7", size = 3822990, upload-time = "2026-04-20T23:35:00.821Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/df/aba0f99397cd811d32e06fc0cc781f1f3ce98bc0e729cb423925085d781a/psycopg2_binary-2.9.12-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:4dfcf8e45ebb0c663be34a3442f65e17311f3367089cd4e5e3a3e8e62c978777", size = 4578696, upload-time = "2026-04-20T23:35:03.409Z" },
-    { url = "https://files.pythonhosted.org/packages/95/9c/eaa74021ac4e4d5c2f83d82fc6615a63f4fe6c94dc4e94c3990427053f67/psycopg2_binary-2.9.12-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c41321a14dd74aceb6a9a643b9253a334521babfa763fa873e33d89cfa122fb5", size = 4274982, upload-time = "2026-04-20T23:35:05.583Z" },
-    { url = "https://files.pythonhosted.org/packages/35/ed/c25deff98bd26187ba48b3b250a3ffc3037c46c5b89362534a15d200e0db/psycopg2_binary-2.9.12-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:83946ba43979ebfdc99a3cd0ee775c89f221df026984ba19d46133d8d75d3cd9", size = 5894867, upload-time = "2026-04-20T23:35:07.902Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/81/8d0e21ca77373c6c9589e5c4528f6e8f0c08c62cafc76fb0bddb7a2cee22/psycopg2_binary-2.9.12-cp313-cp313-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:411e85815652d13560fbe731878daa5d92378c4995a22302071890ec3397d019", size = 4110578, upload-time = "2026-04-20T23:35:10.149Z" },
-    { url = "https://files.pythonhosted.org/packages/00/fc/f481e2435bd8f742d0123309174aae4165160ad3ef17c1b99c3622c241d2/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c8ad4c08e00f7679559eaed7aff1edfffc60c086b976f93972f686384a95e2c", size = 3655816, upload-time = "2026-04-20T23:35:12.56Z" },
-    { url = "https://files.pythonhosted.org/packages/53/79/b9f46466bdbe9f239c96cde8be33c1aace4842f06013b47b730dc9759187/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:00814e40fa23c2b37ef0a1e3c749d89982c73a9cb5046137f0752a22d432e82f", size = 3301307, upload-time = "2026-04-20T23:35:15.029Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/19/7dc003b32fe35024df89b658104f7c8538a8b2dcbde7a4e746ce929742e7/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:98062447aebc20ed20add1f547a364fd0ef8933640d5372ff1873f8deb9b61be", size = 3048968, upload-time = "2026-04-20T23:35:16.757Z" },
-    { url = "https://files.pythonhosted.org/packages/91/58/2dbd7db5c604d45f4950d988506aae672a14126ec22998ced5021cbb76bb/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:66a7685d7e548f10fb4ce32fb01a7b7f4aa702134de92a292c7bd9e0d3dbd290", size = 3351369, upload-time = "2026-04-20T23:35:18.933Z" },
-    { url = "https://files.pythonhosted.org/packages/42/ee/dee8dcaad07f735824de3d6563bc67119fa6c28257b17977a8d624f02fab/psycopg2_binary-2.9.12-cp313-cp313-win_amd64.whl", hash = "sha256:b6937f5fe4e180aeee87de907a2fa982ded6f7f15d7218f78a083e4e1d68f2a0", size = 2757347, upload-time = "2026-04-20T23:35:21.283Z" },
-    { url = "https://files.pythonhosted.org/packages/13/1b/708c0dca874acfad6d65314271859899a79007686f3a1f74e82a2ed4b645/psycopg2_binary-2.9.12-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:6f3b3de8a74ef8db215f22edffb19e32dc6fa41340456de7ec99efdc8a7b3ec2", size = 3712428, upload-time = "2026-04-20T23:35:23.453Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/39/ddbea9d4b4de6aca9431b6ed253f530f8a02d3b8f9bcfd0dbfe2b3de6fe4/psycopg2_binary-2.9.12-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1006fb62f0f0bc5ce256a832356c6262e91be43f5e4eb15b5eaf38079464caf2", size = 3823184, upload-time = "2026-04-20T23:35:25.92Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/a0/bc2fef74b106fa345567122a0659e6d94512ed7dc0131ec44c9e5aba3725/psycopg2_binary-2.9.12-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:840066105706cd2eb29b9a1c2329620056582a4bf3e8169dec5c447042d0869f", size = 4579157, upload-time = "2026-04-20T23:35:28.542Z" },
-    { url = "https://files.pythonhosted.org/packages/57/d7/d4e3b2005d3de607ca4fbb0e8742e248056e52184a6b94ebda3c1c2c329b/psycopg2_binary-2.9.12-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:863f5d12241ebe1c76a72a04c2113b6dc905f90b9cef0e9be0efd994affd9354", size = 4274970, upload-time = "2026-04-20T23:35:30.418Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/42/c9853f8db3967fe08bcde11f53d53b85d351750cae726ce001cb68afa9c1/psycopg2_binary-2.9.12-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a99eaab34a9010f1a086b126de467466620a750634d114d20455f3a824aae033", size = 5895175, upload-time = "2026-04-20T23:35:33.584Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/fd/b82b5601a97630308bef079f545ffec481bbbc795c2ba5ec416a01d03f60/psycopg2_binary-2.9.12-cp314-cp314-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ffdd7dc5463ccd61845ac37b7012d0f35a1548df9febe14f8dd549be4a0bc81e", size = 4110658, upload-time = "2026-04-20T23:35:35.638Z" },
-    { url = "https://files.pythonhosted.org/packages/62/8c/32ca69b0389ef25dd22937bf9e8fbe2ce27aea20b05ded48c4ce4cb42475/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:54a0dfecab1b48731f934e06139dfe11e24219fb6d0ceb32177cf0375f14c7b5", size = 3656251, upload-time = "2026-04-20T23:35:37.854Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/29/96992a2b59e3b9d730fcf9612d0a387305025dc867a9fc490a9e496e074e/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:96937c9c5d891f772430f418a7a8b4691a90c3e6b93cf72b5bd7cad8cbca32a5", size = 3301810, upload-time = "2026-04-20T23:35:39.927Z" },
-    { url = "https://files.pythonhosted.org/packages/56/ad/44b06659949b243ae10112cd3b20a197f9bf3e81d5651379b9eb889bfaad/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:77b348775efd4cdab410ec6609d81ccecd1139c90265fa583a7255c8064bc03d", size = 3048977, upload-time = "2026-04-20T23:35:41.806Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/f2/10a1bcebadb6aa55e280e1f58975c36a7b560ea525184c7aa4064c466633/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:527e6342b3e44c2f0544f6b8e927d60de7f163f5723b8f1dfa7d2a84298738cd", size = 3351466, upload-time = "2026-04-20T23:35:43.993Z" },
-    { url = "https://files.pythonhosted.org/packages/20/be/b732c8418ffa5bcfda002890f5dc4c869fc17db66ff11f53b17cfe44afc0/psycopg2_binary-2.9.12-cp314-cp314-win_amd64.whl", hash = "sha256:f12ae41fcafadb39b2785e64a40f9db05d6de2ac114077457e0e7c597f3af980", size = 2848762, upload-time = "2026-04-20T23:35:46.421Z" },
-]
-
 [[package]]
 name = "pycparser"
 version = "3.0"
@@ -1270,6 +1251,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
 ]
 
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+
 [[package]]
 name = "python-dotenv"
 version = "1.2.2"
@@ -1509,6 +1502,27 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/8c/97/d855d6b3c322d1f27e26f5241c42016b56cf01377ea8ed348285f54652f0/rpds_py-2026.6.3-cp315-cp315t-win_amd64.whl", hash = "sha256:ae3d4fe8c0b9213624fdce7279d70e3b148b682ca20719ebd193a23ebfa47324", size = 220719, upload-time = "2026-06-30T07:17:31.788Z" },
 ]
 
+[[package]]
+name = "scramp"
+version = "1.4.17"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asn1crypto" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/68/76/6db02f36db58a7d009e90f51e961bcc3c44a1c930a744f026e30e791989b/scramp-1.4.17.tar.gz", hash = "sha256:28970f29ebc33df47f9975c805e5e5a360effe5b31045e607d64b3b60370dba1", size = 21291, upload-time = "2026-08-07T17:19:40.827Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7f/99/0e372781210cd36b2f2727e5be3ea93066edad7edd6fa2dfdec3b3e28845/scramp-1.4.17-py3-none-any.whl", hash = "sha256:a4e3fd2e8169461a28a13777a166d3da94274454f0714a7d3023fee124474ac8", size = 16131, upload-time = "2026-08-07T17:19:39.591Z" },
+]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+
 [[package]]
 name = "sse-starlette"
 version = "3.4.8"

From 8d4d8cc690271b71c7dfda18df84f5ac305f60e8 Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Fri, 4 Sep 2026 19:30:37 +0900
Subject: [PATCH 45/64] test(postgres): clarify rollback control flow

Signed-off-by: Codex <codex@localhost>
---
 tests/test_postgres_sync_driver_contract.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/test_postgres_sync_driver_contract.py b/tests/test_postgres_sync_driver_contract.py
index b4ea61f8f..5f7500c15 100644
--- a/tests/test_postgres_sync_driver_contract.py
+++ b/tests/test_postgres_sync_driver_contract.py
@@ -148,9 +148,11 @@ def close(self) -> None:
         pass
     assert (native.commits, native.rollbacks, native.closes) == (1, 0, 0)
 
-    with pytest.raises(RuntimeError):
+    def fail_inside_transaction() -> None:
         with connection:
             raise RuntimeError("synthetic")
+
+    pytest.raises(RuntimeError, fail_inside_transaction)
     assert (native.commits, native.rollbacks, native.closes) == (1, 1, 0)
 
 

From b84f8059b0a47c2344203b06e42d6a87ed8b2347 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 19:54:48 +0900
Subject: [PATCH 46/64] test(postgres): pin review regression contracts

---
 .../test_postgres_sync_review_regressions.py  | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 tests/test_postgres_sync_review_regressions.py

diff --git a/tests/test_postgres_sync_review_regressions.py b/tests/test_postgres_sync_review_regressions.py
new file mode 100644
index 000000000..6db2fd7a9
--- /dev/null
+++ b/tests/test_postgres_sync_review_regressions.py
@@ -0,0 +1,81 @@
+"""Regression contracts for synchronous PostgreSQL review findings."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pg8000.dbapi as _dbapi
+import pytest
+
+from lineageweave.postgres_sync import Connection, errors
+
+
+_ROOT = Path(__file__).resolve().parents[1]
+_WORKFLOW = _ROOT / ".github" / "workflows" / "tests.yml"
+
+
+def test_lock_candidate_artifact_is_unique_per_workflow_attempt_and_review_durable() -> None:
+    """Resolver evidence must survive review and never collide across rerun attempts."""
+    workflow = _WORKFLOW.read_text(encoding="utf-8")
+
+    assert "uv-lock-candidate-${{ github.sha }}-${{ github.run_attempt }}" in workflow
+    retention_match = re.search(
+        r"name: uv-lock-candidate-\$\{\{ github\.sha \}\}-\$\{\{ github\.run_attempt \}\}"
+        r"[\s\S]*?retention-days:\s*(\d+)",
+        workflow,
+    )
+    assert retention_match is not None
+    assert int(retention_match.group(1)) >= 7
+
+
+@pytest.mark.parametrize(
+    ("method_name", "sqlstate", "expected_type"),
+    (
+        ("commit", "23505", errors.UniqueViolation),
+        ("rollback", "23503", errors.ForeignKeyViolation),
+    ),
+)
+def test_connection_transaction_methods_translate_database_errors(
+    method_name: str,
+    sqlstate: str,
+    expected_type: type[BaseException],
+) -> None:
+    """Commit and rollback retain SQLSTATE-specific compatibility at the adapter boundary."""
+
+    class NativeConnection:
+        autocommit = False
+
+        def commit(self) -> None:
+            raise _dbapi.DatabaseError({"C": sqlstate, "M": "synthetic transaction failure"})
+
+        def rollback(self) -> None:
+            raise _dbapi.DatabaseError({"C": sqlstate, "M": "synthetic transaction failure"})
+
+    connection = Connection(NativeConnection(), database="archive")
+
+    with pytest.raises(expected_type):
+        getattr(connection, method_name)()
+
+
+def test_connection_context_uses_translating_transaction_methods() -> None:
+    """Context-manager completion must not bypass transaction error translation."""
+
+    class NativeConnection:
+        autocommit = False
+
+        def commit(self) -> None:
+            raise _dbapi.DatabaseError({"C": "23505", "M": "deferred unique violation"})
+
+        def rollback(self) -> None:
+            raise _dbapi.DatabaseError({"C": "23503", "M": "deferred foreign-key violation"})
+
+    connection = Connection(NativeConnection(), database="archive")
+
+    with pytest.raises(errors.UniqueViolation):
+        with connection:
+            pass
+
+    with pytest.raises(errors.ForeignKeyViolation):
+        with connection:
+            raise RuntimeError("force rollback")

From c671fdb3688fad7f2e38608b6ef93b819c12c66d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 19:55:27 +0900
Subject: [PATCH 47/64] fix(ci): preserve resolver lock evidence across reruns

---
 .github/workflows/tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index efe5b9d43..72c6c3b66 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -69,10 +69,10 @@ jobs:
         if: failure() && steps.lock.outputs.stale == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: uv-lock-candidate-${{ github.sha }}
+          name: uv-lock-candidate-${{ github.sha }}-${{ github.run_attempt }}
           path: uv.lock
           if-no-files-found: error
-          retention-days: 1
+          retention-days: 7
 
       - name: Select pinned Rust toolchain
         run: |

From 823a443ad0f6071f751d24dde0854610586cabb3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 19:56:08 +0900
Subject: [PATCH 48/64] fix(postgres): translate transaction boundary errors

---
 lineageweave/postgres_sync.py | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 5c61861f9..7350497df 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -319,6 +319,26 @@ def autocommit(self, value: bool) -> None:
     def cursor(self, *args: object, **kwargs: object) -> Cursor:
         return Cursor(self._inner.cursor(*args, **kwargs))
 
+    def commit(self) -> None:
+        """Commit while preserving SQLSTATE-specific adapter error types."""
+        try:
+            self._inner.commit()
+        except _dbapi.DatabaseError as exc:
+            translated = _translated_error(exc)
+            if translated is exc:
+                raise
+            raise translated from exc
+
+    def rollback(self) -> None:
+        """Roll back while preserving SQLSTATE-specific adapter error types."""
+        try:
+            self._inner.rollback()
+        except _dbapi.DatabaseError as exc:
+            translated = _translated_error(exc)
+            if translated is exc:
+                raise
+            raise translated from exc
+
     def close(self) -> None:
         """Close the native connection, tolerating repeated cleanup calls."""
         try:
@@ -335,9 +355,9 @@ def __enter__(self) -> "Connection":
 
     def __exit__(self, exc_type: object, exc: object, traceback: object) -> object:
         if exc_type is None:
-            self._inner.commit()
+            self.commit()
         else:
-            self._inner.rollback()
+            self.rollback()
         return False
 
 

From ffde764d697e15d51cbce5b21731014ac0d8b9ed Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 22:54:43 +0900
Subject: [PATCH 49/64] fix(postgres): document public sync adapter surface

---
 lineageweave/postgres_sync.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 7350497df..21283d413 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -106,6 +106,7 @@ def _render_sql_composable(value: object) -> str:
 
 class _SQL(str):
     def format(self, *args: object, **kwargs: object) -> str:
+        """Interpolate only explicitly safe SQL composable fragments."""
         positional = tuple(_render_sql_composable(value) for value in args)
         named = {key: _render_sql_composable(value) for key, value in kwargs.items()}
         return str(self).format(*positional, **named)
@@ -262,6 +263,7 @@ def __init__(self, inner: Any) -> None:
         self._inner = inner
 
     def execute(self, operation: str, args: object | None = None, **kwargs: object) -> Any:
+        """Execute one statement while translating supported PostgreSQL SQLSTATEs."""
         try:
             if args is None:
                 return self._inner.execute(operation, **kwargs)
@@ -273,6 +275,7 @@ def execute(self, operation: str, args: object | None = None, **kwargs: object)
             raise translated from exc
 
     def executemany(self, operation: str, param_sets: object) -> Any:
+        """Execute a statement for many parameter sets with SQLSTATE translation."""
         try:
             return self._inner.executemany(operation, param_sets)
         except _dbapi.DatabaseError as exc:
@@ -310,13 +313,16 @@ def __init__(self, inner: Any, *, database: str) -> None:
 
     @property
     def autocommit(self) -> bool:
+        """Return the native connection's current autocommit setting."""
         return bool(self._inner.autocommit)
 
     @autocommit.setter
     def autocommit(self, value: bool) -> None:
+        """Set autocommit on the isolated native pg8000 connection."""
         self._inner.autocommit = value
 
     def cursor(self, *args: object, **kwargs: object) -> Cursor:
+        """Create a cursor wrapped by the adapter's SQLSTATE boundary."""
         return Cursor(self._inner.cursor(*args, **kwargs))
 
     def commit(self) -> None:

From 1167fea4645c292f5e5379b1ae913179a27bf0a2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:51:11 +0900
Subject: [PATCH 50/64] test(postgres): pin libpq prefer transport ordering

---
 tests/test_postgres_sync_sslmode_contract.py | 65 ++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 tests/test_postgres_sync_sslmode_contract.py

diff --git a/tests/test_postgres_sync_sslmode_contract.py b/tests/test_postgres_sync_sslmode_contract.py
new file mode 100644
index 000000000..a13c8ba2e
--- /dev/null
+++ b/tests/test_postgres_sync_sslmode_contract.py
@@ -0,0 +1,65 @@
+"""Transport-order contract for the synchronous PostgreSQL compatibility boundary."""
+
+from __future__ import annotations
+
+import ssl
+from types import SimpleNamespace
+
+import pg8000.dbapi as _dbapi
+import pytest
+
+from lineageweave.postgres_sync import OperationalError, connect
+
+
+@pytest.mark.parametrize(
+    "dsn",
+    (
+        "postgresql://alice:secret@db.example/archive",
+        "postgresql://alice:secret@db.example/archive?sslmode=prefer",
+    ),
+)
+def test_libpq_prefer_semantics_attempt_tls_before_plaintext_fallback(
+    monkeypatch: pytest.MonkeyPatch,
+    dsn: str,
+) -> None:
+    """Default/explicit prefer must try encrypted transport before server-refusal fallback."""
+    attempts: list[object] = []
+    native_connection = SimpleNamespace(autocommit=False)
+
+    def fake_connect(**kwargs: object) -> object:
+        ssl_context = kwargs["ssl_context"]
+        attempts.append(ssl_context)
+        if len(attempts) == 1:
+            assert isinstance(ssl_context, ssl.SSLContext)
+            assert ssl_context.check_hostname is False
+            assert ssl_context.verify_mode == ssl.CERT_NONE
+            raise _dbapi.InterfaceError("Server refuses SSL")
+        assert ssl_context is False
+        return native_connection
+
+    monkeypatch.setattr("lineageweave.postgres_sync._dbapi.connect", fake_connect)
+
+    connection = connect(dsn)
+
+    assert connection._inner is native_connection
+    assert len(attempts) == 2
+
+
+def test_prefer_does_not_downgrade_on_arbitrary_transport_failure(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Plaintext fallback is limited to an explicit PostgreSQL SSL refusal."""
+    attempts = 0
+
+    def fail_connect(**kwargs: object) -> object:
+        nonlocal attempts
+        attempts += 1
+        assert isinstance(kwargs["ssl_context"], ssl.SSLContext)
+        raise _dbapi.InterfaceError("network path failed during TLS negotiation")
+
+    monkeypatch.setattr("lineageweave.postgres_sync._dbapi.connect", fail_connect)
+
+    with pytest.raises(OperationalError):
+        connect("postgresql://alice:secret@db.example/archive?sslmode=prefer")
+
+    assert attempts == 1

From ff4b02c5a49b147166bcbba1a6fbd234b638332b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:52:32 +0900
Subject: [PATCH 51/64] fix(postgres): preserve libpq prefer SSL ordering

---
 lineageweave/postgres_sync.py | 42 ++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 6 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 21283d413..8c5c1673f 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -115,12 +115,20 @@ def format(self, *args: object, **kwargs: object) -> str:
 sql = SimpleNamespace(SQL=_SQL, Identifier=_Identifier)
 
 
+def _encryption_only_ssl_context() -> ssl.SSLContext:
+    """Create the non-verifying TLS context used by libpq prefer semantics."""
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE
+    return context
+
+
 def _ssl_context_for_mode(mode: str) -> ssl.SSLContext | bool | None:
     normalized = mode.lower()
     if normalized == "disable":
         return False
     if normalized == "prefer":
-        return None
+        return _encryption_only_ssl_context()
     if normalized == "require":
         return True
     if normalized == "verify-ca":
@@ -222,8 +230,7 @@ def connection_kwargs_from_dsn(
         if not query["application_name"]:
             raise ValueError("PostgreSQL application_name must not be empty")
         kwargs["application_name"] = query["application_name"]
-    if "sslmode" in query:
-        kwargs["ssl_context"] = _ssl_context_for_mode(query["sslmode"])
+    kwargs["ssl_context"] = _ssl_context_for_mode(query.get("sslmode", "prefer"))
     if "options" in query:
         startup_params["options"] = query["options"]
     if startup_params:
@@ -256,6 +263,14 @@ def _translated_error(error: BaseException) -> BaseException:
     return translated_type(*getattr(error, "args", ()))
 
 
+def _server_refused_ssl(error: BaseException) -> bool:
+    """Return whether pg8000 reported PostgreSQL's explicit SSL refusal byte."""
+    return any(
+        isinstance(arg, str) and arg.strip().lower() == "server refuses ssl"
+        for arg in getattr(error, "args", ())
+    )
+
+
 class Cursor:
     """Thin cursor wrapper that preserves the SQLSTATE-specific test contract."""
 
@@ -373,11 +388,26 @@ def connect(dsn: str, *, connect_timeout: float | int | None = None) -> Connecti
     pg8000 reports transport failures as ``InterfaceError`` and PostgreSQL
     startup refusals such as authentication/database errors as ``DatabaseError``.
     Both occur before a connection exists and therefore preserve the historical
-    ``OperationalError`` contract used by reachability probes.
+    ``OperationalError`` contract used by reachability probes. Libpq's default
+    ``sslmode=prefer`` is preserved by trying encrypted transport first and
+    falling back to plaintext only when PostgreSQL explicitly refuses SSL.
     """
 
+    parsed = urlsplit(dsn)
+    query = dict(parse_qsl(parsed.query, keep_blank_values=True))
+    sslmode = query.get("sslmode", "prefer").lower()
     kwargs = connection_kwargs_from_dsn(dsn, connect_timeout=connect_timeout)
     try:
-        return Connection(_dbapi.connect(**kwargs), database=str(kwargs["database"]))
-    except (_dbapi.InterfaceError, _dbapi.DatabaseError) as exc:
+        native = _dbapi.connect(**kwargs)
+    except _dbapi.InterfaceError as exc:
+        if sslmode != "prefer" or not _server_refused_ssl(exc):
+            raise OperationalError(*getattr(exc, "args", ())) from exc
+        fallback_kwargs = dict(kwargs)
+        fallback_kwargs["ssl_context"] = False
+        try:
+            native = _dbapi.connect(**fallback_kwargs)
+        except (_dbapi.InterfaceError, _dbapi.DatabaseError) as fallback_exc:
+            raise OperationalError(*getattr(fallback_exc, "args", ())) from fallback_exc
+    except _dbapi.DatabaseError as exc:
         raise OperationalError(*getattr(exc, "args", ())) from exc
+    return Connection(native, database=str(kwargs["database"]))

From 8c0990ad12d6e4e54bbaefc04d223aca41157110 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:53:20 +0900
Subject: [PATCH 52/64] test(postgres): pin libpq require TLS semantics

---
 tests/test_postgres_sync_sslmode_contract.py | 24 ++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/tests/test_postgres_sync_sslmode_contract.py b/tests/test_postgres_sync_sslmode_contract.py
index a13c8ba2e..caf805f76 100644
--- a/tests/test_postgres_sync_sslmode_contract.py
+++ b/tests/test_postgres_sync_sslmode_contract.py
@@ -63,3 +63,27 @@ def fail_connect(**kwargs: object) -> object:
         connect("postgresql://alice:secret@db.example/archive?sslmode=prefer")
 
     assert attempts == 1
+
+
+def test_libpq_require_encrypts_without_implicit_certificate_verification(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Require must force TLS without silently becoming verify-ca/verify-full."""
+    attempts = 0
+    native_connection = SimpleNamespace(autocommit=False)
+
+    def fake_connect(**kwargs: object) -> object:
+        nonlocal attempts
+        attempts += 1
+        ssl_context = kwargs["ssl_context"]
+        assert isinstance(ssl_context, ssl.SSLContext)
+        assert ssl_context.check_hostname is False
+        assert ssl_context.verify_mode == ssl.CERT_NONE
+        return native_connection
+
+    monkeypatch.setattr("lineageweave.postgres_sync._dbapi.connect", fake_connect)
+
+    connection = connect("postgresql://alice:secret@db.example/archive?sslmode=require")
+
+    assert connection._inner is native_connection
+    assert attempts == 1

From d1650eba0de41ee6989685e479f9241e83f3df4d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:54:17 +0900
Subject: [PATCH 53/64] fix(postgres): preserve libpq require TLS semantics

---
 lineageweave/postgres_sync.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 8c5c1673f..2d505f70a 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -116,7 +116,7 @@ def format(self, *args: object, **kwargs: object) -> str:
 
 
 def _encryption_only_ssl_context() -> ssl.SSLContext:
-    """Create the non-verifying TLS context used by libpq prefer semantics."""
+    """Create the non-verifying TLS context used by libpq prefer/require semantics."""
     context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     context.check_hostname = False
     context.verify_mode = ssl.CERT_NONE
@@ -130,7 +130,7 @@ def _ssl_context_for_mode(mode: str) -> ssl.SSLContext | bool | None:
     if normalized == "prefer":
         return _encryption_only_ssl_context()
     if normalized == "require":
-        return True
+        return _encryption_only_ssl_context()
     if normalized == "verify-ca":
         context = ssl.create_default_context()
         context.check_hostname = False

From 1da5f8394cbebe5bcebe5a5ad37881d750e5c9a4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:58:13 +0900
Subject: [PATCH 54/64] chore(ci): adopt protected concurrency contract

---
 .github/workflows/tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 72c6c3b66..a762d574a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,8 +13,8 @@ concurrency:
   # A merged pull request can report the base ref on ``closed``. Keying PR
   # events by number lets that close run cancel an older queued synchronize
   # run for the same PR instead of consuming runners after the PR is closed.
-  group: tests-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   pytest:

From db6a0e92f27bdd076f611049670ac3ff8f2304e9 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:58:53 +0900
Subject: [PATCH 55/64] chore(ci): adopt protected ontology concurrency

---
 .github/workflows/ontology-pages.yml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ontology-pages.yml b/.github/workflows/ontology-pages.yml
index 05e7000bb..9547dc2d1 100644
--- a/.github/workflows/ontology-pages.yml
+++ b/.github/workflows/ontology-pages.yml
@@ -32,13 +32,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   validate:
     name: Validate ontology publication
     if: github.event_name == 'pull_request'
-    concurrency:
-      group: ontology-pages-validation-${{ github.event.pull_request.number || github.ref }}
-      cancel-in-progress: true
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -82,9 +83,6 @@ jobs:
   publish:
     name: Publish ontology to GitHub Pages
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
-    concurrency:
-      group: ontology-pages-publication
-      cancel-in-progress: false
     runs-on: ubuntu-latest
     permissions:
       contents: read

From 59fffb974e5332025c4120004c0f0d9d60c37b8d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 23:59:31 +0900
Subject: [PATCH 56/64] chore(ci): adopt protected PROV-O concurrency

---
 .github/workflows/prov-o-contract.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/prov-o-contract.yml b/.github/workflows/prov-o-contract.yml
index eae453153..4a91c4f7e 100644
--- a/.github/workflows/prov-o-contract.yml
+++ b/.github/workflows/prov-o-contract.yml
@@ -28,8 +28,8 @@ permissions:
   contents: read
 
 concurrency:
-  group: prov-o-contract-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   standards-contract:

From cb430e734cfaca00baa3ad86d3c5d191ccca8523 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 5 Sep 2026 00:00:11 +0900
Subject: [PATCH 57/64] test(ci): adopt protected workflow concurrency contract

---
 tests/test_tests_workflow_contract.py | 37 +++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/tests/test_tests_workflow_contract.py b/tests/test_tests_workflow_contract.py
index e6b48461a..4144790a4 100644
--- a/tests/test_tests_workflow_contract.py
+++ b/tests/test_tests_workflow_contract.py
@@ -1,17 +1,44 @@
-"""Regression contracts for the repository-local test workflow."""
+"""Regression contracts for repository-local workflow concurrency."""
 
 from pathlib import Path
 
 
-_WORKFLOW = Path(__file__).parents[1] / ".github" / "workflows" / "tests.yml"
+_WORKFLOW_DIRECTORY = Path(__file__).parents[1] / ".github" / "workflows"
+_PULL_REQUEST_GROUP = (
+    "group: ${{ github.workflow }}-${{ github.repository }}-"
+    "${{ github.event_name == 'pull_request' && "
+    "github.event.pull_request.number || github.run_id }}"
+)
+_PULL_REQUEST_CANCELLATION = (
+    "cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
+)
 
 
 def test_pull_request_concurrency_survives_closed_ref_change() -> None:
     """Key synchronize and closed events by PR number so close cancels stale work."""
 
-    workflow = _WORKFLOW.read_text(encoding="utf-8")
+    workflow = (_WORKFLOW_DIRECTORY / "tests.yml").read_text(encoding="utf-8")
 
     assert "types: [opened, synchronize, reopened, closed]" in workflow
-    assert "group: tests-${{ github.event.pull_request.number || github.ref }}" in workflow
-    assert "cancel-in-progress: true" in workflow
     assert workflow.count("github.event.action != 'closed'") == 2
+
+
+def test_pull_request_workflows_cancel_only_superseded_same_pr_runs() -> None:
+    """Scope PR cancellation by workflow, repository, and pull request number."""
+
+    for workflow_path in sorted(_WORKFLOW_DIRECTORY.glob("*.yml")):
+        workflow = workflow_path.read_text(encoding="utf-8")
+        if "pull_request:" not in workflow:
+            continue
+        assert _PULL_REQUEST_GROUP in workflow, workflow_path.name
+        assert _PULL_REQUEST_CANCELLATION in workflow, workflow_path.name
+
+
+def test_ontology_publication_runs_are_not_cancelled() -> None:
+    """Keep publication runs isolated and non-cancelling outside pull requests."""
+
+    workflow = (_WORKFLOW_DIRECTORY / "ontology-pages.yml").read_text(
+        encoding="utf-8"
+    )
+    assert "github.run_id" in workflow
+    assert _PULL_REQUEST_CANCELLATION in workflow

From 007261bcbc893eb5cb91c804238f8399039d16ea Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 5 Sep 2026 00:23:55 +0900
Subject: [PATCH 58/64] chore(main): adapt #931 draft admission to resolver
 evidence

---
 .github/workflows/tests.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a762d574a..08923a151 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    types: [opened, synchronize, reopened, closed]
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
 
 permissions:
   contents: read
@@ -19,7 +19,7 @@ concurrency:
 jobs:
   pytest:
     name: Full test suite
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -87,7 +87,7 @@ jobs:
 
   frontend:
     name: Frontend lint, test, build
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

From 307c29e96cf85ee61d690b852a115983e2985d27 Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Sat, 5 Sep 2026 03:22:40 +0900
Subject: [PATCH 59/64] fix(postgres): verify server identity by default

Use verify-full when a synchronous network DSN omits sslmode. Preserve plaintext fallback only for an explicit prefer policy.

Signed-off-by: Codex <codex@localhost>
---
 ...0363-synchronous-postgresql-default-tls.md | 48 +++++++++++++++++++
 lineageweave/postgres_sync.py                 | 11 +++--
 tests/test_postgres_sync_sslmode_contract.py  | 35 ++++++++++----
 3 files changed, 79 insertions(+), 15 deletions(-)
 create mode 100644 docs/adr/0363-synchronous-postgresql-default-tls.md

diff --git a/docs/adr/0363-synchronous-postgresql-default-tls.md b/docs/adr/0363-synchronous-postgresql-default-tls.md
new file mode 100644
index 000000000..5bc7301e9
--- /dev/null
+++ b/docs/adr/0363-synchronous-postgresql-default-tls.md
@@ -0,0 +1,48 @@
+# ADR 0363 — Verify synchronous PostgreSQL server identity by default
+
+**Decision status:** Proposed  
+**Date:** 2026-09-05
+
+## Context
+
+LineageWeave's synchronous administrative and test adapter accepts PostgreSQL
+URIs and translates their transport policy to pg8000. PostgreSQL documents
+`sslmode=prefer` as a backwards-compatibility default that may reconnect in
+plaintext and does not authenticate the server. That behavior is unsuitable as
+an implicit product default for credentials in transit. Explicit DSN policy
+must remain representable for controlled compatibility paths.
+
+## Decision
+
+A network DSN that omits `sslmode` uses `verify-full`: TLS is required, the
+certificate chain is validated, and the requested hostname must match. It never
+retries in plaintext. An explicit `sslmode=prefer` remains TLS-first with
+plaintext fallback only after PostgreSQL's exact SSL-refusal response.
+`disable`, `require`, `verify-ca`, and `verify-full` retain their documented
+meanings. Unix-socket inference remains unavailable because the adapter cannot
+recover libpq's socket selection from a hostless URI.
+
+## Consequences
+
+- Accidental network DSNs fail closed against untrusted or mismatched servers.
+- Existing private-CA deployments must install their CA or state an explicit
+  reviewed compatibility mode; a silent downgrade is no longer possible.
+- Explicit `prefer` remains weaker and must be chosen in the DSN rather than
+  inherited from an omission.
+
+## Alternatives considered
+
+### Keep implicit `prefer`
+
+Rejected because an SSL-refusing endpoint can cause credential-bearing tooling
+to reconnect without encryption.
+
+### Default to `require`
+
+Rejected because encryption without certificate and hostname verification does
+not authenticate the server.
+
+## References
+
+- PostgreSQL 18, *SSL Support* and *Database Connection Control Functions*.
+- pg8000 1.31.5, `ssl_context` connection contract.
diff --git a/lineageweave/postgres_sync.py b/lineageweave/postgres_sync.py
index 2d505f70a..8785153a3 100644
--- a/lineageweave/postgres_sync.py
+++ b/lineageweave/postgres_sync.py
@@ -230,7 +230,7 @@ def connection_kwargs_from_dsn(
         if not query["application_name"]:
             raise ValueError("PostgreSQL application_name must not be empty")
         kwargs["application_name"] = query["application_name"]
-    kwargs["ssl_context"] = _ssl_context_for_mode(query.get("sslmode", "prefer"))
+    kwargs["ssl_context"] = _ssl_context_for_mode(query.get("sslmode", "verify-full"))
     if "options" in query:
         startup_params["options"] = query["options"]
     if startup_params:
@@ -388,14 +388,15 @@ def connect(dsn: str, *, connect_timeout: float | int | None = None) -> Connecti
     pg8000 reports transport failures as ``InterfaceError`` and PostgreSQL
     startup refusals such as authentication/database errors as ``DatabaseError``.
     Both occur before a connection exists and therefore preserve the historical
-    ``OperationalError`` contract used by reachability probes. Libpq's default
-    ``sslmode=prefer`` is preserved by trying encrypted transport first and
-    falling back to plaintext only when PostgreSQL explicitly refuses SSL.
+    ``OperationalError`` contract used by reachability probes. A DSN without
+    ``sslmode`` uses the product's fail-closed ``verify-full`` policy. Explicit
+    ``sslmode=prefer`` retains TLS-first behavior and falls back to plaintext
+    only when PostgreSQL explicitly refuses SSL.
     """
 
     parsed = urlsplit(dsn)
     query = dict(parse_qsl(parsed.query, keep_blank_values=True))
-    sslmode = query.get("sslmode", "prefer").lower()
+    sslmode = query.get("sslmode", "verify-full").lower()
     kwargs = connection_kwargs_from_dsn(dsn, connect_timeout=connect_timeout)
     try:
         native = _dbapi.connect(**kwargs)
diff --git a/tests/test_postgres_sync_sslmode_contract.py b/tests/test_postgres_sync_sslmode_contract.py
index caf805f76..f790ed24b 100644
--- a/tests/test_postgres_sync_sslmode_contract.py
+++ b/tests/test_postgres_sync_sslmode_contract.py
@@ -11,18 +11,10 @@
 from lineageweave.postgres_sync import OperationalError, connect
 
 
-@pytest.mark.parametrize(
-    "dsn",
-    (
-        "postgresql://alice:secret@db.example/archive",
-        "postgresql://alice:secret@db.example/archive?sslmode=prefer",
-    ),
-)
 def test_libpq_prefer_semantics_attempt_tls_before_plaintext_fallback(
     monkeypatch: pytest.MonkeyPatch,
-    dsn: str,
 ) -> None:
-    """Default/explicit prefer must try encrypted transport before server-refusal fallback."""
+    """Explicit prefer must try encrypted transport before server-refusal fallback."""
     attempts: list[object] = []
     native_connection = SimpleNamespace(autocommit=False)
 
@@ -39,12 +31,35 @@ def fake_connect(**kwargs: object) -> object:
 
     monkeypatch.setattr("lineageweave.postgres_sync._dbapi.connect", fake_connect)
 
-    connection = connect(dsn)
+    connection = connect("postgresql://alice:secret@db.example/archive?sslmode=prefer")
 
     assert connection._inner is native_connection
     assert len(attempts) == 2
 
 
+def test_default_sslmode_verifies_identity_without_plaintext_fallback(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """An omitted mode must verify certificate and host and never retry in plaintext."""
+    attempts = 0
+
+    def refuse_ssl(**kwargs: object) -> object:
+        nonlocal attempts
+        attempts += 1
+        ssl_context = kwargs["ssl_context"]
+        assert isinstance(ssl_context, ssl.SSLContext)
+        assert ssl_context.check_hostname is True
+        assert ssl_context.verify_mode == ssl.CERT_REQUIRED
+        raise _dbapi.InterfaceError("Server refuses SSL")
+
+    monkeypatch.setattr("lineageweave.postgres_sync._dbapi.connect", refuse_ssl)
+
+    with pytest.raises(OperationalError):
+        connect("postgresql://alice:secret@db.example/archive")
+
+    assert attempts == 1
+
+
 def test_prefer_does_not_downgrade_on_arbitrary_transport_failure(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:

From 76c0e67712aefe473e6f86d499039769c1139157 Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Sat, 5 Sep 2026 03:45:16 +0900
Subject: [PATCH 60/64] docs(postgres): accept default TLS decision

Signed-off-by: Codex <codex@localhost>
---
 docs/adr/0363-synchronous-postgresql-default-tls.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/adr/0363-synchronous-postgresql-default-tls.md b/docs/adr/0363-synchronous-postgresql-default-tls.md
index 5bc7301e9..6f50f0bcb 100644
--- a/docs/adr/0363-synchronous-postgresql-default-tls.md
+++ b/docs/adr/0363-synchronous-postgresql-default-tls.md
@@ -1,6 +1,6 @@
 # ADR 0363 — Verify synchronous PostgreSQL server identity by default
 
-**Decision status:** Proposed  
+**Decision status:** Accepted
 **Date:** 2026-09-05
 
 ## Context

From 17365653d261d7a13398038c8dff20caa8036c06 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 5 Sep 2026 03:46:24 +0900
Subject: [PATCH 61/64] test(adr): reserve non-colliding TLS decision number

---
 .../test_postgres_sync_adr_number_contract.py | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 tests/test_postgres_sync_adr_number_contract.py

diff --git a/tests/test_postgres_sync_adr_number_contract.py b/tests/test_postgres_sync_adr_number_contract.py
new file mode 100644
index 000000000..de5b234f4
--- /dev/null
+++ b/tests/test_postgres_sync_adr_number_contract.py
@@ -0,0 +1,21 @@
+"""Govern the synchronous PostgreSQL TLS ADR identity and proposal status."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_EXPECTED_ADR = _REPO_ROOT / "docs" / "adr" / "0366-synchronous-postgresql-default-tls.md"
+_COLLIDING_ADR = _REPO_ROOT / "docs" / "adr" / "0363-synchronous-postgresql-default-tls.md"
+
+
+def test_postgres_sync_tls_adr_uses_unclaimed_number_and_stays_proposed() -> None:
+    """The TLS decision must not collide with ADR 0363 or pre-accept itself."""
+    assert _EXPECTED_ADR.exists()
+    assert not _COLLIDING_ADR.exists()
+
+    text = _EXPECTED_ADR.read_text(encoding="utf-8")
+    assert text.startswith("# ADR 0366 — Verify synchronous PostgreSQL server identity by default\n")
+    assert "**Decision status:** Proposed" in text
+    assert "**Decision status:** Accepted" not in text

From 57122947c4f814449ebcec1a6eb5f5ae52f924bb Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 5 Sep 2026 03:46:34 +0900
Subject: [PATCH 62/64] docs(adr): move PostgreSQL TLS proposal to 0366

---
 ...0366-synchronous-postgresql-default-tls.md | 48 +++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 docs/adr/0366-synchronous-postgresql-default-tls.md

diff --git a/docs/adr/0366-synchronous-postgresql-default-tls.md b/docs/adr/0366-synchronous-postgresql-default-tls.md
new file mode 100644
index 000000000..723accc05
--- /dev/null
+++ b/docs/adr/0366-synchronous-postgresql-default-tls.md
@@ -0,0 +1,48 @@
+# ADR 0366 — Verify synchronous PostgreSQL server identity by default
+
+**Decision status:** Proposed  
+**Date:** 2026-09-05
+
+## Context
+
+LineageWeave's synchronous administrative and test adapter accepts PostgreSQL
+URIs and translates their transport policy to pg8000. PostgreSQL documents
+`sslmode=prefer` as a backwards-compatibility default that may reconnect in
+plaintext and does not authenticate the server. That behavior is unsuitable as
+an implicit product default for credentials in transit. Explicit DSN policy
+must remain representable for controlled compatibility paths.
+
+## Decision
+
+A network DSN that omits `sslmode` uses `verify-full`: TLS is required, the
+certificate chain is validated, and the requested hostname must match. It never
+retries in plaintext. An explicit `sslmode=prefer` remains TLS-first with
+plaintext fallback only after PostgreSQL's exact SSL-refusal response.
+`disable`, `require`, `verify-ca`, and `verify-full` retain their documented
+meanings. Unix-socket inference remains unavailable because the adapter cannot
+recover libpq's socket selection from a hostless URI.
+
+## Consequences
+
+- Accidental network DSNs fail closed against untrusted or mismatched servers.
+- Existing private-CA deployments must install their CA or state an explicit
+  reviewed compatibility mode; a silent downgrade is no longer possible.
+- Explicit `prefer` remains weaker and must be chosen in the DSN rather than
+  inherited from an omission.
+
+## Alternatives considered
+
+### Keep implicit `prefer`
+
+Rejected because an SSL-refusing endpoint can cause credential-bearing tooling
+to reconnect without encryption.
+
+### Default to `require`
+
+Rejected because encryption without certificate and hostname verification does
+not authenticate the server.
+
+## References
+
+- PostgreSQL 18, *SSL Support* and *Database Connection Control Functions*.
+- pg8000 1.31.5, `ssl_context` connection contract.

From 034dfc42f78c89f315bf06836c71c838de9dfd72 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 5 Sep 2026 03:46:43 +0900
Subject: [PATCH 63/64] docs(adr): remove colliding TLS ADR 0363

---
 ...0363-synchronous-postgresql-default-tls.md | 48 -------------------
 1 file changed, 48 deletions(-)
 delete mode 100644 docs/adr/0363-synchronous-postgresql-default-tls.md

diff --git a/docs/adr/0363-synchronous-postgresql-default-tls.md b/docs/adr/0363-synchronous-postgresql-default-tls.md
deleted file mode 100644
index 6f50f0bcb..000000000
--- a/docs/adr/0363-synchronous-postgresql-default-tls.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# ADR 0363 — Verify synchronous PostgreSQL server identity by default
-
-**Decision status:** Accepted
-**Date:** 2026-09-05
-
-## Context
-
-LineageWeave's synchronous administrative and test adapter accepts PostgreSQL
-URIs and translates their transport policy to pg8000. PostgreSQL documents
-`sslmode=prefer` as a backwards-compatibility default that may reconnect in
-plaintext and does not authenticate the server. That behavior is unsuitable as
-an implicit product default for credentials in transit. Explicit DSN policy
-must remain representable for controlled compatibility paths.
-
-## Decision
-
-A network DSN that omits `sslmode` uses `verify-full`: TLS is required, the
-certificate chain is validated, and the requested hostname must match. It never
-retries in plaintext. An explicit `sslmode=prefer` remains TLS-first with
-plaintext fallback only after PostgreSQL's exact SSL-refusal response.
-`disable`, `require`, `verify-ca`, and `verify-full` retain their documented
-meanings. Unix-socket inference remains unavailable because the adapter cannot
-recover libpq's socket selection from a hostless URI.
-
-## Consequences
-
-- Accidental network DSNs fail closed against untrusted or mismatched servers.
-- Existing private-CA deployments must install their CA or state an explicit
-  reviewed compatibility mode; a silent downgrade is no longer possible.
-- Explicit `prefer` remains weaker and must be chosen in the DSN rather than
-  inherited from an omission.
-
-## Alternatives considered
-
-### Keep implicit `prefer`
-
-Rejected because an SSL-refusing endpoint can cause credential-bearing tooling
-to reconnect without encryption.
-
-### Default to `require`
-
-Rejected because encryption without certificate and hostname verification does
-not authenticate the server.
-
-## References
-
-- PostgreSQL 18, *SSL Support* and *Database Connection Control Functions*.
-- pg8000 1.31.5, `ssl_context` connection contract.

From 5d40eed35a0b6e0d182397f8d02b29c38e9bdd17 Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Sat, 5 Sep 2026 07:12:29 +0900
Subject: [PATCH 64/64] docs(postgres): remove ADR trailing whitespace

Signed-off-by: Codex <codex@localhost>
---
 docs/adr/0366-synchronous-postgresql-default-tls.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/adr/0366-synchronous-postgresql-default-tls.md b/docs/adr/0366-synchronous-postgresql-default-tls.md
index 723accc05..a8a8fb16a 100644
--- a/docs/adr/0366-synchronous-postgresql-default-tls.md
+++ b/docs/adr/0366-synchronous-postgresql-default-tls.md
@@ -1,6 +1,6 @@
 # ADR 0366 — Verify synchronous PostgreSQL server identity by default
 
-**Decision status:** Proposed  
+**Decision status:** Proposed
 **Date:** 2026-09-05
 
 ## Context