Reconcile reviewed runtime strings and runtime platform A–D

[Dastari]

Summary

Reconcile the reviewed #112 string/binding fix and runtime-platform A–D into one exact-source candidate for final owner review. PostgreSQL prefix/suffix predicates now execute successfully through B's CAS and authority checks and D's repeated GraphQL mutation groups. SQLite empty suffixes match all non-null strings. The combined tests retain backend-emitted bind accounting before protected reads and prove atomic journaling and a single execution per validated response-key group.

The combined source was accepted at 78ad237b7d4d491da595c99eadd8c61e0f00f9db. Owner-authorized merges completed in order #112 → #97 → #113 → #114 → #115 → #116 using the exact tested reconciliation trees. Related PR heads were reconciled onto owner-merged predecessors; all original reviewed commits remain ancestors. Unrelated worktrees remain unchanged. Publication is pending: the protected release workflow remains paused.

Slice	PR	Exact reviewed predecessor
String predicates/native binding	#112	01d4134da18028ec58e318e0ffd30ab244d0d8e1
A: owned runtime migrations	#97	f2665ce68ed7fdbccb272cb8a783b6379ae5fd82
B: transactional runtime mutations	#113	04a1216aff86141ff6500b1dd0bf9adb4b0c6447
C: dynamic reads/composition	#114	9d4cca34cb04ab0fd27c8313215001591f495c43
D: dynamic mutations/grouping	#115	3a59d08be5b663ac952de418eb02dc6321ee08e7

Actual merge base: owner-merged D 531fa07117ce5b02a3a126be36d9a0c45e30c0d1; reconciled head: 6249f06d4346c71040c1422de6f30cc064f3eb8b; merge: 24bfb3cca6c099b6d60dd6fb2913fd9ec2cab83a. This merge has exactly the accepted tree f79851ff958a16a64996452d9bc82368ec6af9f4. Published-main baseline remains df474c761c4057cb643e27a6582dd0376f56e31f (ORM/macros 0.39.0). Aligned ORM/macros are 0.43.0, unpublished.

Required documentation completion followed in #117. Final main is 25355ddc38a04848adcc14d8beef36ef722d49a8, tree c6b2b2d3dacbc0fb1af1826b59e1819a84906a19. Differences from the reviewed tree are only docs/plans/README.md and the accepted contract/evidence move from docs/plans/active/runtime-platform-capabilities/README.md to docs/plans/completed/runtime-platform-capabilities/README.md, with completion metadata/checkpoint updates. Exact Git-tree comparison proves all nine package trees, root manifests/lock, license and release workflow unchanged. Affected documentation and release metadata gates were rerun and passed. A deterministic source-only preview bundle for workspace-2026.10.12.1 is prepared locally, without reserving/tagging/publishing that identity.

The integration merges reconcile only conflicting version/changelog/documentation/build metadata. Relative to reviewed D, production runtime code differs only by the reviewed #112 changes in backend.rs, dialect.rs, and runtime_query.rs. New regression tests exercise their combined behavior. Generated inventory, locks and example version references retain 0.43.0. Every new commit includes [skip ci].

Verification

All commands use CARGO_BUILD_JOBS=2, disk-backed scratch and sequential backend lanes on rustc 1.97.1. SQLite resources are test-owned. PostgreSQL execution provisions disposable PostgreSQL 17 Docker resources with unique ownership metadata and verifies resource identity before cleanup. Ambient application database URLs are rejected. No sibling repository or actual application database is accessed.

Local lane	Actual result
SQLite runtime/migration/naming	147 passed, 0 failed, 0 ignored
SQLite static timestamps/aggregates	23 passed, 0 failed, 0 ignored
SQLite external consumer + legacy migration fixture	2 + 1 passed, 0 failed, 0 ignored
PostgreSQL runtime/migration	134 passed, 0 failed, 0 ignored; includes explicitly enabled owned string execution tests
PostgreSQL static timestamps/aggregates	15 passed, 0 failed, 0 ignored; owned tests explicitly enabled
PostgreSQL external consumer + legacy migration fixture	4 + 1 passed, 0 failed, 0 ignored; plain repository consumer also compiled
MSSQL unit/rendering/pre-I/O rejection + migration fixture	48 + 1 passed, 0 failed, 0 ignored; no live MSSQL database execution
Host examples	SQLite: all 3 entry points executed. PostgreSQL: journal and GraphQL entry points executed; string run executed in the owned consumer test, while its standalone main is compile/run-only and prints instructions.
Formatting, scoped warnings-denied Clippy/Rustdoc, mixed SQLite/MSSQL compilation	Passed in all three scoped lanes; formatting and SQLite/MSSQL coexistence compile also passed
Static public API compatibility vs released main	223 pass, 30 tool skips; no semver update required against 0.39.0 (default/static feature lane)
Documentation/inventory/dependency/release policy/state/manifest/router notices	Passed; 194 governed Markdown files, generated inventory, dependency boundaries, all 9 package release states, manifest and 13 router notice tests

Selected test binaries leave no ignored tests unexecuted. PostgreSQL tests conventionally marked ignored were explicitly enabled with --include-ignored or --ignored. Provider-inapplicable tests remain excluded by cfg; full workspace/provider suites and hosted release jobs were not run.

Runtime coverage includes static/owned fixed points and legacy source compatibility; required/nullable PostgreSQL DateTime with no default and CurrentTimestamp; host Integer timestamps; legacy unsupported DateTime diagnostics; managed ownership, incoming FK/rebuild rejection, RLS preservation, stale/destructive plans and transactional rollback; CAS concurrency and physical bind budgets; pinned authorization and private projections; atomic journals and caught-cancellation poisoning; confidential AEAD cursor round-trips/tampering/bindings; JSON text/null and exact scalars; alias swaps and filter intent through empty-list lowering; independently authorized committed outputs/deleted preimages; repeated inline/fragment create/update/delete/CAS groups, distinct-alias order and terminal failures.

The new combined cases are reconciled_prefix_suffix_cas_preserves_unicode_empty_and_bound_values and reconciled_string_cas_runs_once_through_graphql_and_atomic_journals. emitted_suffix_bind_budgets_precede_target_reads_for_cas_and_authority now runs the formerly gated PostgreSQL success boundaries. All execute on both owned backends. PostgreSQL prefix/suffix CAS and SQLite empty suffixes are successful database execution evidence, rather than rendering-only assertions.

Reproduction commands

export CARGO_BUILD_JOBS=2
export TMPDIR="$HOME/.local/share/graphql-orm-test-scratch"
mkdir -p "$TMPDIR"
cargo fmt --all -- --check

# Run SQLite first, then PostgreSQL; never run workspace --all-features.
cargo test -p graphql-orm --locked --no-default-features --features sqlite,runtime-graphql \
  --lib --test runtime_graphql --test graphql_naming --test runtime_strings \
  --test runtime_queries --test runtime_relations --test runtime_mutations \
  --test runtime_migrations --test runtime_schema_ir --test runtime_migration_memory \
  --test migration_planner --test migration_apply --test legacy_migration_history \
  -- --test-threads=1
cargo test -p graphql-orm --locked --no-default-features --features postgres,runtime-graphql \
  --lib --test runtime_graphql --test runtime_strings --test runtime_mutations \
  --test runtime_migrations --test runtime_schema_ir --test runtime_migration_memory \
  --test migration_planner --test migration_apply --test legacy_migration_history \
  -- --include-ignored --test-threads=1

fixture=crates/graphql-orm/tests/fixtures/repository-aggregate-consumer/Cargo.toml
compat=crates/graphql-orm/tests/fixtures/migration-api-compatibility/Cargo.toml
cargo test -p graphql-orm --locked --no-default-features --features sqlite \
  --test host_timestamps --test grouped_aggregates --test complete_group_pages \
  --test portable_group_pages -- --test-threads=1
cargo test -p graphql-orm --locked --no-default-features --features postgres \
  --test host_timestamps --test grouped_aggregates_postgres --test portable_group_pages \
  -- --ignored --test-threads=1
cargo test --manifest-path "$fixture" --locked --no-default-features --features sqlite -- --test-threads=1
cargo test --manifest-path "$fixture" --locked --no-default-features --features postgres \
  --test runtime_strings --test host_timestamps --test owned_backend --test portable_groups \
  -- --ignored --test-threads=1
cargo check --manifest-path "$fixture" --locked --no-default-features --features postgres

# Sequentially repeat these scoped checks for sqlite and postgres.
cargo clippy -p graphql-orm -p graphql-orm-macros --locked --no-default-features \
  --features sqlite,runtime-graphql --lib --test runtime_strings --test runtime_migrations \
  --test runtime_graphql --test runtime_mutations --example runtime_graphql_reads \
  --example runtime_mutation_journal -- -D warnings
RUSTDOCFLAGS=-Dwarnings cargo doc -p graphql-orm -p graphql-orm-macros --locked \
  --no-default-features --features sqlite,runtime-graphql --no-deps

# Compile the original migration enum namespace and API contracts in each lane.
for backend in sqlite postgres mssql; do
  cargo test --manifest-path "$compat" --locked --no-default-features --features "$backend"
done
cargo test -p graphql-orm --locked --no-default-features --features mssql,runtime-graphql \
  --lib --test runtime_graphql_unsupported --test runtime_migrations_unsupported
cargo clippy -p graphql-orm -p graphql-orm-macros --locked --no-default-features \
  --features mssql,runtime-graphql --lib --test runtime_graphql_unsupported \
  --test runtime_migrations_unsupported -- -D warnings
RUSTDOCFLAGS=-Dwarnings cargo doc -p graphql-orm -p graphql-orm-macros --locked \
  --no-default-features --features mssql,runtime-graphql --no-deps
cargo check -p graphql-orm -p graphql-orm-macros --locked --no-default-features \
  --features sqlite,mssql,runtime-graphql --lib

base=df474c761c4057cb643e27a6582dd0376f56e31f
env -u CARGO_TARGET_DIR cargo semver-checks -p graphql-orm \
  --manifest-path crates/graphql-orm/Cargo.toml --baseline-rev "$base" \
  --default-features --release-type patch
python3 scripts/check-documentation.py --base "$base"
python3 scripts/generate-workspace-inventory.py --check
bash scripts/check-workspace-dependencies.sh
bash scripts/check-package-release-policy.sh "$base"
python3 scripts/check-release-state.py
bash scripts/check-release-manifest.sh
python3 scripts/test-router-notices.py

Public APIs and compiled host examples

No interface deviation from the reviewed contract. A uses ValidatedRuntimeSchema::physical_schema, with_static_entities, explicit ManagedTableSet, read-only plan_owned_migration, separate guarded apply_owned_migration, and runtime_mutation_environment. B uses schema-bound create/update/delete requests and MutationContext::mutate_runtime within the existing pinned transaction runner; ordinary typed repository journal inserts share that transaction. C/D opt into runtime-graphql with RuntimeGraphqlModule, checked composition, host RuntimeReadAuthority/RuntimeWriteAuthority, mutation hooks and host-owned cursor protection.

External-consumer examples (no direct async-graphql dependency): the SQLite entry points all execute. PostgreSQL journal/GraphQL entry points execute; the string example's PostgreSQL main only prints instructions. Its public run function executes through the owned PostgreSQL consumer test below.

fixture=crates/graphql-orm/tests/fixtures/repository-aggregate-consumer/Cargo.toml
# Run the entire SQLite loop first. PostgreSQL requires Docker.
for example in runtime_strings runtime_mutation_journal runtime_graphql_reads; do
  cargo run --manifest-path "$fixture" --locked --no-default-features \
    --features sqlite,runtime-graphql --example "$example"
done
cargo test --manifest-path "$fixture" --locked --no-default-features --features postgres \
  --test runtime_strings -- --ignored --test-threads=1
for example in runtime_mutation_journal runtime_graphql_reads; do
  cargo run --manifest-path "$fixture" --locked --no-default-features \
    --features postgres,runtime-graphql --example "$example"
done

Examples exercise bound prefix/suffix reads, A's owned planning/application and physical certification, B's required-key/CAS/atomic host journal operations, and C/D checked host composition, confidential cursor protection, committed mutations and independent result authorization. Example cursor keys are disposable; production keys and policy/public-revision validation belong to the host.

Compatibility, limitations and owner handoff

Existing static APIs, enum imports/struct literals, repository-only consumers, GraphQL behavior and internal cursor formats are preserved. The string fix requires no data migration. Runtime migrations remain explicit; plans are read-only and unsupported physical semantics fail closed. Use sqlite,runtime-graphql or postgres,runtime-graphql for C/D, and the individual backend for framework-neutral A/B. Runtime MSSQL capabilities reject before I/O; live MSSQL execution is not claimed.

Approved limitations remain: locked dynamic custom-directive factory registration rejects unsupported_capability before schema publication; host extensions/built-ins/checked subscriptions remain available. Hosts provide authenticated cursor encryption with no raw-cursor fallback. Runtime mutations are exact single-record operations, not bulk/nested writes or new upsert semantics. Unsupported modifying incoming cascade actions remain rejected. Legacy epoch-second DateTime defaults stay unsupported while Integer defaults and host-managed integer timestamps retain their semantics. Cancellation poisoning belongs to runtime B; catching an inner static mutation timeout and returning Ok still does not guarantee rollback. Post-commit output denial/error/timeout reports committed/nonretryable status and never implies rollback. Transport or cancellation after commit can leave outcome uncertainty. No durable event replay is claimed.

Actions remain paused. Future workflow test coverage is retained, but no workflows were enabled, dispatched or rerun by this work. Hosted checks are not run; local verification is the evidence. No tag or release is created.

For Digibase adoption, review and ordered merges are complete. The owner must still complete the full protected release validation/publication workflow and provide a published immutable workspace tag, resolved full source SHA, aligned ORM/macros versions/features, manifest/checksum and attested exact-source provenance. The release runbook requires that protected workflow; it cannot be dispatched while Actions remain paused. The complete workspace release matrix and workflow attestation have not run. No publication gate is claimed complete. The downstream host then pins that reviewed released identity, verifies its own SQLite/PostgreSQL string gates and A–D integration contracts, supplies its policies/journal/cursor protector, and activates schemas outside the ORM. This unpublished candidate is not an adoption release. Digibase/agql-auth/sibling worktrees remain untouched.

Documentation impact

• Documentation updated
• No documentation impact

Explanation: update the runtime mutation/GraphQL references and the approved active plan checkpoint to distinguish the reconciled implementation from owner merge/release; retain string/null semantics, all accepted limitations, changelog/migration/version guidance and exact predecessor identities. Documentation and generated-inventory checks are included in verification.