…fication

Evidence-based verification of the P1 baseline chain on a throwaway local
PostgreSQL 16 cluster (created and destroyed in-session; production never
touched):

- PR #250's drift finding independently corroborated: PR #248's
  initDatabase()-derived candidate re-materialized and counted with the
  operator's exact catalog queries — 125 tables / 1595 columns / 400
  indexes / 275 non-PK / 267 FKs, matching the drift table exactly and
  confirming the ~54-column shortfall vs production (1649).
- Guard checks on main: db:migrate inert (no meta/_journal.json — migrate.ts
  skips), no prod-baseline directory merged, baseline-preview quarantined,
  initDatabase() still the runtime schema source (the drift engine).
- New finding feeding back into PR #250's runbook: the Step 2 artifact fix
  (grep int4_ops) is too narrow — 149 wrong-opclass tokens exist in at
  least three forms, including text_ops-on-timestamptz which hard-fails on
  apply (reproduced); amendment: normalize ALL explicit opclass tokens.
- Hard gates documented: the Gate 1 production snapshot is operator-held
  (no dump in-tree) and PG18 requires Docker (no daemon here) — so the
  final authoritative baseline is operator-executed per the amended
  runbook; fabricating it from in-repo sources is explicitly not done.
- Verdict + exact remaining path: merge PR #250, close PR #248 as
  superseded, operator runs the amended runbook, commit the 1649-column
  authoritative baseline; then P2.

Docs only — no code changes, no migrations, no schema changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMnfvQvtgNQwiUvPJ4ff8Z

…fication (#279)

Production Readiness P1: evidence-based verification of the authoritative
database baseline plan. Docs-only — adds
docs/audit/production-readiness/P1_AUTHORITATIVE_BASELINE.md (132 lines).

- Independently corroborated PR #250's drift finding: PR #248's
  initDatabase()-derived candidate re-materialized on a throwaway
  PostgreSQL 16.13 cluster reproduces every candidate-side count exactly
  (125 tables / 1595 columns / 400 indexes / 275 non-PK / 267 FKs) vs
  real production's 1649 columns — the candidate must never be adopted.
- New finding (runbook amendment): the replacement runbook's opclass fix
  step is too narrow — 149 wrong-opclass tokens in three forms, including
  text_ops on timestamptz which hard-fails on apply; amendment: normalize
  ALL <type>_ops tokens.
- Guard verification on main: no live migration journal (db:migrate inert),
  no prod-baseline directory, baseline-preview quarantined, initDatabase()
  drift engine documented.
- Final baseline generation remains operator-gated (Gate 1 snapshot +
  PG18); no baseline adopted, no schema changes, no code changes.
- Throwaway cluster destroyed and verified.

Evidence-based PG18 verification, executed on a genuine PostgreSQL 18.4
server obtained without Docker (npm @embedded-postgres/linux-x64).
Docs-only: adds docs/audit/production-readiness/P2_PG18_VERIFICATION.md.

- Candidate baseline (normalized per P1 amendment) applies cleanly on
  PG18.4 with identical structural counts to PG16 and PR #250
  (125/1595/400/275/267); raw candidate hard-fails on PG18 exactly as
  on PG16, re-proving the normalize-all-opclasses amendment.
- Zero-DDL mark-as-applied, journal integrity, and replay safety proven
  end-to-end on PG18 with the real drizzle migrator; drizzle hash =
  sha256 of the shipped SQL file.
- Rollback safety: full baseline is transactional DDL on PG18 (explicit
  ROLLBACK and mid-apply failure both leave 0 objects).
- Live initDatabase() engine runs cleanly on PG18.4 (0 failures,
  pgcrypto OK, identical shape) — the app can start on PG18 today.
- Integrity: 0 invalid indexes, 0 unvalidated constraints, amcheck
  bt_index_check passes 400/400 btree indexes.
- New runbook amendment: introspected SQL ships fully block-commented
  and applies as a silent no-op (rc 0, zero objects) unless uncommented.
- P1 errata recorded (byte size 169,833; opclass token counts 437
  total / ~189 wrong). Snapshot-dependent items remain operator-gated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMnfvQvtgNQwiUvPJ4ff8Z

Production Readiness P2: evidence-based PostgreSQL 18 verification,
executed on a genuine PostgreSQL 18.4 server obtained without Docker
(npm @embedded-postgres/linux-x64). Docs-only — adds
docs/audit/production-readiness/P2_PG18_VERIFICATION.md (193 lines).

- Normalized candidate baseline applies cleanly on PG18.4 with counts
  identical to PG16 and PR #250 (125/1595/400/275/267); raw candidate
  hard-fails on PG18 as on PG16, re-proving the normalize-all-opclasses
  amendment.
- Zero-DDL mark-as-applied, journal integrity, and replay safety proven
  end-to-end with the real drizzle migrator (hash = sha256 of file).
- Rollback safety: full baseline is transactional DDL on PG18.
- Live initDatabase() runs cleanly on PG18.4 (0 failures, pgcrypto OK,
  identical shape).
- Integrity: 0 invalid indexes, 0 unvalidated constraints, amcheck
  passes 400/400 btree indexes.
- New runbook amendment: introspected SQL ships block-commented and is
  a silent no-op unless uncommented (rc 0, zero objects).
- P1 errata recorded (169,833 bytes; 437 opclass tokens / ~189 wrong).
- Snapshot-dependent items remain operator-gated; no baseline adopted,
  no schema/code changes, no production deployment.