effect-jobs 0.1.0-alpha.0

package/specs/core-contract.md

@@ -0,0 +1,323 @@
+# Shared core contracts
+
+Implemented serial prerequisite for UPVE-1031, against accepted D1–D8 at
+`0e10e8a5a0b21101c00ea064e87ac641b73743c3`. The earlier
+`core-contract-proposal.md` is historical, not a merge input. This document freezes
+the contracts consumed by definitions/producer, lifecycle/store and codec units.
+It does not implement or qualify their runtimes or activate those tasks.
+
+## Modules and import directions
+
+The package exports these exact public subpaths (ESM and declarations):
+
+```text
+effect-jobs/JobId
+effect-jobs/JobIdentity
+effect-jobs/JobPolicy
+effect-jobs/JobFailure
+effect-jobs/JobContract
+effect-jobs/JobTransaction
+```
+
+The root remains empty, not an all-modules barrel. No subpath imports auth,
+PostgreSQL, Drizzle, environment configuration, pools, workers or registry Layers.
+No import starts work. The backend must not enter core through a default Layer.
+
+```text
+Effect <- JobId / JobIdentity / JobPolicy
+JobPolicy <- JobFailure
+JobId + JobIdentity + JobPolicy <- JobContract
+JobContract <- JobTransaction (public opaque capability and errors)
+JobContract + JobTransaction <- internal/JobTransaction (lifetime mechanics)
+JobContract + JobIdentity + JobPolicy + internal/JobTransaction <- later Job/JobProducer
+JobContract <- later JobPayload/JobPayloadCodec
+JobContract + JobFailure + JobPolicy <- later JobStore/internal/JobLifecycle
+shared contracts + qualified active application handle <- later backend bridges
+```
+
+`JobTransaction` has only a **type-only** reference to the internal symbol; the
+internal leaf imports its public errors at runtime. There is no runtime cycle.
+Only the later definition implementation and qualified backend bridges consume
+the internal leaf. `internal/*` is not a package export or custom-adapter API.
+The transaction declaration references the internal symbol declaration; that file
+must remain in the build artifact even though package export resolution denies
+runtime deep imports. Do not duplicate symbols, brands or errors in later units.
+
+## Identity and synchronous declaration validation
+
+`JobId.JobId` is a nonempty string Schema branded `effect-jobs/JobId`; the Schema
+and its inferred type share the name. IDs are library-assigned; their generation
+and uniqueness are backend obligations. No UUID algorithm or caller ID override
+is selected here. Schema decoding brands persisted IDs; it is not production.
+
+`JobIdentity` exports Schemas `QueueName`, `JobKind`, `JobVersion`, `OperationName`,
+`SlotName`, `OperationId`, `CatalogIdentity` and `ProducerIdentity`. The last two
+also have literal-preserving structural interfaces:
+
+```ts
+interface CatalogIdentity<
+  Q extends string = string,
+  K extends string = string,
+  V extends number = number
+> {
+  readonly queue: Q
+  readonly kind: K
+  readonly version: V
+}
+interface ProducerIdentity<O extends string = string, S extends string = string> {
+  readonly operation: O
+  readonly operationId: string
+  readonly slot: S
+}
+```
+
+Queue names are 1–64 characters; kind/operation/slot names 1–128, all ASCII
+`^[a-z][a-z0-9.-]*$`. Version is integer 1–32,767. These preserve source bounds.
+Operation IDs are valid scalar strings without NUL, 1–256 UTF-8 bytes, with exact
+equality: no trimming, normalization or case folding. Application-branded strings
+are accepted. Durable collation/equality must preserve this behavior.
+
+`validateOperationId(value: string): void` throws `InvalidOperationId` with only
+`rule: "unicode-scalars" | "no-nul" | "utf8-length"` and length-rule
+`byteLength`. It never includes the supplied ID. Untrusted non-string values use
+Schema validation at the consumer boundary; do not export raw Schema diagnostics
+containing sensitive inputs as enqueue errors.
+
+`validateProducerDeclaration({ operation: string, slots: ReadonlyArray<string> }):
+void` validates names, nonempty slots and uniqueness synchronously. It throws
+`JobDeclarationError` containing `field` (`operation`, `slots`, or `slots[index]`),
+the invalid declaration `value` where applicable, and actionable `expected` text.
+The producer unit **must call this before returning its immutable declaration**;
+there is no producer implementation here. It must preserve inferred operation and
+slot literals, reject undeclared slots, and copy/freeze its slot array. No global
+registry or mutable builder is needed.
+
+## Complete immutable policy
+
+Use `import * as JobPolicy from "effect-jobs/JobPolicy"` and
+`JobPolicy.make(options?: JobPolicyOptions): JobPolicy.JobPolicy`.
+Every public input field is optional:
+
+| Field              | Input                                | Default         |
+| ------------------ | ------------------------------------ | --------------- |
+| leaseDuration      | Effect Duration                      | 90 seconds      |
+| attemptTimeout     | Effect Duration                      | 30 seconds      |
+| retryDelay         | Effect Duration                      | fixed 5 seconds |
+| maxAttempts        | integer                              | 3               |
+| maxStalledCount    | integer                              | 1               |
+| completedRetention | Effect Duration or Duration.infinity | 90 days         |
+| deadRetention      | Effect Duration or Duration.infinity | infinity        |
+
+No raw millisecond input or hand-written `_tag` is required publicly. `make` is a
+synchronous configuration factory and throws `JobPolicyConfigurationError` with
+the exact `field` and `expected` constraint. Counters retain source limits:
+maxAttempts 1–100, maxStalledCount 0–100. Finite durations must resolve to integer
+milliseconds 1–253,402,300,799,999; no rounding, truncation or clamping. Zero,
+negative, fractional-millisecond and negative-infinity retention are rejected.
+Only positive infinity is Forever, and only for retention.
+
+`attemptTimeoutMillis < leaseDurationMillis` is mandatory. Response budget is
+backend configuration, not a policy field; later backend qualification must
+ensure the stored lease can support timeout plus its budget.
+
+The returned object and every nested configuration object are frozen:
+
+```ts
+interface JobPolicy {
+  readonly leaseDurationMillis: number
+  readonly attemptTimeoutMillis: number
+  readonly maxAttempts: number
+  readonly maxStalledCount: number
+  readonly retrySchedule: { readonly _tag: "FixedDelayV1"; readonly delayMillis: number }
+  readonly completedRetention: JobRetention
+  readonly deadRetention: JobRetention
+}
+type JobRetention =
+  { readonly _tag: "Forever" } | { readonly _tag: "Duration"; readonly millis: number }
+```
+
+`PersistedJobPolicy`, `FixedDelayV1`, `JobRetention`, `PositiveMillis` and
+`EpochMillis` are runtime Schemas. Persisted decode requires the **complete**
+resolved configuration and the cross-field constraint; it never fills current
+defaults into old rows. The layout is the V1 policy representation; concrete
+backend storage/version discriminator belongs to its schema task. Updated
+deployment defaults cannot rewrite retained rows.
+
+`EpochMillis` preserves the source positive integer bound 1–253,402,300,799,999
+for availableAt/notAfter; accepting epoch zero would be a policy change, not
+silently inferred from the superseded proposal. Ordinary past positive timestamps
+are valid. The backend must validate computed timestamp additions against the
+same bound rather than overflowing/clamping. No database-time arithmetic is
+implemented in this unit.
+
+## Handler and enqueue contracts
+
+`JobContract.HandlerInput<Payload>` is `{ readonly payload: Payload; readonly
+context: HandlerContext }`. Context contains exactly jobId, catalog, producer and
+attemptNumber, all readonly. No client, lease token, transaction, finalizer or
+ambient handler dependency service is exposed.
+
+attemptNumber is `attemptsMade + 1`. Claim/release do not increment attempts;
+confirmed fenced Complete/Retry/Dead/Isolate increments exactly once. Unknown
+leaves attempts unchanged; stalled recovery has its own counter. Consequently
+attempt numbers may repeat and are not external idempotency keys or invocation
+counts. Enforcing those transitions belongs to the lifecycle unit.
+
+`JobFailure` is a Schema/type union. `JobFailures` supplies checked frozen factories:
+
+```ts
+JobFailures.Retry({ code: string, notAfter?: number })
+JobFailures.Dead({ code: string })
+JobFailures.Isolate({ code: string })
+JobFailures.OutcomeUnknown({ code: string })
+```
+
+Codes are 1–64 characters matching `^[a-z0-9][a-z0-9_-]*$`; cutoffs use
+EpochMillis. Invalid factories throw `InvalidJobFailure { field: "code" |
+"notAfter" }`, without recording input text. Domain errors are mapped by ordinary
+Effect composition. Unknown is not a seventh lifecycle state; mixed causes,
+defects, interruption or timeout never imply known-safe Retry. Runtime boundaries
+must validate even structurally constructed failure values with `JobFailure`.
+
+`EnqueueInput<Payload>` has required producer, decoded payload, resolved policy
+and optional availableAt. No job ID is supplied. `EnqueueResults` is a
+`Data.taggedEnum` factory for `Inserted { jobId } | AlreadyPresent { jobId }`.
+Results remain provisional until application commit.
+
+For matching producer tuples, duplicate equality compares catalog and validated
+canonical semantic payload/fingerprints only. It excludes generated IDs, policy,
+initial/current availability, ciphertext randomness and lifecycle state. Matching
+duplicates return the original ID and retain first policy/availability. Omitted
+availability uses DB time only on first insertion. Conflicts are typed
+`JobIntegrityConflict` with no raw payload/identifiers; they cannot be swallowed
+to commit partial application writes.
+
+`InvalidJobInput { field }` and `JobPayloadCodecError { reason }` are bounded
+operation-owned errors. `JobTransaction.JobEnqueueError` unites those with
+JobIntegrityConflict and JobsTransactionClosed. Provider errors stay in the
+backend's explicit E channel, not raw public diagnostic strings.
+
+## Codec and prepared-payload seam
+
+`EncodedJobPayload` contains `formatVersion: 1`, `payloadBytes: Uint8Array` and
+`semanticProjectionBytes: Uint8Array`. `PreparedJob` contains catalog, producer,
+complete policy, optional availableAt and encoded. It has no generated candidate
+ID. Readonly byte properties **do not make Uint8Array immutable**: the codec owns
+its output buffers, and a receiver must copy before retaining them. Internal
+forwarding deliberately does not implement serialization or pretend to validate
+fake byte fixtures.
+
+Shared constants: payload and projection each 65,536 bytes; maximum depth 32;
+maximum protected subtrees 16; maximum UTF-8 schema path 256 bytes; formatVersion 1.
+The codec implements exported function-type contracts:
+
+```ts
+type JobPayloadEncoder = <S extends Schema.Top>(
+  schema: S,
+  payload: S["Type"]
+) => Effect.Effect<EncodedJobPayload, JobPayloadCodecError, S["EncodingServices"]>
+type JobPayloadDecoder = <S extends Schema.Top>(
+  schema: S,
+  encoded: EncodedJobPayload
+) => Effect.Effect<S["Type"], JobPayloadCodecError, S["DecodingServices"]>
+```
+
+The later codec exposes matching encode/decode functions; definitions must carry
+encoding services into enqueue and capture decoding/handler services through
+ordinary Layers. No `EncodingServices: never` limitation or hidden provisioning.
+
+Protected markers describe application-owned envelope/fingerprint Schemas.
+Require an **own** fingerprint with validated canonical JSON representation;
+semantic projection excludes the remainder of that subtree. Marking proves no
+encryption/authenticity. No projection callbacks, mandated crypto envelope, keys,
+automatic encryption or generic AAD are introduced here. Full marker/codec runtime
+and own-field checks belong to UPVE-857, not a parallel stub in contracts.
+
+Codec qualification must cover finite fractional JSON numbers, nonfinite rejects,
+locale-independent object order, meaningful array order, supported structs/arrays/
+optionals/unions and explicit unsupported transformed/recursive mapping. Decode
+validates format, bounds, UTF-8, schema and projection consistency before dispatch.
+Canonical projection comparison is not an authenticity proof.
+
+## Scoped explicit transaction seam
+
+`JobsTransaction<E = never, R = never>` is an opaque callback capability. It has
+no public constructor, arbitrary insert callback, query client, transaction
+runner, savepoint, commit, rollback or replay. Its symbol is internal only.
+
+The internal `withJoinedTransaction(insertOrCompare, body)` is a lifetime helper
+for **qualified backend callbacks**, not a generic public extension point:
+
+```ts
+withJoinedTransaction<A, E, R, BackendError, BackendRequirements>(
+  insertOrCompare: (prepared: PreparedJob) =>
+    Effect.Effect<EnqueueResult, BackendError | JobIntegrityConflict, BackendRequirements>,
+  body: (tx: JobsTransaction<BackendError, BackendRequirements>) => Effect.Effect<A, E, R>
+): Effect.Effect<A, E, R>
+
+insertPrepared<E, R>(tx: JobsTransaction<E, R>, prepared: PreparedJob):
+  Effect.Effect<EnqueueResult, E | JobIntegrityConflict | JobsTransactionClosed, R>
+```
+
+It allocates a fresh frozen capability per Effect execution, scopes the callback
+and invalidates it at callback exit on success, typed failure, defect, synchronous
+throw or interruption. Deferred/escaped enqueue Effects check liveness when run,
+before invoking the backend. Closed failure carries reason `callback-exited` and
+an actionable message directing enqueue into the joinTransaction callback.
+Callback-scoped fibers are scoped normally; unscoped escaping fibers and concurrent
+transaction operations are not supported. Branding/lifetime checks are atomicity
+correctness, not a sandbox against trusted application code or casts.
+
+The backend must bind the supplied exact active connection/source. The helper
+cannot prove connection provenance, insert correctness, rollback or durable
+atomicity, and these tests do not claim that it can. Custom adapters need a later
+explicit qualified backend extension contract, not a public re-export of this
+helper. No Effect SQL/Drizzle/pg compatibility claim exists yet.
+
+`JobTransactionsService<ManagerError, ManagerRequirements = never>` is the explicit
+configured manager integration contract, not an implementation or Context tag:
+
+```ts
+withTransaction<A, E, R>(
+  body: (tx: JobsTransaction<ManagerError>) => Effect.Effect<A, E, R>
+): Effect.Effect<A, E | ManagerError, R | ManagerRequirements>
+```
+
+A qualified integration delegates join-or-establish to the application's manager;
+it must not instantiate a second engine/pool. Explicit backend join must never
+open a new connection/transaction/savepoint, or independently commit/replay.
+Application owner retains whole-operation commit knowledge and replay authority.
+
+## Qualification and ownership
+
+Tests under `tests/core` exercise identity diagnostics, defaults and policy bounds,
+strict timeout edge, failure bounds, forwarding and capability lifetimes.
+`tests/types/contracts.ts` is included by the existing strict compiler gate,
+using positive assertions, checked `@ts-expect-error` cases and type-level
+service/error-negative assertions. Tests cover distinct Schema encode/decode
+requirements against real Effect 4.0.0 declarations.
+
+Source reference inspected read-only at auth revision
+`5c2e2b81c1aabb102d71894ecb6977611028b78a`: JobQueue, AuthJobs, AuthJobData and
+JobPayloadCodec bounds. Auth remains independent and untouched.
+
+This serial unit owns these six public contract modules, their internal
+transaction leaf, tests/core and tests/types/contracts, this specification and
+required package/root export integration. Later units must not edit shared
+contracts, package/lock/config or exports concurrently; request serial changes.
+No dependency/toolchain upgrade, worker, store, producer/registry, full codec,
+generic crypto, migration or backend is included.
+
+The current repository has no tracked `.github` workflow or extra gate scripts.
+The actual local CI-equivalent gate is package `verify`: check, lint, whole-tree
+format check, build and tests. Harness-generated untracked files are not owned:
+if whole-tree format fails on them, report that failure and independently check
+tracked/owned files without modifying runtime files. Exact command results,
+tool versions, read manifest and immutable base/head/tree are delivered in the
+issue report; this document does not invent successful future receipts.
+
+No PG or packed worker/backend qualification, database operation, push, PR,
+publication, runtime modification or merge is authorized. Temporal runtime edges
+(due `<=`, owned `>`, expiry `<=`, usable lease `>= timeout + budget`, retry cutoff
+`>= notAfter`, one DB-time snapshot) remain accepted obligations of later units;
+contract tests qualify only the policy inequality, not those unimplemented writes.

package/specs/drizzle-compatibility.md

@@ -0,0 +1,167 @@
+# Effect-native Drizzle compatibility
+
+This qualification targets exactly `drizzle-orm@1.0.0-rc.5-169397b`,
+`effect@4.0.0` and the compatible native peer `@effect/sql-pg@4.0.0`, on
+Node 24.15.0, Bun 1.4.2 and PostgreSQL 16.15. The owner accepted this dependency
+direction in UPVE-1032; UPVE-1165 owns its isolated compatibility qualification.
+The coordinator's prepared package/lock changes are part of the tested inputs.
+The existing production schema and backend need no runtime changes for this pin.
+
+## Actual driver and application bridge
+
+`drizzle-orm/effect-postgres.makeWithDefaults` requires the native `PgClient`
+service. It creates a session using that client; queries are Effects, executed
+through `client.unsafe(...).values`, `.withoutTransform` or `.raw`. The session
+wraps a transaction callback in `client.withTransaction`. A nested Drizzle
+transaction delegates to the session again: native Effect SQL emits a savepoint.
+The executable negative control confirms this on the real server.
+
+The qualification application registrar captures the exact connection published
+by **that client's** `transactionService`, inside its owning callback. A private
+WeakMap binds an opaque handle to source object, connection and active lifetime.
+`PostgreSqlJobs.joinTransaction` validates that registration and executes through
+the captured connection. It neither borrows nor calls another native transaction
+wrapper. A separate registrar around the same client is foreign. A Drizzle
+transaction object or structural query object alone is unqualified.
+
+Native raw int8 results are bigint. The application query adapter converts those
+top-level values to exact decimal strings, preserving the existing backend row
+contract and its bounds validation. It does not convert arbitrary int8 directly
+to potentially rounded JavaScript numbers. Drizzle's own query mapper handles
+the declared number-mode bigint columns. The existing custom bytea codec accepts
+the native Uint8Array result and copies it; its Buffer parameter encoding and
+binary bytes including zero and values above 127 round-trip on both runtimes.
+
+Native SQL control failures can occur as defects because Effect SQL uses `orDie`
+at the control boundary. Native COMMIT checks its actual command tag and rejects
+ROLLBACK. The fixture sanitizes recognized SQL provider reasons to bounded
+`PostgreSqlFailure`, conservatively Unknown for controls, and recognized Drizzle
+query failures to NotCommitted. Caller errors, defects, interruption and other
+reasons in mixed Causes remain caller-owned. It performs no retry or independent
+receipt reconciliation. The outer application manager owns durable commit.
+
+This is a concrete qualification application, **not a shipped universal native
+Drizzle adapter**. Applications must supply their actual registered capability
+and the complete documented application adapter contract. The probe does not
+qualify auth's executor, arbitrary native SQL configurations, other native driver
+versions, independent foreign unregistered transaction managers, concurrent
+operations on one connection, or exhaustive native control/network fault recovery.
+It adds no public constructor or changes to the core capability, lifecycle,
+worker, codecs, migrations, pool ownership or accepted D1–D8 decisions.
+
+## Executable qualification
+
+From the repository, with the private resource directory in
+`D6_RESOURCE_DIRECTORY` and the pinned runtimes on PATH:
+
+```sh
+timeout 60s bun install --frozen-lockfile
+# Run each fixture install in its directory, also with --frozen-lockfile.
+timeout 300s bun run build
+export EFFECT_JOBS_ARCHIVE=/path/to/immutable-versioned-effect-jobs.tgz
+timeout 300s node tests/qualification/drizzle-native/Run.mjs
+timeout 600s bun run verify
+timeout 300s bun run check:postgresql
+timeout 300s bun run test:postgresql:node
+timeout 300s bun run test:postgresql:bun
+timeout 600s bun run qualify:postgresql:installed
+```
+
+The release runner consumes the immutable `EFFECT_JOBS_ARCHIVE`, creates a fresh
+independent consumer, and installs that same archive with npm's normal peer resolver alongside
+the exact pins. It uses no force or legacy-peer-deps. It retains a lockfile,
+archive hash, root manifest hash, logs, consumer declarations and sanitized
+runtime receipts. Each child command is foreground and bounded to 60 seconds.
+It compiles the `.mts` fixture inside that consumer, outside the repository's
+core-only TypeScript include set; no native optional peer becomes a root
+development requirement. The runner prepares an ignored fixture-local dependency
+link for subsequent repository lint in a fresh checkout. All public exports are typechecked and imported on
+Node and Bun. Existing installed qualification separately proves imports without
+pg/Drizzle peers and strict non-Drizzle backend declarations.
+
+The 17 native assertions per runtime cover:
+
+- Native Drizzle domain + production enqueue/job/payload + receipt atomic commit.
+- Duplicate equality, original durable evidence and caught integrity conflict
+  causing actual outer COMMIT rejection, with one callback invocation.
+- Caller Context requirements and custom binary bytea read/write round trips.
+- Real CHECK failures at each of the four insertion boundaries, with zero
+  remaining writes and sanitized provider failures.
+- Matching physical backend PID, zero extra joined control statements, inner
+  success invisible to an independent observer and outer rejection rollback.
+- A real nested Drizzle savepoint as the negative control.
+- Private registration, foreign source, inactive handles and owned-operation
+  rejection inside an active native transaction.
+- Escaped capability rejection after success/failure/defect/interruption and
+  interruption after all four writes rolling back the complete operation.
+
+The original compatibility source PostgreSQL matrix passed 27 tests per runtime;
+installed production qualification passed 25 real-PG tests per runtime. The alpha
+release adds a public worker pipeline and records its larger final counts separately. The root test gate passes
+388 tests with 47 optional PG tests skipped when it has no PG environment; those
+skips are NotTested in that invocation. The explicit source and installed gates
+above supply the required real-PG evidence. Historical D6 receipts remain tied to
+their original snapshots and were not rerun for confirmation.
+
+## Declaration limits and reproducibility
+
+Consumer declarations pass with `skipLibCheck: true`, matching the repository's
+existing Drizzle setting. The runner also executes the full upstream declaration
+check with `skipLibCheck: false` and retains its **failure**, rather than claiming
+complete declaration compatibility. In this version Drizzle still imports the
+removed `effect/unstable/sql/SqlError` path; policy/role declarations also fail
+exact optional property checks. The fixture restores only the transaction
+function's error declaration to the actual pinned native `SqlError` at its
+explicit typed invocation boundary. It does not patch installed dependencies or
+hide that full upstream checking failed. Intentionally version-pinned unstable
+SQL API warnings are documented and disabled only in these two qualification
+modules; any/unknown Effect-channel diagnostics remain enabled.
+
+The initial fresh-worktree `verify` failed lint before build because an existing
+portable codec smoke imports absent `dist` declarations. Building first resolves
+that bootstrap issue; the subsequent complete `verify` passes. No shared test,
+manifest, root registrar or lint policy was changed to make it pass.
+
+The fixtures verify the exact task-owned container and deadline before use.
+Native objects use only the `drizzle_native` schema and `drizzle_native_runtime`
+role in `effect_jobs_d6`; application setup owns DDL and runtime uses its separate
+login. Native client scopes and observer/admin pools close in finally, and both
+runtime receipts confirm zero remaining fixture schemas and roles. Existing
+backend fixtures run serially. Container lifecycle stays with the coordinator.
+Credentials are read only in-process and are absent from argv, Git and receipts.
+
+No unresolved architecture decision or additional package dependency is needed
+for the qualified schema and producer path. The coordinator may register the
+new runner as a shared CI/package gate; that registry is outside author ownership.
+Publication, deployment, push, PR, merge and review dispatch remain outside this
+author's scope. Final exact Git and artifact receipts accompany the issue handoff.
+
+## Documentation read manifest
+
+All 16 recursive ai-docs files were read before implementation:
+
+- `ai-docs/README.md`
+- `ai-docs/tsconfig.json`
+- `ai-docs/src/index.md`
+- `ai-docs/src/01_services/10_services-and-layers.ts`
+- `ai-docs/src/01_services/20_module-consumption.ts`
+- `ai-docs/src/01_services/30_layer-composition.ts`
+- `ai-docs/src/02_modeling/10_schema-tagged-match.ts`
+- `ai-docs/src/03_errors/10_errors-and-causes.ts`
+- `ai-docs/src/04_observability/10_operation-observability.ts`
+- `ai-docs/src/05_resources/10_resources-interruption-secrets.ts`
+- `ai-docs/src/06_persistence/10_mutation-boundaries.ts`
+- `ai-docs/src/07_transport/10_wire-errors.ts`
+- `ai-docs/src/08_style/10_visible-code-and-modules.ts`
+- `ai-docs/src/09_testing/10_testing-and-review.ts`
+- `ai-docs/src/10_boundaries/10_external-time-regex.ts`
+- `ai-docs/src/fixtures/Auth.ts`
+
+Also read canonical UPVE-1020, assigned issue and required empty thread scan,
+the owner's parent decision thread, `specs/multica-workflow.md`, accepted
+`specs/architecture-decisions.md`, `specs/core-contract.md`,
+`specs/postgresql-backend.md`, `specs/d6-qualification.md`, current manifests,
+TypeScript configuration, production schema/producer/transaction seams, retained
+application-manager fixture, installed gate and actual installed Drizzle/native
+driver/codecs/Effect SQL transaction implementations. The author worktree has no
+repository-owned AGENTS.md. No auth repository or issue was written.