[jeremi]

Summary

Realistic reviewed registries could pass authoring checks and then fail candidate preparation at a hidden migration ceiling. Candidate failures also discarded their cause, while dev-session log filtering and concealed inbox source refusals left operators without useful diagnostics.

• Raise the shared migration statement budget from 1,024 to 4,096, align package validation, migration-ledger bounds and the database interlock, and upgrade the legacy ledger constraint transactionally during successor activation. Raise the bounded manifest allowance from 4 MiB to 8 MiB so these packages can actually publish and load. Data validation/import/export reuse the integrity-verified manifest instead of applying their smaller checkpoint-file bound. Production checks report the initial-DDL budget as a warning; --deny-warnings enforces it without rejecting valid baseline-derived successor plans.
• Keep test.candidate.refused, adding the value-free package error variant and failing stage at all four call sites.
• Emit one bounded source-refusal summary per Casework staffing page. Explicit denials and contract changes use WARN; concealed or moved sources use INFO, which is available with the shipped runtime configuration. Caller responses and concealment remain unchanged.
• Preserve warning-level BReg diagnostics in bregctl dev while retaining stdout/stderr capture.
• Add an executable two-reference array-claim fixture and authenticated regression coverage for successful, partially authorized, missing-claim and malformed-claim callers.
• Reconcile Action precondition documentation and generated schemas with omission/empty-object equivalence for unconditioned immediate Actions. Keep Proposal and guarded-Action requirements intact; refresh affected generated contracts and the identifier catalog hash.

Closes #2427
Closes #2428
Closes #2429
Closes #2430
Closes #2431
Refs #2432

Evidence

Focused checks use a disposable PostgreSQL/PostGIS database.

Protected CI passed for the submitted revision, including all selected Rust, PostgreSQL 18, native-binding, contract, configuration, catalog and documentation jobs. CodeQL also passed with no new alerts in the changed code.

• cargo test --locked -p registry-breg --features postgres-test,tooling,schema --test postgres_package: the 66 existing cases passed. The two added capacity cases initially exposed the manifest-size ceiling; after fixing it, both passed in a focused rerun. They activate initial and reviewed successor packages above 1,024 statements, including rehearsal rollback and a legacy ledger constraint. The strengthened legacy case also measures the old constraint's actual fingerprint, forces a precondition failure after maintenance begins, and successfully retries the exact pinned target on PostgreSQL 18.
• cargo test --locked -p registry-breg --features postgres-test,tooling,schema --test postgres_multi_reference_action_authority: passed. Signed tokens traverse the authenticator and router; north-only and south-only claims independently refuse the opposite reference, and omitted/empty preconditions replay one receipt.
• cargo test --locked -p registry-breg --features postgres-test,tooling,schema --test problem_code_catalogues --test postgres_proposal_review_delivery: 5 and 40 passed, including the existing terminal-refusal warning/redaction regression.
• Focused review regressions: all 50 data-lifecycle tests passed, including the reproduced large-manifest refusal; both compiled revision/DDL pin tests and all 12 PostgreSQL 18 schema-rehearsal tests passed. BReg and CLI library suites passed with their existing opt-in tests ignored. CLI suite: 175 passed. Explain contracts: 28 passed; tool schemas, source conventions, refactor contracts and access-log tests passed. Coverage includes production-budget warnings, candidate stage/cause preservation and dev-child logging/capture.
• Casework library: 96 passed, 3 existing opt-in tests ignored; PostgreSQL acceptance: 64 passed; HTTP: 31 passed. The added refusal-summary tests exercise the shipped INFO filter, aggregation, redaction and unchanged list/next responses.
• Clippy with -D warnings: all targets for the three owning crates without optional PostgreSQL test features passed; all changed PostgreSQL/HTTP targets with those features also passed. cargo fmt --all -- --check and git diff --check passed.
• CLI documentation/language-server compatibility and Rust client contract suites passed. Product validation, runner inventory tests, identifier reference closure and catalog reproducibility passed. Facility and minimal generated trees reproduce their committed baselines.
• Native smoke: bregctl dev start on a fresh copy of products/breg/fixtures/multi-reference-array-claim, using both binaries rebuilt from the final committed source, exited successfully with ok: true and status: ready. Its maintained journeys run before the service becomes ready.
• Documentation: 918 tests passed; production build, internal links, critical-page accessibility and scoped Vale checks passed. OpenAPI validation passed with 202 existing warnings.
• ShellCheck passed for the modified runner. Changeset secret scanning passed.

Notes

The ledger upgrade runs within the existing migration-authorized transaction. On legacy databases, its constraint change commits when maintenance begins and remains after later failure; recovery uses the exact target or the pre-activation backup, as documented in the operator lifecycle. Statement, manifest, per-file and total-package bounds remain explicit; oversized manifests are refused before publication creates an output directory. Operator summaries contain fixed failure classes, without task counts, identities, tokens, profile values or provider error strings.

The remaining #2432 enhancement, identifying a stale input in a 412 response, is deferred. Persisted handoff refusal details and cross-project doctor checks are also deferred.

Verification limits: the broad optional-PostgreSQL all-target Clippy invocation encounters an unchanged unused helper in postgres_native_retention; the changed database targets pass separately. Global Vale and shfmt report existing findings outside the edited prose and unchanged shell formatting. Protected CI supplies the broader regression coverage and is green for this revision; no merge or release is performed here.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T17:52:01.664912Z	11cbb17	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.