Compose Runlimit authentication attempts with atomic application outcomes

[featherenvy]

Summary

• Add optional PostgreSQL AttemptRunner: native admission, bounded verification outside a transaction, live receipt claim before application SQL, typed accepted/rejected decision and acknowledged atomic completion.
• Require PgProfiledPool for attempts so admission and completion share explicit role/schema/settings. The SQLx foundation owns the connect/acquire/release hooks; Runledger delegates to that same implementation.
• Add retained context-aware atomic completion (run_atomic_in and profile-owned run_atomic_profiled_in). No caller-managed outcome publication is needed.
• Preserve existing quota workflows while adapting to the native typed API. Pin merged Runlimit ci: reduce duplicate Rust builds and cache dependencies #9 and the Runledger Split Jig test verification into parallel targets #22 companion, with the documented consumer-root foundation patch.

Boundaries and compatibility

Runlimit owns limiter state/SQL, algorithms, budgets and migrations. Batter owns ordering and execution, not credential meaning, application audit schemas or production limiter policy. Rejected authentication commits failure state and audit; operational failure rolls back; stale receipts invoke no application writes. No automatic replay, separate reset or quota refund.

The attempt constructor now requires AttemptRunner::new(PgProfiledPool)?, not an arbitrary pool; fallback schema lists are rejected. This intentionally corrects the unpublished attempt API. Existing Runledger database signatures and quota semantics are preserved. Git consumers repeat the root batter-sqlx patch using their exact Batter revision for one foundation type identity.

Merge companion bpcakes/runledger#22 first. Downstream D-09 adoption remains separate. No consumer repository changes, tenants or passkeys are included.

Current validation

• Full bash scripts/verify.sh on Rust 1.98.1 and 1.94.0 passed, including strict Clippy/rustdoc and isolated feature/identity checks.
• All five HTTP smoke profiles passed on both toolchains.
• PostgreSQL 18.6: 14 live attempt tests and 26 owned atomic tests passed. New regressions cover restricted roles, quoted custom schemas, RLS settings, missing-table fallback rejection, invalid profiles and authority drift. Temporarily restoring unprofiled completion makes the new regression fail.
• Required Jig gates passed, including api:test receipt receipt_01M32CAHRTKVB1HCXT3KZ3RVXD; closeout reused unchanged Rust evidence and refreshed repository gates.
• A fresh GitHub-only consumer of the coordinated source pins compiled without sibling paths, even with RUNLEDGER_BATTER_SOURCE set to a nonexistent directory.
• Runledger companion: all 374 PostgreSQL and 497 runtime tests/doctests, nine packaged-consumer tests, native review and all five CI jobs passed.
• Independent boundary/bypass review found no additional concrete issue. Final native Codex review of the original stable range ac1275307b448244c4350f7174227e5b584031cb..004ed7280309bc427f160b7ec9f8be2914ee6be1, including closeout and final policy-check history, reported no findings. Current hosted checks are attached below.

Detailed evidence: docs/evidence/parallel-foundation-2026-09-21.md. The original P1 profile-loss finding is corrected at the shared ownership boundary. Earlier PR revisions and their validation remain in Git history; they are not current acceptance evidence.

[featherenvy]

Reconciliation follow-up: commit e2a1e9d pins all native Runlimit dependencies to PR #9 merge head c335806447bea60aadd08b46318a8d92dd45b68a (now includes master 62036e9). No adapter source changes; the lockfile changes only immutable Runlimit sources.

Validation passed: full scripts/verify.sh on Rust 1.98.1 and 1.94.0, Jig api:test, all 10 live PostgreSQL attempt cases, and all five HTTP process smoke profiles on both toolchains. Native Codex review over the unchanged original base ac12753..e2a1e9d reported no actionable regressions (code inspection; validation ran separately). Hosted CI is still running at the time of this comment.

The downstream local consumer pins both Batter and its required foundation patch to this same revision. No merge or publication performed.

[featherenvy]

Updated pin in 9d19b42 to Runlimit review-fix head 904abcf2aaee669f016720af7199fbc266e2d32d. No adapter source changes.

All local verification passes on Rust 1.98.1 and 1.94.0, including strict rustdoc and isolated features; Jig api:test, ten live attempt cases and five HTTP smoke profiles on both toolchains pass. Native review over the original ac12753..9d19b42 range is clean. The local downstream consumer is pinned and validated, with one foundation identity.

The previous head had one macOS smoke timeout: its unchanged 1 ms middleware deadline caught the fallback response before the test observed the expected 404. Duplicate same-head execution and local runs passed. All four macOS jobs at this final head now pass unchanged; no assertions or runtime behavior were weakened. Hosted Linux verification is still running.

[featherenvy]

Final hosted verification is green at 9d19b42: all Linux Rust 1.94.0, 1.98.1 and stable jobs, all macOS subprocess jobs, and repository-policy checks passed. No assertions were changed to address the earlier isolated 1 ms smoke timeout. Final native original-range review and local two-toolchain/live validation are clean. Runlimit PR #9 at 904abcf is also green, with the user-reported cleanup-index finding fixed. Ready for review; no merge or release performed.