[ARCH.DB.1] Inventory and ratchet concrete persistence leakage

[alseif0x]

Summary

• inventories concrete persistence access with exact AST identities and production/test/generated splits
• records reviewed logical-database, capability-owner, affinity, ordering, error and unknown-commit semantics per workflow
• generates and validates the canonical persistence boundary policy reproducibly
• adds executable guards for inventory growth, unowned workflows, stale authority and uncovered typed database targets
• synchronizes the architecture ledger, dependency policy and documentation

Scope

This is an architecture-governance change only. It does not change runtime behavior, SQL statements or database schemas.

Validation

• tools/pr-preflight.sh architecture
• tools/pr-preflight.sh quick 2d94ee51
• tools/pr-preflight.sh full 2d94ee51
• three independent final audits: code, governance/reproducibility and semantic policy

Closes #186

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3409947c6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alseif0x]

@codex review

Please re-review the latest commit 41debe7d, including the fixes and adversarial regressions for all three resolved threads.

[chatgpt-codex-connector]

💡 Codex Review

rustycore/tools/architecture/handler-contract-check/src/persistence_access.rs

Lines 916 to 920 in 41debe7

	UseTree::Rename(rename) => {
	let source_name = normalized_ident(&rename.ident);
	let local = normalized_ident(&rename.rename);
	let mut source = prefix.clone();
	source.push(source_name);

Normalize grouped self-renames as namespace aliases

When code uses the legal grouped alias form use wow_database::{self as db};, this branch appends self to the source path and produces wow_database::self rather than treating db as an alias of the wow_database namespace. Consequently, both the import and a subsequent db::CharacterDatabase type reference are absent from the inventory, so this concrete database dependency can be introduced without tripping the non-growth snapshot. Handle renamed self leaves the same way the preceding UseTree::Name branch handles an unrenamed self leaf.

---

rustycore/tools/architecture/handler-contract-check/src/persistence_access.rs

Lines 2314 to 2315 in 41debe7

	let known_persistence_method = operation.is_some();
	if !known_persistence_method && !FLOW_PASSTHROUGH_METHODS.contains(&name.as_str()) {

Record pool escapes for unvalidated executor-named methods

When a concrete pool is passed to an unrelated method whose name happens to be execute, fetch_one, or another executor name, operation is populated but the receiver validation above rejects the operation because the receiver has no persistence flow. This line nevertheless treats the call as known and suppresses argument-escape recording; for example, adding sink.execute(pool) where pool: &MySqlPool and sink is a local helper produces no new call or escape row beyond the already-baselined parameter. Only suppress escape handling when the persistence operation was actually validated and recorded.

---

rustycore/tools/architecture/handler-contract-check/src/persistence_access.rs

Lines 1086 to 1090 in 41debe7

	let name = field
	.ident
	.as_ref()
	.map(normalized_ident)
	.unwrap_or_else(|| "tuple_field".to_owned());

Track unnamed fields by their numeric member

When a tuple struct or tuple enum variant stores a concrete database value, symbol collection registers every unnamed field under the literal key tuple_field, while expression analysis looks up accesses such as .0 under the key 0. Thus, after a wrapper like struct Adapter(CharacterDatabase) is baselined, adding adapter.0.pool() does not produce a pool-access row because neither the wrapper parameter nor its numeric field carries persistence flow. Store unnamed fields using the same numeric member identity consumed by field_flow.

---

rustycore/tools/architecture/handler-contract-check/src/persistence_access.rs

Lines 1747 to 1748 in 41debe7

	Expr::Macro(expression) => self.flow_of_macro(&expression.mac),
	_ => Flow::default(),

Fail closed on unmodeled persistence-bearing expressions

When a concrete persistence value flows through an expression variant not listed here, the analyzer silently drops the flow instead of rejecting or propagating it. For example, in a function whose pool: MySqlPool parameter is already baselined, let hidden = loop { break pool }; consume(hidden); adds no value-alias or argument-escape row: Expr::Loop takes this default, and visits to the known local paths are intentionally ignored. Unsupported arrays, loops, indexing, async blocks, and similar value-bearing expressions can therefore launder pools past the non-growth guard; conservatively propagate their child flow or fail closed when they contain a known persistence value.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict unknown-outcome inference to commit semantics

When any persistence row's symbol merely contains unknown, this marks the entire workflow as requiring definite-rollback versus unknown-COMMIT reconciliation. The current generated policy therefore assigns that guarantee to Database::open_with_pool_size_and_auto_create_like_cpp solely because it calls is_unknown_database_error_like_cpp, even though that path only classifies a connection error and performs no commit or reconciliation. This leaves the semantic ledger inaccurate and can impose or preserve nonexistent failure behavior during later extractions; infer this guarantee only from outcome-aware commits or explicit reviewed reconciliation evidence.

Useful? React with 👍 / 👎.