# Proof audit, pass 1 — relay quota reservation

**Findings first**

1. **Evidence is pending.** No runtime capture was supplied or executed in this pass. The proposed real Postgres 17 driver is suitable for quota and reservation behavior, provided it uses the actual layers and the same PgClient instance for each check/reservation transaction. Screenshots and client/UI passes do not apply: the entire diff is server-side relay code.
2. **The count changed as well as the lock.** The old query counted only allocations joined to an active, managed-enabled link, regardless of tunnel/release/timestamp. The new query counts another environment for the same user iff `updated_at > T−15m OR (tunnel_id IS NOT NULL AND tunnel_released_at IS NULL AND NOT EXISTS same-user/same-environment revoked-or-disabled link)`. Missing links qualify for the live branch. Recent released/revoked/publish-only rows count deliberately in the supplied code and PR description; do not capture their immediate exclusion as the expected result. If the product requirement is immediate quota release, that requirement contradicts this head and needs a decision, not a passing transcript.
3. **The existing test does not establish the SQL predicate or real transaction propagation.** The sole added ManagedTunnelLimits test models count as an array length and uses a fake lock. Provider tests also use fake allocations/limits. The PR body mentions a window test and earlier PG probes, but no matching window test exists at the reviewed head and those probes are not captures for this local revision. Minimum proof includes row snapshots, timestamp refresh, and lock/transaction scope, beyond a single `3 reserved / 3 denied` summary.
4. **Reservation conflict behavior also changes.** Same-PK conflict updates only `updated_at` and returns the stored allocation. A new PK colliding on hostname/tunnel_name now yields a database-request allocation error; the old DO NOTHING + missing lookup yielded resolve-reservation. Rollback and provider stage mapping must remain intelligible.
5. **Two entry paths share one changed boundary.** Ordinary managed linking and managed tunnel recovery both call `ManagedEndpointProvider.provision`; ready reuse is attempted only after capacity/reserve. The direct DB driver cannot by itself prove provider error mapping, commit-before-CF ordering, or recovery behavior. Label provider/API harness captures accurately; live Cloudflare provisioning is unavailable and is not required to claim proof of the DB race fix.

Reviewed read-only in `/home/ubuntu/wt/pr-26186`: [#26186](https://git.cafe/pingdotgg/t3code/pull/26186), local branch `pr-26186`, proposed branch `t3/fix-relay-quota-race`, [2102cdbc8d](https://git.cafe/pingdotgg/t3code/commit/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf) against [f120c51134](https://git.cafe/pingdotgg/t3code/commit/f120c51134c6b5f20b42f51cda84e3e6da681a5f). `origin/main` equals that base at inspection. The remote PR still has [2bc2abb140](https://git.cafe/pingdotgg/t3code/commit/2bc2abb1403244c4972264da30eb2e9e46bc727a); its checks/reviews cannot validate the unpushed local head. No edits, pushes, comments, test runs, DBs, containers, or servers were made/started during this audit. Only requested scratch artifacts and read-only PR metadata were written outside the worktree.

**Fixture matrix**

`M` = minimum capture set for this proof; `C` = useful compatibility control (may be folded into the minimum sweep); `X` = extended fault/precondition coverage, listed so paths are not silently omitted. Every row is pending capture. A table row can contain parameter variants with identical outcomes; reset fixtures between those variants. “Before → after” refers to the supplied base/head, not the remote PR head. `DB` means actual layers + actual PgClient + drizzle effect-postgres, never reimplemented counting SQL. `A/L/O`, `N/V/R`, clock and seed SQL are defined below.

| ID | Named fixture | Data and action | Expected before → after | Diff effect | Capture / timing | Status |
|---|---|---|---|---|---|---|
| S01 | Sequential fresh environments / default limit | Empty A/L/O for U; request E1..E4 in order, no tunnel/link writes. | 4 reservations / 4 committed rows → 3 reservations, then Exceeded(active=3,max=3); only 3 rows. | Changed | DB | M; pending |
| S02 | Recent allocation with active link | O(U,1); A(U,E0,N or V or R,recent); L(U,E0,active); request Enew. | Count 1 → 1; deny in all 3 tunnel variants. | Control | DB + time | C; pending |
| S03 | Recent reservation overrides link exclusions | O(U,1); A(U,E0,N or V or R,recent); L absent, revoked, or publish-only; request Enew. | Count 0 → 1; allow → deny. All 9 combinations share this outcome; include released+revoked and live+publish-only explicitly. | Changed | DB + time | M; pending |
| S04 | Old live tunnel with active link | O(U,1); A(U,E0,V,old); L(active); Enew. | Count 1 → 1; deny. Age does not expire a live tunnel. | Control | DB + time | C; pending |
| S05 | Old live tunnel without a link | O(U,1); A(U,E0,V,old); no L; Enew. | Count 0 → 1; allow → deny. A provision abandoned after recordTunnel still consumes quota. | Changed | DB + time | M; pending |
| S06 | Old live tunnel with excluded link | O(U,1); A(U,E0,V,old); L(revoked) or L(publish-only); Enew. | Count 0 → 0; allow. Also revoked+managed=false is excluded, not a new outcome. | Control | DB + time | M; pending |
| S07 | Old tunnel-less or released allocation with active link | O(U,1); A(U,E0,N or R,old); L(active); Enew. | Count 1 → 0; deny → allow. An active link alone no longer establishes usage. | Changed | DB + time | M; pending |
| S08 | Old tunnel-less/released allocation without active link | O(U,1); A(U,E0,N or R,old); L absent/revoked/publish-only; Enew. | Count 0 → 0; allow in all 6 combinations. Includes abandoned reservations and old released rows. | Control | DB + time | M; pending |
| S09 | Strict fifteen-minute boundary | O(U,1); A(U,E0,N,cutoff−1ms / cutoff / cutoff+1ms), no L; reset between probes; Enew. | Before: allow all. After: allow / allow / deny. Exact cutoff is expired (strict >). Repeat at cutoff with V+no L: still deny after via live branch. | Changed | DB + fixed time | M; pending |
| S10 | Link with no allocation | O(U,1); L(U,E0,active); no A(U,E0); Enew. | Count 0 → 0; allow. Link-only data cannot consume quota. | Control | DB | C; pending |
| S11 | User and correlated-link scope | (a) O(U,1), only V+active allocation for W (same E0), Enew for U; (b) A(U,E0,V,old), L(W,E0,revoked), no L(U,E0); (c) L(U,Eother,publish-only). | (a) allow → allow: other user ignored; (b,c) allow → deny: unrelated link must not suppress U/E0. Reset (b,c) separately. | Mixed | DB + time | M; pending |
| S12 | Current environment at and over quota | 3 old V+active allocations E0,E1,E2 for U, default 3; request E0. Then add E3 and request E0 again. | At limit: count other envs=2, allow → allow, one E0 row. Over limit: count=3, deny → deny. Excluding self is not an unconditional bypass. | Control | DB | M; pending |
| S13 | Per-user overrides, including zero | O(U,1): existing old V+active E0 then Enew; reset O(U,5): 4 old V+active then two sequential new; reset O(U,0): empty then Enew. Give W a different override. | 1: deny → deny. 5: first allow both, second allow before / deny after (pending fifth now counts). 0: deny at count 0 both; no callback. W override never applies to U. | Mixed | DB | M; pending |
| R01 | Re-reserve refreshes only timestamp and returns stored identity | O(U,1); old A(U,E0) in N+absent, R+absent, V+revoked, V+publish-only variants; rich non-null metadata where applicable. Reserve E0 with DIFFERENT incoming hostname/name, then request Enew. | Before returns old timestamp; Enew allowed. After returns updatedAt=T, Enew denied. Existing hostname/name/tunnel/DNS/ready/origin/recovery/generation/released/createdAt stay unchanged; row count stays 1. | Changed | DB + fixed time | M; pending |
| C01 | Six concurrent fresh environments | Empty U, default 3; 6 E values, common start gate outside wrapper, 50ms logged delay inside each reservation before real reserve. Use at least 2 independent PgClient pools/runtime instances. | Before 6 success / 0 deny / 6 rows. After 3 success / 3 Exceeded(active=3,max=3) / 3 rows. Callback entry serialized per U across clients; success only after commit. | Changed | DB + concurrency | M; pending |
| C02 | Concurrent revival of six stale excluded rows | Default 3; 2 old N+no L, 2 old R+no L, 1 old V+revoked, 1 old V+publish-only. Simultaneously request all 6 existing environments with delayed callbacks. | Before all 6 succeed but remain old/excluded. After exactly 3 refresh to T, 3 fail, counted total 3. Do not assert winner order; PK/metadata preserved. | Changed | DB + concurrency + fixed time | M; pending |
| C03 | Concurrent retries of the same environment | Empty U, O(U,1); 6 concurrent calls for E0, identical identity; log callback/commit and inspect PK. | All 6 allowed both revisions; exactly one row. After refreshes updatedAt; self-exclusion prevents duplicate retries consuming 6 slots. This does not prove CF tunnel creation idempotency. | Mixed | DB + concurrency | C; pending |
| C04 | Different users proceed independently | Empty U and W, default limits; hold U first callback on a Deferred after lock, start W on separate client; release U only after W commits. | W commits while U held; after lock is per-user, not global. Both rows eventually commit. No elapsed-time assertion or all-callbacks barrier. | Control / new lock scope | DB + concurrency | M; pending |
| E01 | Reservation SQL failure / unique identity collision | O(U,1); old N+no L allocation for W owns hostname or tunnel_name; new Enew for U reuses it. Run each unique index variant; then valid U reservation. | Before reserve error stage=resolve-reservation (DO NOTHING then missing lookup); after stage=database-request (23505). Both operation=reserve, no new row; valid retry succeeds, proving lock released. | Changed | DB fault | M; pending |
| E02 | Typed callback failure rolls back reservation | Empty U; harness callback runs REAL reserve then fails a non-SqlError sentinel. Compare old ensureCapacity→callback and new withCapacity(callback); then valid retry. | Same sentinel preserved. Before inserted row persists; after insert rolls back and retry succeeds. Existing-row variant: after failed refresh, updatedAt restored. Inspect from fresh connection. | Changed | DB + labelled callback harness | M; pending |
| E03 | Interruption releases transaction / lock | Empty U; harness callback reserves E0, signals Deferred, awaits another Deferred; interrupt that fiber, then reserve E1 for U from a second client. | Before E0 persists; after E0 absent and E1 commits. Interruption remains interruption, not a limit/persistence typed failure. No background fibers left. | Changed | DB + concurrency / labelled callback harness | X; pending |
| E04 | Override SELECT fails | Disposable restricted non-owner role lacks SELECT on relay_managed_tunnel_limits; normal A/L access; empty or ordinary data; invoke Enew. | ManagedTunnelLimitPersistenceError(operation=load-limit,userId=U) both revisions; callback not run, no allocation committed. Restore role access and retry. | Control | DB fault (GRANT/REVOKE) | X; pending |
| E05 | Allocation/link count SELECT fails | Role can read overrides but lacks SELECT on A or L (separate variants); invoke Enew. | ManagedTunnelLimitPersistenceError(operation=count-tunnels,userId=U) both; callback not run; rollback/lock released after restoration. | Control | DB fault (GRANT/REVOKE) | X; pending |
| E06 | Advisory-lock statement fails | Not representable by seed rows. Label a RelayDb.execute fault-injection harness that fails only the lock statement; keep real layers otherwise. | After ManagedTunnelLimitPersistenceError(operation=lock-user,userId=U), callback not run. Before no corresponding statement/path. Do not imply this is a real PG lock-failure reproduction. | New | Labelled harness | X; pending |
| E07 | Transaction begin / commit fails | Not ordinary seed data. Label $client.withTransaction fault-injection harness for begin and commit SqlErrors separately; commit fixture must not report success before commit. | After ManagedTunnelLimitPersistenceError(operation=transaction,userId=U); begin never runs callback, commit never returns reservation success. Before no enclosing transaction. A fabricated commit error does not prove real ambiguous-commit recovery. | New | Labelled harness | M; pending |
| E08 | Reserve returns no row / defensive resolver | Not reachable through normal INSERT..ON CONFLICT DO UPDATE RETURNING on this schema. Label a DB-result harness returning [] from insert; before lookup also returns []. | ManagedEndpointAllocationPersistenceError(operation=reserve,stage=resolve-reservation) both. After no fallback select. No claim this is seeded PG behavior. | Control; changed fallback | Labelled harness | X; pending |
| P01 | Ordinary managed linking; commit before provider I/O | EnvironmentLinker.link managed=true → provider.provision → sole withCapacity/reserve call. SQL data as S01; real DB layers plus mocked tunnel/DNS clients and valid config/origin. | Reservation returns stored identity then tunnel list/create/record/config/DNS/token/ready. First mocked CF call reads committed allocation from a separate client; transaction lock is already released. | Changed order/boundary | Labelled provider harness + DB | M; pending |
| P02 | Recovery: ready reuse and fallback | recoverEnvironmentTunnelRecord → provider.provision(reuseReadyTunnel=true). Seed A(E0,V,old) ready/DNS/origin and active L, plus 2 other V+active rows; mock CF get/getToken success; repeat released/wrong-origin/missing-tunnel variants. | At default quota self excluded: reserve refresh then ready reuse (get/getToken only); ineligible ready allocation falls back to full provision after reservation. Over-quota uses S12 deny behavior before reuse. | Changed reservation; caller control | Labelled provider/API harness | M; pending |
| P03 | Provider quota error and no external side effects | S01 fourth request / S12 over-quota via provider; mock CF clients only. Exercise managed link and recovery mapping with service harness. | Provider preserves ManagedTunnelLimitExceeded; no reserve/CF calls on rejected check. Linking maps environment_link_limit_exceeded(maxTunnels); recovery maps internal_error/upstream_unavailable. | Control with new boundary | Labelled provider/API harness | M; pending |
| P04 | Provider maps limit persistence failures | Feed E04–E07 failures through real provider wrapping; no CF access; valid config/origin. | ManagedEndpointProvisioningFailed(stage=check-tunnel-limit, requested hostname/name, cause preserved). No CF calls. New lock/transaction failures must take this path too. | Mixed / new causes | Labelled provider harness | M; pending |
| P05 | Provider maps reservation persistence failure | Use E01 or injected reserve persistence error while within capacity; real provider wrapping. | ManagedEndpointProvisioningFailed(stage=reserve-allocation, requested hostname/name, cause preserved), not check-tunnel-limit; transaction aborts; no CF calls. | Control with new transaction | Labelled provider harness | M; pending |
| P06 | Preconditions and publish-only bypass | Label harness: provision non-loopback origin; missing CF config; digest error; EnvironmentLinker.link(managed=false). These are not allocation seed conditions. | First three fail before limit/reserve (OriginNotAllowed / ProvisioningNotConfigured / ProvisioningFailed derive-environment-hash). Publish-only links deprovision and upsert disabled L, never call withCapacity/reserve. Same before/after. | Control; static caller coverage | Labelled harness | X; pending |
| P07 | Failure after committed reserve; before/after recordTunnel | Label provider harness with CF failure before recordTunnel (tunnel-less) and after successful recordTunnel (live tunnel); do not write link; clock T then advance to >T+15m. | Reservation persists on both provider failures. After: both count while recent; at >15m N expires but V+absent L still counts. Before neither counts without L. Provider failure stage remains its existing CF/recording stage. | Changed quota aftermath | Labelled provider harness + DB/time | M; pending |

**Seed contract and clock**

Use synthetic data only in the lead-owned disposable Postgres 17 container. Apply every `migration.sql` under `infra/relay/migrations/postgres` in timestamp order, including the release/recovery columns and the unrelated migrations; do not use Drizzle push as a substitute. Record `SELECT version(), current_setting('transaction_isolation')`, the applied migration list/checksums, both full source SHAs, PgClient/drizzle versions, pool sizes, and the driver identity. No schema migration is in this diff.

Use `T = 2026-10-28T12:00:00.000Z`; cutoff `K = 2026-10-28T11:45:00.000Z`; `recent = 2026-10-28T11:59:00.000Z`; `old = 2026-10-28T11:00:00.000Z`; createdAt `2026-10-27T00:00:00.000Z`. Provide Effect's `Clock.Clock` with `currentTimeMillis` and `currentTimeMillisUnsafe` pinned to T for both layers; keep real sleep/monotonic behavior for capture delays. `DateTime.now` in both production modules reads that clock. For time-transition fixtures replace the logical clock explicitly, rather than waiting 15 minutes. Log each clock value and derived cutoff. SQL `now()` alone does NOT control the production cutoff. These columns are varchar: use canonical UTC ISO strings with the same millisecond precision, not PG timestamp casts or mixed offsets.

`U` and `W` are distinct synthetic users, e.g. `audit-u`, `audit-w`; `E0`, `Enew`, etc. distinct environment strings. Generate unique synthetic hostname and tunnel_name for every user+environment, including across users and parallel captures (except E01 intentionally). Use `.invalid` for synthetic hosts. No auth/account/credential/device rows are needed for the direct two-service DB driver; these tables have no foreign keys requiring them.

`A(u,e,state,time)` is an INSERT into `relay_managed_endpoint_allocations`. Supply `user_id`, `environment_id`, `hostname`, `tunnel_name`, `tunnel_id`, `tunnel_released_at`, `created_at`, `updated_at`. `N` = no tunnel: tunnel_id NULL, tunnel_released_at NULL. `V` = live: tunnel_id a unique synthetic non-null string, tunnel_released_at NULL. `R` = released: tunnel_id non-null, tunnel_released_at a canonical time <= updated_at. Other columns default NULL, generation defaults 0. A no-tunnel row with non-null releasedAt has the same count outcome as N/R, so it needs no independent fixture. For R01 additionally set metadata as shown and snapshot ALL columns before/after; reserve must only update updated_at, even when incoming hostname/name differ.

```sql
-- A: bind all parameters; :released_at is NULL except in R.
INSERT INTO relay_managed_endpoint_allocations
  (user_id, environment_id, hostname, tunnel_name, tunnel_id,
   tunnel_released_at, created_at, updated_at)
VALUES (:u, :e, :unique_hostname, :unique_tunnel_name, :tunnel_id,
        :released_at, :created_at, :updated_at);

-- R01 metadata, where applicable: keep hostname/name from A stable.
UPDATE relay_managed_endpoint_allocations
SET dns_record_id = 'synthetic-dns', ready_at = '2026-10-28T10:00:00.000Z',
    origin = '{"localHttpHost":"127.0.0.1","localHttpPort":3773}'::jsonb,
    recovery_enabled_at = '2026-10-28T10:00:00.000Z',
    recovery_environment_public_key = 'synthetic-public-key', generation = 7
WHERE user_id = :u AND environment_id = :e;
```

`L(u,e,state)` INSERTs `relay_environment_links` with the columns below. `absent` means no insert. `active` means managed_tunnels_enabled=true, revoked_at=NULL. `revoked` means true and revoked_at non-null. `publish-only` means false, revoked_at=NULL. Both revoked+disabled is equivalent to either for the count. Active/revoked fixtures use provider_kind=cloudflare_tunnel; publish-only can use a non-managed provider kind (the predicate only reads managed_tunnels_enabled/revoked_at). `endpoint_provider_kind`, URLs, keys, readyAt, DNS and recovery fields do not participate in the count. They matter only to provider/API harness eligibility. A link updated recently with an old allocation still uses the allocation timestamp; the link timestamp does not refresh quota.

```sql
INSERT INTO relay_environment_links
  (user_id, environment_id, environment_public_key,
   endpoint_http_base_url, endpoint_ws_base_url, endpoint_provider_kind,
   managed_tunnels_enabled, revoked_at, created_at, updated_at)
VALUES (:u, :e, 'synthetic-public-key', 'https://synthetic.invalid/',
        'wss://synthetic.invalid/ws', :provider_kind,
        :managed_enabled, :revoked_at, :created_at, :updated_at);

-- O(u,n): one override per user; omit this row for default=3.
INSERT INTO relay_managed_tunnel_limits
  (user_id, max_tunnels, created_at, updated_at)
VALUES (:u, :max_tunnels, :created_at, :updated_at);
```

Use `O(U,1)` for counting sweeps so a single E0 is observably enough to reject Enew, and the actual `ManagedTunnelLimitExceeded.activeTunnels` reports 1. Successful requests insert Enew, so reset to the listed seed before the next variant. With default=3, three copies of the listed E0 state are an equivalent seed. Do not insert an override of 0 intending “default”: 0 is an actual enforced limit; a negative integer similarly rejects even count=0, with no distinct branch. No override for U must remain the default even if W has one.

**How the matrix covers the changed predicate**

S02/S03 cover every recent combination of N/V/R × absent/active/revoked/publish-only. S04–S08 cover all old combinations of the same states. S09 covers equality and both sides of the strict cutoff, with the live branch as a guard against incorrectly expiring live tunnels. S10/S11/S12 cover missing allocation, correlation by both keys, user filtering, and the current environment exclusion. S13 covers fallback/override/zero and threshold equality. R01/C02 verify the upsert update that makes stale rows count again. This is a partition of observable count behavior rather than an arbitrary combinatorial list. Variants with identical count results can share a transcript section; do not conflate the two changed directions, 0→1 and 1→0.

**Caller and failure-path inventory**

- One production `withCapacity` caller and one production `allocations.reserve` caller: [ManagedEndpointProvider.ts](https://git.cafe/pingdotgg/t3code/blob/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf/infra/relay/src/environments/ManagedEndpointProvider.ts#L1172). The reserve Effect is constructed first but stays lazy; it must execute only inside the successful limit transaction. Ordinary provision and `reuseReadyTunnel=true` both pass this boundary.
- Ordinary linking: [EnvironmentLinker.ts](https://git.cafe/pingdotgg/t3code/blob/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf/infra/relay/src/environments/EnvironmentLinker.ts#L307). Managed=false goes through best-effort deprovision then link upsert, without this quota/reserve path. Managed=true provisions before links.upsert; hence a new reservation commonly has no link.
- Recovery: [Api.ts](https://git.cafe/pingdotgg/t3code/blob/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf/infra/relay/src/http/Api.ts#L675), `recoverEnvironmentTunnelRecord`, first validates current link/public key/provider kind, then provisions with `reuseReadyTunnel=true`. `registerManagedEndpointRecovery` reconciles/enables recovery but does not call provision/reserve. No additional desktop/web/mobile/render/provider-CLI paths changed.
- Limit service outcomes: success returns the supplied callback result; quota rejection skips callback and preserves typed fields; SQL failures at lock/load/count get their own operations; opening/committing transaction SqlErrors get `transaction`; non-SqlError callback failures pass through; interruption/defects stay Causes rather than being mapped to typed persistence errors. If a harness supplies a raw unwrapped SqlError from its callback, the outer mapper classifies it as transaction; the production reserve callback wraps its errors before that point.
- Allocation outcomes: new insert, same-PK timestamp-only upsert and RETURNING, insert/update SQL failure, and defensive empty RETURNING. Old conflict fallback SELECT was removed. S12/C03/R01 verify retained identity and one row per environment; E01 verifies other-unique-index conflict mapping; E08 is expressly synthetic.
- Provider mappings are P03/P04/P05. Preconditions before the boundary are P06. The unchanged post-reservation CF/recording stages include ensure-tunnel, validate-tunnel-response, record-tunnel (including claim-lost), configure-tunnel, record-dns, get-tunnel-token, mark-allocation-ready; they still occur after the capacity transaction. P07 represents the two quota-relevant failure aftermaths, before/after recordTunnel. A full replay of every unchanged CF error is outside this proof scope.
- ClaimRelease/claimDeprovision/recordTunnel/recordDns/markReady/enableRecovery also touch allocation.updatedAt. This is why recent released/revoked/disabled combinations must be captured rather than interpreted as impossible rows. The reaper does not call reserve/withCapacity; tunnel-less expiry is a count behavior, not deletion. No assertion should claim stale rows are physically removed.

**Minimum capture plan and acceptance**

Minimum rows: S01, S03, S05, S06, S07, S08, S09, S11, S12, S13, R01, C01, C02, C04, E01, E02, E07, P01, P02, P03, P04, P05, P07.
Compatibility controls: S02, S04, S10, C03. Extended paths: E03, E04, E05, E06, E08, P06. Capture them if available, or carry them as explicitly uncovered; the minimum sufficiency verdict concerns the M rows. Each row's variants specify the input partition; a compact scripted sweep may emit all variants in one transcript rather than one file per variant. Existing focused tests can supplement harness rows only when their exact command, head and result are included; unexecuted source inspection is not a capture.

1. One real-DB before/after transcript can sweep the S rows and R01, with a fixture manifest, clock/cutoff, normalized SQL snapshots before/after each attempt, returned result/error tag+fields+cause, and expected/actual comparison. Keep data reset and source version explicit; do not port the new predicate into an old-code simulation. Load the actual base ensureCapacity/reserve implementation and actual head withCapacity/reserve implementation separately. Apply the same migration set in isolated DBs/schemas and close their pools.
2. One race transcript can cover C01/C02/C04 (and C03). Log wall-clock event order separately from fixed logical time: attempt-start, callback-enter, delay-start/end, reserve-return, wrapper-return/commit, and row snapshots from an independent connection after wrappers finish. Use at least two independent clients/runtimes for the same-user race, no JS semaphore emulating the DB lock. Show backend PID/transaction identity where practical. The DB layer shared with each limits/allocations pair must use the same PgClient, so both calls inherit its transaction service. Do not accidentally serialize attempts in the driver; do not await a six-callback barrier inside the new lock (it would deadlock). The deliberate 50ms delay is recording evidence, not a timing assertion in a test.
3. Failure captures cover E01/E02/E07 minimally; E04/E05 can use real restricted-role grants, while E06–E08 require explicitly labelled fault injection. A real transaction rollback assertion must read persisted rows from a fresh connection, and be followed by a same-user reservation to show no leaked lock. A simulated begin/commit error only proves classification. A transport failure at COMMIT can have unknown outcome: do not claim universal rollback from that fault injection.
4. A labelled provider/API harness transcript covers P01–P05/P07 with the real provider and, where needed, real DB services; only CF/DNS/config/auth boundary inputs are synthetic. It must state “no Cloudflare resources were created; provider clients are mocked”. Existing provider/API tests offer useful scaffolding but do not establish the actual DB predicate. No live Cloudflare account, browser, screenshot, web/desktop/mobile UI pass, or product UI evidence is necessary for this server-only change.

**Coverage / scope limit**

Static inspection covered the complete five-file diff, the new test, related provider tests, both production provisioning callers, HTTP error mappings, allocation release/update behavior, schema/migrations, PgClient transaction scoping and drizzle effect-postgres execution through that client. No code bug was confirmed with a runtime reproduction in this pass; this is an evidence-design audit, not a merge approval. The proposed two-service driver alone leaves provider/API harness rows uncovered unless the lead adds that labelled capture or supplies focused test output.

FRICTION: none

VERDICT: INSUFFICIENT captures pending: S01, S03, S05, S06, S07, S08, S09, S11, S12, S13, R01, C01, C02, C04, E01, E02, E07, P01, P02, P03, P04, P05, P07