Scope beyond title: this PR changes which allocations count, timestamp refresh, and transaction rollback as well as concurrent limits.

Capture coverage: 30/33 rows have runtime captures: 25 complete DB/fault rows (72/72 variants per side) and five partial provider unit-harness rows. Two rows (P04/P05) have no covering existing test; E01 is dropped as unreachable. Every row is accounted for; partial rows retain the unverified subcases below.

Ubuntu 24.04.5 LTS / Linux 6.1.102 x86_64; Node v26.12.1; Docker 29.1.3; Postgres 17.11, postgres:17@sha256:b8faeff7712663c2773a190181e1246e37e364b887611c04658c28b44e2408fe; PgClient 4.0.5 / Drizzle 1.0.0-rc.5-ab785fc; READ COMMITTED; two pools × 8; T=2026-10-28T12:00:00.000Z, K=11:45:00.000Z.
Before [f120c51134](https://git.cafe/pingdotgg/t3code/commit/f120c51134c6b5f20b42f51cda84e3e6da681a5f); after [2102cdbc8d](https://git.cafe/pingdotgg/t3code/commit/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf). Driver SHA256 f60e3c35e4829ab976e3df737d0736550469f6c11611b5fee9cb6d6403473581.

| Row | Fixture | Before [f120c51134](https://git.cafe/pingdotgg/t3code/commit/f120c51134c6b5f20b42f51cda84e3e6da681a5f) | After [2102cdbc8d](https://git.cafe/pingdotgg/t3code/commit/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf) | Expected / status |
|---|---|---|---|---|
| S01 | Sequential default limit | 4 reserved / 4 rows | 3 reserved; Exceeded(3,3) / 3 rows | PASS: 4 → 3 + deny |
| S02 | Recent + active, N/V/R | 3/3 denied(1,1) | 3/3 denied(1,1) | PASS: deny all |
| S03 | Recent × excluded/absent links, 9 variants | 9/9 reserved | 9/9 denied(1,1) | PASS: allow → deny all |
| S04 | Old live + active | denied(1,1) | denied(1,1) | PASS: deny |
| S05 | Old live, no link | reserved | denied(1,1) | PASS: allow → deny |
| S06 | Old live revoked/publish-only | 2/2 reserved | 2/2 reserved | PASS: allow both |
| S07 | Old N/released + active | 2/2 denied(1,1) | 2/2 reserved | PASS: deny → allow |
| S08 | Old N/released × absent/excluded | 6/6 reserved | 6/6 reserved | PASS: allow all |
| S09 | cutoff−1ms / cutoff / cutoff+1ms; live at cutoff | allow / allow / allow; live allow | allow / allow / deny; live deny | PASS: strict >; live branch persists |
| S10 | Link without allocation | reserved | reserved | PASS: allow |
| S11 | Other-user / wrong-user-link / wrong-env-link | allow / allow / allow | allow / deny / deny | PASS: correlate user+environment |
| S12 | Self retry at quota / over quota | allow / denied(3,3) | allow / denied(3,3) | PASS: self excluded; no unconditional bypass |
| S13 | Overrides 1 / 5 / 0, other user=9 | deny / allow+allow / deny(0,0) | deny / allow+deny(5,5) / deny(0,0) | PASS: pending fifth counts; zero enforced |
| R01 | Four stale states, changed incoming identity, rich metadata | timestamp old; next allowed | only updated_at=T; next denied | PASS: identity and all other columns preserved |
| C01 | Six fresh envs; 50ms; 2 pools; 5 repeats | 5/5: 6 reserved, 0 denied, 6 rows | 5/5: 3 reserved, 3 denied, 3 rows | PASS: 6 → 3; serialized per user |
| C02 | Six stale revivals; 50ms; 2 pools; 5 repeats | 5/5: 6 reserved; 0 refreshed | 5/5: 3 reserved, 3 denied; 3 refreshed | PASS: 3 refresh; all PK/metadata preserved |
| C03 | Six same-env retries; 50ms; 5 repeats | 5/5: 6 reserved / 1 row | 5/5: 6 reserved / 1 row | PASS: all retries allowed; one row |
| C04 | Different users; U held; 50ms; 5 repeats | 5/5: W commits while U held | 5/5: W commits while U held | PASS: per-user lock; no global blocking |
| E01 | Unique identity collision | dropped: unreachable | dropped: unreachable | provider SHA-256 identities; lead adjustment |
| E02 | Typed failure after insert/refresh + retry | sentinel; new insert persists | sentinel; insert/refresh rolled back | PASS: sentinel preserved; retry succeeds |
| E03 | Interrupt after reserve; second-pool retry | interruption; E0 persists | interruption; E0 rolled back | PASS: interruption preserved; lock released |
| E04 | Restricted role: override SELECT denied | load-limit; restored retry reserved | load-limit; restored retry reserved | PASS: callback skipped; no failed allocation |
| E05 | Restricted role: allocation/link SELECT denied | count-tunnels ×2; retry reserved | count-tunnels ×2; retry reserved | PASS: callback skipped; rollback/lock released |
| E06 | Labelled advisory-lock SqlError injection | no lock path; reserved | lock-user; no callback; retry reserved | PASS: new operation; no real PG lock failure claimed |
| E07 | Labelled BEGIN injection + real deferred COMMIT rejection | no outer boundary; reserved | transaction ×2; callbacks 0/1; no rows; retries reserved | PASS: no early success; not ambiguous transport recovery |
| E08 | Labelled empty RETURNING/fallback result | reserve / resolve-reservation | reserve / resolve-reservation | PASS: defensive branch; no seeded-PG claim |
| P01 | Existing unit harness: provisioning order | 31/31 suite; matching tests pass | 31/31 suite; matching tests pass | PARTIAL: DB commit observation/caller unverified |
| P02 | Existing unit harness: ready reuse/fallback | matching 2 tests pass | matching 2 tests pass | PARTIAL: released/over-quota/API variants unverified |
| P03 | Existing unit harness: quota no side effects | matching test passes | matching test passes | PARTIAL: link/recovery mappings unverified |
| P04 | Limit persistence mapping | no existing test | no existing test | UNVERIFIED: no check-tunnel-limit test |
| P05 | Reservation persistence mapping | no existing test | no existing test | UNVERIFIED: no reserve-allocation test |
| P06 | Existing unit harness: non-loopback origin | matching test passes | matching test passes | PARTIAL: other preconditions/publish bypass unverified |
| P07 | Existing unit harness: failure stages/retry | matching 3 tests pass | matching 3 tests pass | PARTIAL: real failure+aging aftermath unverified |

What else changed:

- Quota semantics extend beyond the PR title: recent reservations count for 15 minutes even with absent/revoked/publish-only links or a released tunnel (S01/S03); old live tunnels without a link now count (S05); old tunnel-less/released rows stop counting even with an active link (S07). Exact cutoff is expired, while a live tunnel still counts at cutoff (S09).
- Re-reserve updates only updated_at to T and returns the stored identity; a revived stale row therefore consumes quota again (R01/C02). The second new request after a fifth pending reservation now hits the per-user override (S13).
- Same-user callbacks/reservations are serialized across independent clients. C01 changes from six committed rows to three; C02 changes from six stale successes to three refreshed successes and three denials. Different users continue independently (C04).
- A typed callback failure or interruption now rolls back the inserted reservation (E02/E03); failed timestamp refresh is restored. The sentinel/interrupt is preserved and a second-client retry commits.
- The new wrapper exposes lock-user and transaction persistence operations. Labelled lock/BEGIN injection and actual deferred COMMIT rejection return errors without a reservation success; unaffected before code has no enclosing boundary (E06/E07). No ambiguous network COMMIT-recovery claim is made.
- No other behavioral difference was confirmed in the captured controls or the provider unit suite. Raw diff also contains environment names, backend PIDs, wall times and scheduling order; these are capture metadata, not behavioral changes. E01 was dropped, so its unique-collision stage change was not exercised.

Provider harness and unverified subcases:

- P01: “provisions a Cloudflare tunnel endpoint and connector token”; “reuses checkpointed resources when provisioning is retried”. Unit harness captures reserve then provisioning calls; no real DB commit observation, no EnvironmentLinker invocation.
- P02: “recovers a ready tunnel for the same origin with only reads”; “fully provisions a recovery when the ready tunnel cannot be reused”. Unit harness captures ready reuse, wrong-origin fallback and missing-tunnel fallback. Released-ready allocation, over-quota recovery and HTTP caller mapping are unverified.
- P03: “refuses to provision past the managed tunnel limit without side effects”. Unit harness preserves the exact Exceeded object and skips allocation/tunnel/DNS calls. EnvironmentLinker and recovery HTTP error mapping are unverified.
- P04: No covering test. Unverified: no existing ManagedEndpointProvider.test.ts test injects ManagedTunnelLimitPersistenceError or checks check-tunnel-limit mapping. No new tests written.
- P05: No covering test. Unverified: no existing ManagedEndpointProvider.test.ts test injects reserve persistence failure or checks reserve-allocation mapping. E01 is dropped. No new tests written.
- P06: “rejects non-loopback managed endpoint origins before calling Cloudflare”. Partial unit harness only. Missing CF config, digest failure and managed=false publish-only bypass have no existing tests in this provider file and remain unverified.
- P07: “does not hide non-not-found checkpoint update failures”; “reports mismatched tunnel responses without manufacturing a cause”; “keeps a newly created tunnel available for retry after losing its allocation claim”. Partial unit harness captures existing failure stages and retry preservation. No existing test covers the paired pre/post-recordTunnel failures with persisted real rows and T then T+15m clock transition; quota aftermath remains unverified.

E01: dropped: unreachable under supported provider-generated identities, per lead adjustment; hostname and tunnel name derive from SHA-256(namespace,userId,environmentId), so distinct pairs cannot collide in that path. No seeded collision capture was substituted.

E07 limits: BEGIN error is injected through a PgClient.withTransaction wrapper; COMMIT is genuinely rejected by a deferred constraint trigger created inside that transaction. These prove error classification, no early success and rollback/lock release, not ambiguous transport-outcome recovery.