Outcome
UNVERIFIED at provider head 36ae0c855280cf09f87ba940f5fc6dce1da2cfdd.
The provider composes public SQL e9d44cba50fccac90c8c751b0fa95b100aa7e9c8 and Pool Primitives b7c710c945b7c8467b4521c3a2d5b00539275593 directly. It owns Pool.Bounded<Session<Transport>>; the private Pools/Lease facade remains removed.
Scoped operations
Each non-cursor read, write, or rollback operation receives one sending move-only, non-Sendable handle in the database actor, borrows its session, and consumes the handle exactly once. Active success is reusable; any typed failure or cancellation is invalid. Checkout cancellation, shutdown, and creation failure remain typed. Shutdown drains the public bounded pool.
Escaping cursor ownership
SQL.Reader.cursor is the sole actor-to-caller move-only cursor seam. The database checks out exactly one handle, opens the portal through its borrowed session, and consumes the handle into SQL's generic Cursor context. Every element returns the sole continuation. Natural exhaustion and successful explicit close consume the handle reusable. Open, iteration, decoding, close, or cancellation failure consume it invalid. Dropping a live Cursor invokes the handle's synchronous abandon/drop law.
The old SQL.Connection.fetchCursor composition is removed. There is no second checkout, provider-local Cursor/context box, lifecycle gate, public with*, Task cleanup, Error-carried resource, copied lifecycle closure, SPI, trait, unchecked conformance, compatibility Lease facade, or new habitual @Sendable requirement.
Transport preservation
The direct transport remains frozen at TLS e27e99f5c841170593dde7b0396e9090a7515f62, DNS 930ab8b5dadc99d6c44b101d92422545b697db7d, Byte Channel dfc56d1ed173aae4db784018c746050cbfbe4ee7, and Sockets 3fad32626d347cbfc0e803496e7ad9c0e66162db. Singular identity, typed Count/Byte.Chunk, actor-region TLS Session transfer, event-backed IO, typed failures, and Session → Pump → runner close order are unchanged.
Exact changed paths
Package.swiftSources/SQL Postgres Provider/Postgres.Provider.Database.swiftSources/SQL Postgres Provider/Postgres.Provider.Connection.swiftSources/SQL Postgres Provider/Postgres.Provider.Session.swiftTests/SQL Postgres Provider Tests/Postgres.Provider.Production.Contracts.swiftREADME.mdDocumentation/Production scenarios.md
No Pool Primitives, TLS, Sockets, DNS, workflow, or Package.resolved path changed.
Evidence status
UNVERIFIED. No build, test, resolve, update, clean, run, compose, verification, typecheck, lint, compiler probe, or CI read/watch/poll was performed under the source-only moratorium.
Depends on TX-SQL1. Parent: Provide Institute-native networking.
Outcome
UNVERIFIED at provider head
36ae0c855280cf09f87ba940f5fc6dce1da2cfdd.The provider composes public SQL
e9d44cba50fccac90c8c751b0fa95b100aa7e9c8and Pool Primitivesb7c710c945b7c8467b4521c3a2d5b00539275593directly. It ownsPool.Bounded<Session<Transport>>; the private Pools/Lease facade remains removed.Scoped operations
Each non-cursor read, write, or rollback operation receives one sending move-only, non-
Sendablehandle in the database actor, borrows its session, and consumes the handle exactly once. Active success is reusable; any typed failure or cancellation is invalid. Checkout cancellation, shutdown, and creation failure remain typed. Shutdown drains the public bounded pool.Escaping cursor ownership
SQL.Reader.cursoris the sole actor-to-caller move-only cursor seam. The database checks out exactly one handle, opens the portal through its borrowed session, and consumes the handle into SQL's generic Cursor context. Every element returns the sole continuation. Natural exhaustion and successful explicit close consume the handle reusable. Open, iteration, decoding, close, or cancellation failure consume it invalid. Dropping a live Cursor invokes the handle's synchronous abandon/drop law.The old
SQL.Connection.fetchCursorcomposition is removed. There is no second checkout, provider-local Cursor/context box, lifecycle gate, publicwith*, Task cleanup, Error-carried resource, copied lifecycle closure, SPI, trait, unchecked conformance, compatibility Lease facade, or new habitual@Sendablerequirement.Transport preservation
The direct transport remains frozen at TLS
e27e99f5c841170593dde7b0396e9090a7515f62, DNS930ab8b5dadc99d6c44b101d92422545b697db7d, Byte Channeldfc56d1ed173aae4db784018c746050cbfbe4ee7, and Sockets3fad32626d347cbfc0e803496e7ad9c0e66162db. Singular identity, typed Count/Byte.Chunk, actor-region TLS Session transfer, event-backed IO, typed failures, and Session → Pump → runner close order are unchanged.Exact changed paths
Package.swiftSources/SQL Postgres Provider/Postgres.Provider.Database.swiftSources/SQL Postgres Provider/Postgres.Provider.Connection.swiftSources/SQL Postgres Provider/Postgres.Provider.Session.swiftTests/SQL Postgres Provider Tests/Postgres.Provider.Production.Contracts.swiftREADME.mdDocumentation/Production scenarios.mdNo Pool Primitives, TLS, Sockets, DNS, workflow, or
Package.resolvedpath changed.Evidence status
UNVERIFIED. No build, test, resolve, update, clean, run, compose, verification, typecheck, lint, compiler probe, or CI read/watch/poll was performed under the source-only moratorium.
Depends on TX-SQL1. Parent: Provide Institute-native networking.