[ancongui]

Current source: 85f5f95.

Business mutations need immutable audit evidence and a permanent export intent to commit together. The R2DBC module adds an opt-in appender and mapped repository that use the owning bounded transaction and verify its active scope/resource graph. Mandatory append failures mark that owner rollback-only, including when application code catches a logical refusal. Exact replay preserves the original event/outbox. Provisional append results remain separate from owner-acknowledged commit and cleanup facts.

The optional standalone PostgreSQL contract binds the actual transaction/session/backend, resource and admitted actor, protects originals for restricted runtime roles, and checks the complete local graph at completion. It adds no default bean/schema/security grant/pool/export worker. Actor platform tenants retain genuine String keys; resource tenants remain UUIDs. Values and database context parameters do not authenticate a caller or establish an owner permission.

Validation: 134 focused source cases pass independently. A fresh owned PostgreSQL 17 run passes seven stages covering commit, replay, legitimately narrowed current permission, rollback after provisional append, same-physical restart and recovery. Independent retained review verifies fixed source classes/loaded origins/full business-event-outbox-head-grant graphs and closed resources. The 500 ms permit case is source-tested; native narrowing uses 60 seconds while retaining the original operation cap of five seconds. These are local signed/durable sandbox-authority proofs, not core adoption.

Current-head hosted CI passes all eleven applicable checks with one expected Pages skip, including library installation, examples and gRPC alignment. Independently downloaded report artifacts verify30 selected suites/275 cases with zero failures, errors or skips;134 critical cases are a subset. The entire reactor reports4378 passed and24 skipped (ledger12, Cognito12). GitHub associates these results with this PR head; report XML does not expose the merge-checkout SHA.

The local original four-library package now also passes30 suites/275 cases and inspection of all12 primary/source/Javadoc artifacts. Its two disclosed test-environment overlays preserve production/POM bytes and original test bodies; the pinned genuine Mockito premain applies only to Maven tests. The first final-consumer attempt was refused before compiler launch because its launcher omitted a required ownership nonce; that failure remains retained. A separately approved offline continuation now passes on the exact retained artifacts, using the genuine JDK compiler and an agent-free consumer. Root verifies4040 unchanged input pins, twelve physical JAR class origins, full immutable event round trip, String platform tenant preservation and rejection of all public operations outside an active owning scope, with zero database acquisitions and cleanup0. Maven was not repeated. Independent retained review of the continuation remains pending; no suite skip, cache write, installation or release occurred. The original60 kernel and prior hosted3503 evidence remains historical.

The kernel supplies immutable values, canonical SHA-256 hashing and bounded range verification against externally trusted checkpoints. The 15-path transactional addition changes two ownership bridges and adds 13 source/documentation/schema/test files; all 3481 inherited paths and all raw POMs, dependencies, defaults, security logging, SDKs, and branding remain unchanged from 3503. See docs/immutable-local-audit.md for the contract.

Adoption in every core and process, export/custody/WORM, retention/holds, restore evidence, complete financial journeys and DORA acceptance remain OPEN. No merge/tag/release/deployment is included.

Issuer-bound OPA rules denied authenticated requests because the outgoing policy subject omitted the validated principal issuer. Project the issuer when present, preserving the original four fields for legacy principals without an issuer. Claims, attributes, headers and request context do not supply the subject issuer.

Validation: 13 direct-source adapter cases pass, including three new request-serialization regressions; Root independently repeats all 13. Four offline evaluations of exact adapter request input pass against the unchanged terminal/domain Rego policies. Current-head reactor CI passes as scoped above; the rebuilt signed consumer journey remains pending. No authentication, policy, financial acceptance or release is inferred from the offline checks.

The existing orchestration REST switch now also gates the workflow management controller. Setting firefly.orchestration.rest.enabled=false removes its HTTP surface while retaining workflow engine, registry, services, signals and timers. Four real Spring reactive-context regressions pass, including the maintained failing case; default/true behavior and the independent engine switch are preserved. Root independently repeats all four, and strict production compilation matches. No workflow management operation, financial service or release is qualified by these configuration tests.

The observability environment postprocessor now preserves the host application's effective auto-configuration exclusion list using Spring Boot Binder. Previously, indexed YAML exclusions could disappear when tracing bridge exclusions were added, unexpectedly activating database auto-configuration in stateless applications. Four new controls cover indexed YAML, property-source precedence, comma-separated compatibility and disabled tracing; all twelve existing controls remain passing. Root independently repeats all sixteen and the strict production-only class matches. An explicit full-source aggregate of the existing organization Domain Main now starts and serves its real current-controller metadata with zero cleanup errors. Original Domain SDK generation, current-head hosted CI and coordinated released-artifact adoption remain separate work.

The preceding persistence block wraps four diagnostic correlation String fields in cache/event-sourced persistence and adds twelve regression controls. Independent validation passes190 selected cases, strict137-unit production compilation into157 matching classes, AST preservation of all13 log templates/levels and23 actual CodeSource bindings. Stored keys/state/events/projections/MDC/results and Throwable identity remain unchanged.

Current-head hosted checks and CodeQL closure are pending. Preceding a1bb source passes all11 hosted checks; exact-merge Java analysis2036572469 reports37medium/zero high with15 target closures and four newly reported persistence diagnostics. This source correction covers those four, but their closure requires actual new-head analysis.

This draft improves framework runtime integration, bounded transaction support, SDK generation compatibility, and diagnostic handling while preserving application overrides and default-off generator options.

The combined changes cover durable JDBC Batch execution and process recovery, persistent TCC acknowledgement choices, CQRS type resolution, scoped idempotency, startup metadata discovery, scalar-enum R2DBC criteria, UTC auditing, cryptographic account-number generation, and AES configuration compatibility. Boot 4 OAuth client wiring uses production modules, JWT tenant projection and policy decisions remain explicit, and nullable SDK serialization uses the existing Jackson builder. Restricted HTML rendering and offline schema validation retain their documented limits.

Diagnostics use the shared kernel LogFields helper. The preceding diagnostic block updates four starter-data production files and adds twelve regression cases. String diagnostic fields are escaped only inside logger calls. Synchronous job diagnostics report payload presence and response class without traversing maps or formatting request/response bodies. Five message templates change to describe these reduced diagnostics. Persistence values, metrics tags, events, MDC, responses, exception propagation, and Throwable identity remain unchanged.

Validation is scoped to the exact source and execution:

• The preceding starter-data block passes 80 selected regression cases and a production-only compile of 80 source units into 126 classes. Root independently repeats both. Production class bytes match the full test compile, and AST checks preserve non-logging source bytes, log levels, and the disclosed template boundary.
• Earlier original Maven qualification covers the bounded R2DBC reactor: five modules, 25 XML suites, 192 cases and twelve packaged JARs. This remains evidence for its recorded source; later logging edits do not retrospectively acquire that full-reactor result.
• The preceding public e4a13ca head passes all eleven applicable hosted checks, including Docker, library installation and maintained examples. Its exact-head Java analysis reports 55 medium and zero high findings, with nine targeted findings removed and no new finding IDs. The preceding7665c0a9 head passes all eleven applicable hosted checks, including Docker, full reactor/library installation and maintained standalone examples. Java analysis2035231439 on merge57095da4 reports48 medium and zero high findings; exactly seven targeted IDs are removed with no new IDs. This hosted result is separate from released artifacts and owner adoption.

Current artifact availability, coordinated releases, owner adoption, native and live-provider integrations, broader financial journeys, and consumer acceptance remain separate work. This draft does not claim those outcomes.