[salmonumbrella]

Builds on #2585.

Incremental diff for this part.

What changed

Implement the guarded activation transaction, parity audit and connection cleanup. Retry complete attempts for supported transaction conflicts, and discard uncertain physical connections without replaying a committed activation.

Why

A lost COMMIT or unlock response must not activate a scope twice or return a connection holding a session lock to the pool. The engine needs explicit commit and cleanup boundaries.

Usage

No usage change. The engine remains disconnected from production commands until the next slice.

Refs #1352.

[roborev-ci]

roborev: Combined Review (a8b1a47)

Verdict: Changes require fixes for 5 findings.

Medium

• internal/postgres/raw_parity_reader.go:39: Real Codex captures matching retained pushed history are classified as unmatchable because the query treats an empty SourceSessionID as missing stable identity. Codex stores its native identity in Session.ID, so identical sessions skip comparison and report pass=false. The fixture masks this with a synthetic SourceSessionID.

  Fix: Recognize stable Codex IDs according to the provider identity contract while preserving thread/page distinctions. Add a regression using real Codex parser output.

• internal/postgres/raw_rollout_retry_pgtest_test.go:96: TestRawRolloutFirstSerializationFailureRegression invokes the same helper with identical arguments, setup, operations, and assertions as TestRawRolloutRetriesCommitExactlyOnce/40001/projection.

  Fix: Delete TestRawRolloutFirstSerializationFailureRegression and retain the table case and shared helper.

• internal/postgres/raw_activation_connection_pgtest_test.go:118: activationObservedRows.NextRow classifies SQL column shapes and increments counters that no test reads. The custom driver-row wrapper protects no behavior.

  Fix: Delete activationObservedRows, the unused rows map and its initialization, and return underlying rows directly from QueryContext. Retain connection, transaction, and response-loss instrumentation.

• internal/postgres/raw_parity_readiness_pgtest_test.go:112: TestRawParityRuntimeCannotReadOtherTenant stores foreign data in B's schema but invokes both loaders only against A's empty schema. It tests absent-ID and empty-head behavior without exercising forbidden access to B. Existing TestHostedTenantIsolation already covers the actual boundaries.

  Fix: Delete TestRawParityRuntimeCannotReadOtherTenant and its otherwise unnecessary foreign projection setup.

• internal/rawparity/relationships_test.go:184: TestCompareResolvedRejectsMalformedTarget injects an invalid UTF-8 physical target ID that cannot reach CompareResolved through production: projectOnce constructs these IDs from "raw-row-" plus a hexadecimal digest. The test only exercises JSON encoding failure for an invented ID.

  Fix: Delete TestCompareResolvedRejectsMalformedTarget.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 16s | Total: 18m30s