Same-credential direct and pooler authentication passed, exact session retirement evidence

Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root reviewed source 67a4e0aaa04de7d33ceb1c275ac9bf95879428af and independently rehashed all eleven entries in CA manifest 6e66c87a572bc8e832d3ec2c974bdd5aa448c9ee1476210cae772488d3a2ab19. Root authorized exactly one authentication-only run using .tmp/production007/auth-preflight-ca-once/. That reviewed command ran once. The old TLS STOP and all unsigned acquisition STOP records remain immutable.

The helper's activation transaction verified the exact revoked role OID 13362275, accepted admin/PUBLIC baseline and zero preexisting role sessions. It generated one credential and set a server-clock five-minute expiry: activation clock 2026-10-03 09:01:01.782321+00, VALID UNTIL 2026-10-03T09:06:01.782Z. All nine stored/parsed credential, OID/flags, LOGIN/expiry and verified-TLS booleans passed. No verifier or credential was logged.

Direct authentication succeeded in 377 ms, actual role delivery_proof_audit_adr0053, database postgres, server clock 09:01:02.345547Z. The same credential succeeded through the unchanged approved pooler target on its first attempt at offset zero in 305 ms, actual role/database exact, server clock 09:01:02.689297Z. There was no 28P01 or retry. Both clients used the exact pinned public CA with certificate and hostname verification. This proves restricted login readiness during this bounded database preflight. It does not prove a pooler cache cause for the earlier d6 failure or genuine Vercel workload acquisition.

The helper's unconditional finally revoked LOGIN/password, but its strict session-marker guard refused to drain a retained Supavisor backend because the provider changed application_name to Supavisor. The immutable result therefore reports loginReady: true, retired: false, with a sanitized ERR_ASSERTION. It was not changed to claim successful cleanup. Verified-TLS READ ONLY catalog at 09:01:18.849Z confirms exact role OID, NOLOGIN/password NULL, all explicit grants false, no dependencies and unchanged accepted admin/PUBLIC facts. It identifies one idle backend: PID 1189451, exact role, application Supavisor, backend start 09:01:02.648Z, after activation and during the successful pooler attempt. No session was terminated by that failed marker guard.

Root authorized one atomic drain binding PID 1189451, exact role, Supavisor, backend start 2026-10-03T09:01:02.648Z, exact role OID and NOLOGIN/password NULL. The requested predicate matched zero rows and terminated no session. The new text readback exposed PostgreSQL timestamp precision lost by the earlier pg JavaScript Date serialization: actual backend start is 2026-10-03 09:01:02.648067+00. PID, role, application and idle state remained unchanged. The helper was not rerun and the predicate was not broadened. Root separately authorized one drain with this exact full-precision timestamp and all prior guards. At 09:03:12.453Z, that session was already absent before the statement; it matched zero rows and terminated nothing. Fresh verified-TLS READ ONLY snapshot then passed exact equality with the earlier revoked baseline, including zero sessions, password NULL/NOLOGIN, no dependencies or direct grants and unchanged accepted admin/PUBLIC facts. Retirement is now independently verified. The original helper result retired: false and both no-op statements remain immutable alongside this reconciliation. Future session evidence should preserve backend_start::text.

Evidence under .tmp/production007/auth-preflight-ca-once/:

No audit grant or proof audit write, proof window, signing key/approval, project env/deployment, acquisition POST, Phase C or business-domain call occurred. The permanent claim is retained, no execution retry is planned, and no proof window is authorized by authentication success. Root remains sole canonical publisher. G2, old runtimes and deadlines remain preserved.