feat: establish catalog identity and atomic file ownership

docs/project-status.md

@@ -4,7 +4,44 @@ Baseline: `c1ef2ee`. This review compares the live Gitea acceptance criteria wit
 source, tests, and recorded runtime evidence. Implementation is not milestone
 acceptance. The earlier assessment understated remaining M2/M3 work.
 
-## Evidence
+## Catalog-core Task 4 evidence — 2026-10-13
+
+Tasks 1–3 were approved at handoff (371 tests / 2032 assertions / 22 skips,
+local lint clean). Task 4 adds six PostgreSQL cases using independent sessions,
+generated schemas, 250ms lock timeouts and 5s statement timeouts. Execution-time
+parameter recording establishes ascending file locks for reversed input;
+FOR SHARE contention establishes same-owner no-op locking. Tests also establish
+stale-owner rejection, rollback/retry, nested transaction survival, lower-lock
+release after savepoint rollback, and explicit/legacy root creation contention
+including disjoint folders. No deadlock was induced and no automatic retry added.
+
+- Fresh Windows PHP 8.3.35: foundation checks pass; full PHPUnit **377 tests,
+  2032 assertions, 28 skips**, exit 0; standard PHPCS lint exit 0. These are the
+  Composer script commands invoked directly with the required PHP executable.
+- Fresh isolated Docker PostgreSQL 17 / PHP 8.4.26: `sh bin/test-postgres.sh`
+  ran full Composer tests and lint successfully: **377 tests, 2160 assertions,
+  7 skips**. Final log:
+  `keith@192.168.2.23:/tmp/meshvault-catalog-tests-Ov96uNzU/pg-run-3.log`.
+- Initial PG run (`pg-run-1.log` in the same directory): 377 tests / 2140
+  assertions / 4 errors / 7 skips. All four errors were SQLite-only trigger DDL
+  in the later-update rollback fixture. A PostgreSQL trigger function now tests
+  the same earlier-write condition; `pg-run-2.log` first confirmed the fix.
+  New concurrency cases passed against the approved implementation; no production
+  locking gap or new-case red/mutation run is claimed.
+- Transfer included current uncommitted source, excluding vendor, node_modules,
+  .git, .superpowers, environment files, secrets and key files. Dockerfile.test
+  installs dependencies. Dedicated disposable containers/network used no host DB
+  ports or persistent volumes; test containers were gone after final cleanup.
+  Neither `/tmp/MeshVault`, the historical PG workspace nor development data was
+  modified. SSH calls exceeded the tool's 30s wait; subsequent log reads verified
+  completion and the script's tests-and-lint success marker.
+
+Independent whole-slice review approved the bounded implementation with no blocking
+findings, reran local tests/lint and checked the PostgreSQL log and matching source
+hashes. The user authorized local integration into main, not a push. No issue closure
+is implied; broader #28 metadata/lifecycle contracts and the M2/M3 gaps remain open.
+
+## Historical evidence
 
 - Fresh Windows run: `composer test` — 291 tests, 1801 assertions, 22 skips; exit 0.
   `composer lint` — exit 0. Expected HTTP failure-path logs are not test failures.
@@ -43,7 +80,7 @@ changes; issue states were rechecked through the live API afterward.
 | #25 | Queue/worker/locking exist; confirmed grouping and full replay/retry guarantees remain incomplete. |
 | #26 | Repository progress exists; caller-facing polling, full state distinctions and worker handling of empty jobs remain incomplete. |
 | #27 | Failures persist; supported retry with attempt history and persisted-message redaction remain incomplete. |
-| #28 | Importer-facing repository exists; explicit reassignment, catalog-owned transaction contract and broader metadata/lifecycle contracts remain incomplete. |
+| #28 | Bounded identity, explicit expected-owner reassignment and catalog-owned savepoint transactions are implemented with local/PG evidence above; whole-slice review approved, but broader metadata/lifecycle contracts remain open. Not complete. |
 
 ## Important implementation findings