feat(p5): integrate durable migration jobs

.agents/skills/subagent-coordinator/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 
 本 Skill 指导主会话 Agent 作为**协调者 (Coordinator)**，负责统筹、拆轨、派发并合流多子代理并行开发与测试任务。
 
-> **不写台账。** 进度、缺陷清单、设计方案一律不落文件。结论必须进代码、测试与 `docs/` 的正式文档（`docs/features/`、`docs/architecture/`、`docs/development/`）。过程产物（如需临时记录）只存在于会话上下文，随会话消亡。
+> **进度落文件，但随开发周期清理。** 各轨把自己的进度记录到该轨分支的 `progress.md`，协调者把跨轨汇总记录到集成分支的 `hub.md`；两者**提交进 git**，以便会话中断、重启或上下文压缩后仍可恢复。feature 开发完成并通过验收后，协调者删除这些进度文件并提交一次清理。设计结论与缺陷修复则必须进代码、测试与 `docs/` 的正式文档（`docs/features/`、`docs/architecture/`、`docs/development/`），不得只停留在进度文件里。
 > 完整项目约定见 `AGENTS.md`。
 
 ## 核心硬性纪律

.env.example

@@ -0,0 +1,18 @@
+# Application / local-development overrides.
+#
+# Copy to `.env` and fill in. `.env` is gitignored (`.gitignore`); this template
+# is committed (negated by `!.env.example`) so it can never carry a real value.
+#
+# This file is deliberately almost empty. Every key below was located by
+# grepping `import.meta.env.<NAME>` across `src/` and `packages/`; a key that no
+# source file reads is not a setting, it is a comment that lies to the next
+# reader. Vite's built-ins (DEV / PROD / MODE / SSR) are supplied by Vite.
+#
+# Database credentials for the driver contract **live tier** do NOT belong here.
+# They live in `.env.test` — see `.env.test.example`.
+
+# Enables `data-testid` hooks for WebdriverIO.
+# Read by packages/ui/src/tid.ts, src/commands/connection.ts, src/commands/transfer.ts.
+# 1 = on, unset = off. Leave unset for normal development; the E2E harness sets
+# it as part of `pnpm tauri:build:webdriver`.
+VITE_E2E=

.env.test.example

@@ -0,0 +1,176 @@
+# Test / driver-contract-live-tier credentials.
+#
+# Copy to `.env.test` and fill in. `.env.test` is gitignored (`.gitignore`);
+# this template is committed (negated by `!.env.test.example`) so it can never
+# carry a real value.
+#
+# ---------------------------------------------------------------------------
+# How this is consumed
+# ---------------------------------------------------------------------------
+#   scripts/run-live-contract.sh            # the driver contract live tier
+#   scripts/run-live-contract.sh --dry-run  # resolve + report, run nothing
+#
+# The runner loads `.env`, then `.env.test`, then `packages/drivers/.env` if it
+# exists — later wins. It *parses* KEY=VALUE rather than `source`-ing the file,
+# because `source` executes whatever is in it and a parser can only assign.
+#
+# The tests themselves read the process environment ONLY (fake-runtime-fixtures
+# §10.2 rule 5); they never open a file. That is deliberate — it keeps the
+# credential source single and auditable.
+#
+# If you already keep a `postgres://…` or `mysql://…` URL in this file, the
+# runner expands it into the TEST_* variables and you do not need section 1 or 2
+# at all. `DATABASE_URL` is only accepted when its scheme names the family, so
+# one shared URL cannot be handed to the wrong driver.
+#
+# ---------------------------------------------------------------------------
+# Safety rules the tests enforce, and why they exist
+# ---------------------------------------------------------------------------
+# These tests create, alter and DROP tables. They will not touch a database that
+# is not obviously disposable:
+#
+#   TEST_*_DATABASE      MUST begin with `dz_fixture_`
+#   TEST_*_DATABASE_B    MUST begin with `dz_fixture_`, and MUST differ from
+#                        TEST_*_DATABASE. (If B is unset it defaults to A, and
+#                        two equal targets are refused — the cross-database
+#                        dimension would silently verify nothing.)
+#   MIGRATION_TEST_DATABASE         MUST begin with `dz_mig_`
+#   MYSQL_MIGRATION_TEST_DATABASE   MUST begin with `dz_mig_`
+#
+# The migration tier is stricter than the fixture tier on purpose: those suites
+# DROP schemas wholesale, and a fixture name is no evidence that the database is
+# throwaway to someone who names a working copy `dz_fixture_…`. A handful of
+# long-standing exceptions are exact names a given suite has always accepted
+# (`datazen_sync_src`, `datazen_e2e`, `datazen_test`); they are per-suite, in
+# migration_gate.rs, and there is deliberately no way to add one from this file.
+#
+# A refusal is a refusal, not a warning. Renaming a real database to
+# `dz_fixture_…` to get past the check defeats the check; make a dedicated one:
+#
+#   createdb dz_fixture_pg_a && createdb dz_fixture_pg_b
+#   mysql -e 'CREATE DATABASE dz_fixture_mysql_a; CREATE DATABASE dz_fixture_mysql_b;'
+#   createdb dz_mig_contract_pg
+#   mysql -e 'CREATE DATABASE dz_mig_contract_mysql;'
+#
+# The account also needs DDL rights (CREATE/ALTER/DROP), not just CONNECT.
+
+
+# ===========================================================================
+# 1. Driver contract live tier — PostgreSQL
+# ===========================================================================
+# Consumed by packages/drivers/postgres/tests/real_driver_contract.rs and
+# postgres_cross_database.rs. Defaults, if omitted, come from the driver's own
+# Contract: host 127.0.0.1, port 5432, user postgres.
+#
+#   TEST_PG_HOST=127.0.0.1
+#   TEST_PG_PORT=5432
+#   TEST_PG_USER=postgres
+#   TEST_PG_PASSWORD=
+TEST_PG_DATABASE=dz_fixture_pg_a
+TEST_PG_DATABASE_B=dz_fixture_pg_b
+
+
+# ===========================================================================
+# 2. Driver contract live tier — MySQL
+# ===========================================================================
+# Consumed by packages/drivers/mysql/tests/real_driver_contract.rs and
+# mysql_cross_database.rs. Defaults: host 127.0.0.1, port 3306, user root.
+#
+#   TEST_MYSQL_HOST=127.0.0.1
+#   TEST_MYSQL_PORT=3306
+#   TEST_MYSQL_USER=root
+#   TEST_MYSQL_PASSWORD=
+TEST_MYSQL_DATABASE=dz_fixture_mysql_a
+TEST_MYSQL_DATABASE_B=dz_fixture_mysql_b
+
+
+# ===========================================================================
+# 3. Strict mode — usually set for you
+# ===========================================================================
+# Unset, an unreachable server is a SKIP, and `test result: ok` cannot tell a
+# skip from a pass. Set to 1 and an unverified dimension becomes a failure.
+# scripts/run-live-contract.sh exports this for you; set it here only to make
+# a bare `cargo test` strict too.
+#
+#   DATAZEN_CONTRACT_REQUIRE_LIVE=1
+
+
+# ===========================================================================
+# 4. Migration suites — postgres and mysql
+# ===========================================================================
+# These now run by default as part of the contract tier; they are no longer
+# `#[ignore]`d and need no `--ignored`. Unset, each suite reports its dimension
+# unverified and returns; under `DATAZEN_CONTRACT_REQUIRE_LIVE=1` that is a
+# failure, which is the whole point.
+#
+# The two families use DIFFERENT prefixes. One `cargo test -p <pg> -p <mysql>`
+# puts every test binary in a single environment, so a shared name would point
+# the MySQL suites at the PostgreSQL server. PostgreSQL keeps the original
+# prefix; MySQL gets its own.
+#
+#   MIGRATION_TEST_HOST=127.0.0.1          MYSQL_MIGRATION_TEST_HOST=127.0.0.1
+#   MIGRATION_TEST_PORT=5432               MYSQL_MIGRATION_TEST_PORT=3306
+#   MIGRATION_TEST_USER=postgres           MYSQL_MIGRATION_TEST_USER=root
+#   MIGRATION_TEST_PASSWORD=               MYSQL_MIGRATION_TEST_PASSWORD=
+#   MIGRATION_TEST_DATABASE=               MYSQL_MIGRATION_TEST_DATABASE=
+#
+# Both DATABASE keys MUST start with `dz_mig_` (see the refusal note above).
+# Leave them empty here: `run-live-contract.sh` defaults them to
+# dz_mig_contract_pg / dz_mig_contract_mysql and creates those if absent.
+
+
+# ===========================================================================
+# 5. Redis live tests
+# ===========================================================================
+# Also `#[ignore]`d, and gated on the URL being present at all.
+#
+#   DATAZEN_TEST_REDIS_URL=redis://127.0.0.1:6379
+#   DATAZEN_TEST_REDIS_CLUSTER_URL=redis://127.0.0.1:7000
+# Overrides the `redis-server` binary used by the in-process harness.
+#   DATAZEN_REDIS_SERVER=/opt/homebrew/bin/redis-server
+
+
+# ===========================================================================
+# 6. Driver-internal unit tests
+# ===========================================================================
+# Not the contract tier — these are `#[cfg(test)]` tests inside the driver
+# crates that reach for the vendor-standard libpq / MySQL variable names.
+# Leaving these unset simply skips them.
+#
+#   PGHOST=127.0.0.1
+#   PGPORT=5432
+#   PGUSER=postgres
+#   PGPASSWORD=
+#   PGDATABASE=postgres
+#
+#   MYSQL_HOST=127.0.0.1
+#   MYSQL_PORT=3306
+#   MYSQL_USER=root
+#   MYSQL_PASSWORD=
+#   MYSQL_DB=mysql
+#
+# Note: PGDATABASE / MYSQL_DB above are NOT read by run-live-contract.sh. The
+# runner only borrows a bare vendor variable as a fallback when it can also
+# name the database, so a half-filled block here cannot shadow section 1.
+
+
+# ===========================================================================
+# 7. SQL Server env-file opt-in
+# ===========================================================================
+# The SQL Server live tests may read their settings from a file. This variable
+# names that file, and only a bare filename is accepted — a path is refused, so
+# the opt-in cannot be widened into "read anything".
+#
+#   TEST_SQLSERVER_ENV_FILE=
+
+
+# ===========================================================================
+# 8. Escape hatch: names this template does not guess
+# ===========================================================================
+# If your env file spells these differently, do not edit this template. Put
+# `YOUR_NAME = TEST_PG_NAME` lines in scripts/.live-contract.aliases (gitignored)
+# and the runner will bind them. Keeping the mapping in a file rather than in
+# the runner means nobody has to say their variable names out loud.
+#
+#   POSTGRES_USER = TEST_PG_USER
+#   POSTGRES_PASSWORD = TEST_PG_PASSWORD