# Published data/jobs consumer evidence

This standalone consumer verifies only registry-published public imports. It contains no platform source imports, live provider calls, compatibility shims, or application wiring.

## Pins

- `@platform-modules/db@0.2.1`
- `@platform-modules/jobs@0.0.2`
- `drizzle-orm@0.45.2`
- `@standard-schema/spec@1.1.0`
- `typescript@5.9.3`
- `@types/node@22.19.21`

The local `.npmrc` contains only registry selection and install policy. Authentication is inherited from the remote user's npm configuration and is never captured.

## Reproduction and evidence

Run `./verify-remote.sh` on a configured remote host. The script copies only this consumer's manifests, sources, probes, and tests into a fresh directory under `$HOME/.cache`; it refuses a work directory beneath the source tree and disables npm workspaces. It records sanitized command output, exact statuses, the generated lockfile, dependency resolution/tree, build output, host metadata, and checksums.

The audited debian1 run is under `evidence/20260823T164947Z-3741716/`. Its install, dependency resolution, strict typecheck, 28 tests, and build all exited 0. Tests use only published exports and injected in-memory fakes. No provider or database connection is made.

## Result: failed published-contract probe

Overall status remains **failed**. The exact published-surface probe imports `SQLiteQuerier` and `SQLiteTransactionalDatabase` from `@platform-modules/db/sqlite/d1`; `@platform-modules/db@0.2.1` does not export either name. The compiler failure is retained in `missing-sqlite-export.stderr.txt` with its nonzero status in `exit-statuses.tsv`. This agrees with `docs/integration/platform-data-jobs.md`, which documents both types as internal and instructs consumers not to import them.

Available D1 public types are `D1Binding`, `D1ClientOptions`, and `DrizzleD1Database`. A published `DrizzleD1Database` does not satisfy the root PostgreSQL-shaped `Querier` accepted by `withAdvisoryLock`; a root `Database` also does not satisfy `TransactionalDatabase`. The strict consumer preserves compile-time negative assertions for both boundaries.

## Behavioral coverage

The remote suite covers public export resolution plus registry validation/dispatch, strict and non-strict unknown jobs, malformed payloads, idempotency-store behavior, terminal and retryable failures, queue send/resolve/consume ack-retry behavior, outbox insert and queue nudge behavior, processed-row skipping, fresh-row dispatch, and the Durable Object rearm constant.

## Contract limitations

The published jobs helpers remain generic rather than authoritative PDF2HTML CAS primitives:

- `claim` has no PDF2HTML owner, lease-token hash, lease expiry, heartbeat, source-expiry, or cancellation contract.
- `requeueAfterFailure` exposes no expected-attempt/owner/lease predicate.
- `markJobCompleted` accepts no expected-state/owner/lease/attempt predicate.
- `IdempotencyStore.seen()` followed by handler execution and `mark()` is not an atomic claim.
- `dispatchOutboxRow` has no public claiming/lease transition before dispatch.

These are API contract observations, not production concurrency measurements. Production-like PostgreSQL evidence remains required for PDF2HTML-owned lease and CAS commands.