test(instrument): prove suspend omit and same-locale catalog order

[cursor]

Why

#193 lists stored Published forms after restart. Review found two realistic catalog cases untested and operator copy that disagreed with the session-start landing vehicle.

A purchaser who suspends a live form must not still see that release_ref as startable. Two Published Korean Big Five forms must appear in release_ref order so the catalog is deterministic. Session start remains #205 (prefer over #180), not #164. HTTP catalog remains #165.

Prefer this head over #193, #179, and #171 for catalog-from-store.

What this PR does

• Keep list_startable_instrument_releases from feat(instrument): list startable published releases after restart #193.
• Prove a Published row later Suspended on the same release_ref is omitted.
• Prove two Published rows that share instrument_ref and locale order by release_ref.
• Mark the catalog as Active PR work in README and point session start at fix(session): seal persist first-insert against unpublished reconstitution #205 load_published_instrument_release plus persist first-insert seal.
• Record BCP 47 / RFC 5646 in doctoring so exact locale matching is cited, not implied.

Out of scope

• Session start from a stored Published release (fix(session): seal persist first-insert against unpublished reconstitution #205)
• Instrument catalog HTTP (feat(api): list startable published instruments over HTTP #165)
• Persisting publication-event history or bound scientific evidence
• Psychometric recomputation (stays in fast-mlsirm)

Test plan

• cargo test --lib postgres_instrument_release
• cargo test --test instrument_release_startable_catalog --test documentation_architecture_contract --test traceability_active_pr_contract --test instrument_locale_canonical_contract
• cargo clippy --all-targets -- -D warnings
• cargo test --test postgres_instrument_release_persistence (needs TEST_DATABASE_URL)

Operator next action

Prefer this head over #193 for catalog-from-store. After exact-head Runtime CI, coverage, and an independent last-push review, open a READ COMMITTED transaction and call list_startable_instrument_releases. Copy a returned release_ref and exact BCP 47 locale into the #205 session-start path. If listing fails, repair the corrupt stored snapshot before offering any form. Do not start sessions from load_instrument_release or from a partial untrusted catalog.

Do not merge this PR in parallel with #205; rebase this slice after #205 if both remain open. Do not fold HTTP or session start into this adapter list. Do not merge until exact-head checks and independent last-push approval are satisfied. Never self-approve.

[cursor]

Verdict: SOUND

aa1724d keeps list_startable_instrument_releases as a store adapter list. It does not fold HTTP or session start into this slice. The two buyer cases this PR claimed are proven by PostgreSQL tests, not by docs.

Proven on this head

• A Published row later Suspended on the same release_ref leaves the catalog (tests/postgres_instrument_release_persistence.rs startable_catalog_omits_the_same_release_after_it_is_suspended).
• Two Published rows that share instrument_ref and ko-KR order by release_ref, including when v2 is inserted first (startable_catalog_orders_same_instrument_and_locale_by_release_ref).
• Draft / Review / Suspended / Retired stay hidden; mixed-family order is instrument_ref, locale, release_ref.
• A corrupt Published row fails the whole list as InconsistentEvidence.
• Exact persist replay of a listed snapshot stays Duplicate.
• Reconstruction does not invent publication events or bound evidence.
• Operator copy names session start as #205 load_published_instrument_release plus persist first-insert seal, and HTTP catalog as #165. That matches this slice.

Residual, not merge-blocking

Doctoring says the catalog does not collapse ko and ko-KR. No test inserts both tags. ORDER BY locale would keep them distinct, so this is true by construction, not proven. Add that Postgres case on a follow-up, or narrow the sentence to “orders by the stored tag.” Do not open a fourth catalog-from-store PR for that sentence.

tests/instrument_release_startable_catalog.rs only re-checks accepts_new_sessions(). The buyer proofs need TEST_DATABASE_URL (Runtime CI sets it).

This list has no tenant_ref filter. That matches migrations/0006_instrument_release.sql and the current ERD (global release_ref PK). Tenant-scoped catalogs stay a later authorization/HTTP gate.

Operator next action

Prefer this head over #193, #179, and #171 for catalog-from-store. After exact-head Runtime CI (including postgres_instrument_release_persistence), coverage, and an independent last-push review, open a READ COMMITTED transaction and call list_startable_instrument_releases. Copy a returned release_ref and exact BCP 47 locale into the #205 session-start path. If listing fails, repair the corrupt stored snapshot before offering any form.

Do not merge this PR in parallel with #205; rebase this slice after #205 if both remain open. Do not fold HTTP or session start into this adapter list. Do not merge #164 or #179 in parallel. Do not start sessions from load_instrument_release or from a partial untrusted catalog. Never self-approve. This automation has no merge tool.

After #213 and #205 are check-clean: bind #165 GET /v1/instruments to this store list on the #165 line, not here.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

This consequence is not proven on this head. No catalog test inserts both ko and ko-KR for the same instrument_ref. ORDER BY locale would keep the stored tags distinct, but that is construction, not evidence.

Add a Postgres test that persists both tags and asserts two startable rows in stored-tag order, or narrow this sentence to “orders by the stored tag.” Do not open a fourth catalog-from-store PR for this sentence alone.

[cursor]

Filter plus ORDER BY instrument_ref, locale, release_ref is the right catalog contract. Same-release_ref suspend-omit and same-locale release_ref order are proven. ko vs ko-KR non-collapse is not. Keep HTTP and session start off this adapter.