Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

One commit with exactly the tree of the reviewed head 35b4509c0a, on main 12c2574c9d, so two compiled programs added and removed on the branch leave no trace in history (issue 1577).

modules/postgres/cmd/postgres-provider/provisioner.go

@@ -35,10 +35,14 @@ func (a provisioner) Create(ctx context.Context, p harness.Provision) error {
 	if err := a.pg.CreateDatabaseAndRole(ctx, database, p.As, p.Password); err != nil {
 		return err
 	}
+	// A login retired and asked for again takes back what its keeper kept (retire_pg.go).
+	if err := a.pg.Reclaim(ctx, database, p.As); err != nil {
+		return err
+	}
 	if err := a.pg.EnsureExtensions(ctx, database, extensions); err != nil {
 		return err
 	}
-	// The active mark: a retired consumer asked for again loses its mark to delete here, its LOGIN
+	// The active mark: a login locked before ADR 0570 and asked for again loses its mark to delete here, its LOGIN
 	// already set again by the role statement above (novox/hq ADR 0230).
 	if err := a.pg.MarkActive(ctx, p.As, p.Consumer); err != nil {
 		return err
@@ -47,11 +51,10 @@ func (a provisioner) Create(ctx context.Context, p harness.Provision) error {
 	return nil
 }
 
-// Retire locks the login, never drops (novox/hq issue 241, ADR 0230): the database is kept under its
-// own name, the role marked retired with when and why (retire_pg.go). On 2026-10-04 a misread
-// contributions file withdrew every consumer at once, and dropping made that a loss of seven databases.
-// Deleting is `cleanup delete`, a person's act; taking a database out of service by hand is
-// postgres_retire_database, which renames rather than drops.
+// Retire removes the login on the operator's yes (novox/hq ADR 0570 clause 5, ADR 0114 §2): what it owns is handed
+// to its keeper, its sessions end and the login is dropped; the database and its data are kept (retire_pg.go).
+// Deleting is `cleanup delete`, a person's act; taking a database out of service by hand is postgres_retire_database,
+// which renames rather than drops.
 func (a provisioner) Retire(ctx context.Context, as string, _ map[string]any, why string, at time.Time) error {
 	if err := a.pg.RetireRole(ctx, as, why, at); err != nil {
 		return err