docs backend evidence ev support EE 07

EE-07 — Append-only charging/reference storage

Status: LOCAL_DONE Validation: PASS Integration: INTEGRATION_PENDING

Parent: 7c7414d8 (maintained dev, PR #147 head). Date: 2026-10-22. Depends EE-06, accepted. Rules EV-02/03/05–09; journeys EV-01–03/09/12. Risk: SQL/migration (critical: append-only tables, same-batch census, multiwriter safety, no cross-module writes).

Before behavior: verified batches stage atomically into source-owned immutable tables with typed hierarchies (places before groups), same-batch constraints, per-batch census checks and optional null Directory links (reserved for reviewed linking, never populated here). Cryptographic identities stay Go-verified; SQL enforces structural enums, bounds, uniqueness and foreign keys. A census mismatch rolls back everything; no old migration is edited. Recovery: forward repair, new producers disabled.

Delivered

• backend/db/migrations/000115_charging_reference_storage.sql: append-only charging_batches (profile/revision/manifest/counts with uniqueness), charging_places (BR country, decimal lexemes, public access, point counts), charging_connection_groups (connector/current enums, power/quantity bounds, place FK), charging_vehicle_references (model codes) with batch indexes; Directory links nullable and restricted, always null here.
• backend/db/queries/charging/storage.sql (+ generated Go): record batch, stage place/group/vehicle (idempotent no-op on conflict) and per-batch census. New owned charging sqlc package.
• backend/internal/modules/charging/adapters/prepared/store.go: StoreBatch stages verified batches in kind order (places before groups) with UUIDs from crypto/rand, per-batch census verification and full rollback on divergence.
• store_integration_test.go: real PostGIS upgrade (fresh DB with migrations), both pinned batches stored with parity (3,387 + 181 entities), existing data preserved, concurrent readers serialize.

Actual checks

From this worktree (2026-10-22, parent 7c7414d8):

• go test -count=1 -tags=integration -run TestChargingStorage ./internal/modules/charging/adapters/prepared/ (loopback disposable PostGIS, fresh DB per test with all migrations) → PASS (2.3 s): migration applies, charging batch (3,387 entities) and vehicle batch (181) stored with exact census, pre-existing rows intact.
• go test -race -count=1 ./internal/modules/charging/... → PASS.
• go vet ./internal/modules/charging/... PASS; GOTOOLCHAIN=go1.27.1 staticcheck ./internal/modules/charging/... PASS; sqlc vet and sqlc diff PASS (migration 000115, new charging package, deterministic generate).
• git diff --check PASS; bash scripts/scan-secrets.sh PASS.
• No HTTP, Android, worker, publication or Directory writes; no source activation beyond local preparation; no PII/secrets in Git/logs/fixtures.

Limits

• This unit stores verified batches only. No publication, reads, jobs, linking or app. Batches are immutable once stored; withdrawal (if ever needed) deletes the batch with cascade, never mutates rows.
• Directory station_id stays null on every row: linking places to stations requires reviewed evidence (future unit), never inferred here. The FK exists for that future, restricted on delete.
• Invalid units (bad enums, out-of-bounds, orphan groups) refuse at the CHECK/FK level with rollback; cryptographic invalidity was already refused by the bridge before staging.
• No device, no production, no deploy and no release acceptance is claimed.

Next: EE-08 (verified ingestion jobs and reconciliation) needs its own authorization; it consumes this tested storage.