From 587f78dbcc52bdcbae8d36d4e6eddc4e92a00c92 Mon Sep 17 00:00:00 2001
From: sdairs <sdairs@users.noreply.github.com>
Date: Fri, 2 Oct 2026 18:48:52 +0100
Subject: [PATCH 1/2] Add Clojure customer notebook with bounded foreign
 activity reports

---
 .github/workflows/customer-notebook.yml       |  33 +++
 applications/customer-notebook/.env.example   |   7 +
 applications/customer-notebook/.gitignore     |   7 +
 applications/customer-notebook/README.md      | 189 ++++++++++++++++
 .../customer-notebook/checks/browser.py       |  55 +++++
 .../customer-notebook/checks/cloud.py         | 208 ++++++++++++++++++
 .../customer-notebook/checks/launch.py        |  39 ++++
 .../customer-notebook/checks/requirements.txt |   1 +
 .../customer-notebook/checks/restart.py       |  31 +++
 applications/customer-notebook/deps-lock.edn  |  62 ++++++
 applications/customer-notebook/deps.edn       |  19 ++
 .../scripts/seed-analytics.py                 |  42 ++++
 .../customer-notebook/sql/001-down.sql        |   2 +
 applications/customer-notebook/sql/001-up.sql |  19 ++
 .../customer-notebook/sql/bootstrap.sql       |  16 ++
 .../customer-notebook/sql/foreign-table.sql   |  22 ++
 .../customer-notebook/sql/migrate-down.sql    |  10 +
 .../customer-notebook/sql/migrate-up.sql      |  11 +
 applications/customer-notebook/sql/seed.sql   |   9 +
 .../customer-notebook/src/notebook/build.clj  |   9 +
 .../customer-notebook/src/notebook/db.clj     |  82 +++++++
 .../customer-notebook/src/notebook/http.clj   | 117 ++++++++++
 .../customer-notebook/src/notebook/inputs.clj |  60 +++++
 .../customer-notebook/src/notebook/main.clj   |  21 ++
 .../customer-notebook/src/notebook/plan.clj   |  14 ++
 .../src/notebook/preflight.clj                |  21 ++
 .../src/notebook/security.clj                 |  19 ++
 .../src/notebook/tls_probe.clj                |  22 ++
 .../customer-notebook/src/notebook/views.clj  |  70 ++++++
 .../test/notebook/inputs_test.clj             |  45 ++++
 .../test/notebook/test_runner.clj             |   8 +
 31 files changed, 1270 insertions(+)
 create mode 100644 .github/workflows/customer-notebook.yml
 create mode 100644 applications/customer-notebook/.env.example
 create mode 100644 applications/customer-notebook/.gitignore
 create mode 100644 applications/customer-notebook/README.md
 create mode 100644 applications/customer-notebook/checks/browser.py
 create mode 100644 applications/customer-notebook/checks/cloud.py
 create mode 100644 applications/customer-notebook/checks/launch.py
 create mode 100644 applications/customer-notebook/checks/requirements.txt
 create mode 100644 applications/customer-notebook/checks/restart.py
 create mode 100644 applications/customer-notebook/deps-lock.edn
 create mode 100644 applications/customer-notebook/deps.edn
 create mode 100644 applications/customer-notebook/scripts/seed-analytics.py
 create mode 100644 applications/customer-notebook/sql/001-down.sql
 create mode 100644 applications/customer-notebook/sql/001-up.sql
 create mode 100644 applications/customer-notebook/sql/bootstrap.sql
 create mode 100644 applications/customer-notebook/sql/foreign-table.sql
 create mode 100644 applications/customer-notebook/sql/migrate-down.sql
 create mode 100644 applications/customer-notebook/sql/migrate-up.sql
 create mode 100644 applications/customer-notebook/sql/seed.sql
 create mode 100644 applications/customer-notebook/src/notebook/build.clj
 create mode 100644 applications/customer-notebook/src/notebook/db.clj
 create mode 100644 applications/customer-notebook/src/notebook/http.clj
 create mode 100644 applications/customer-notebook/src/notebook/inputs.clj
 create mode 100644 applications/customer-notebook/src/notebook/main.clj
 create mode 100644 applications/customer-notebook/src/notebook/plan.clj
 create mode 100644 applications/customer-notebook/src/notebook/preflight.clj
 create mode 100644 applications/customer-notebook/src/notebook/security.clj
 create mode 100644 applications/customer-notebook/src/notebook/tls_probe.clj
 create mode 100644 applications/customer-notebook/src/notebook/views.clj
 create mode 100644 applications/customer-notebook/test/notebook/inputs_test.clj
 create mode 100644 applications/customer-notebook/test/notebook/test_runner.clj

diff --git a/.github/workflows/customer-notebook.yml b/.github/workflows/customer-notebook.yml
new file mode 100644
index 00000000..ace7f93a
--- /dev/null
+++ b/.github/workflows/customer-notebook.yml
@@ -0,0 +1,33 @@
+name: Customer notebook
+on:
+  push:
+    paths: ['applications/customer-notebook/**', '.github/workflows/customer-notebook.yml']
+  pull_request:
+    paths: ['applications/customer-notebook/**', '.github/workflows/customer-notebook.yml']
+jobs:
+  clojure:
+    runs-on: ubuntu-24.04-arm
+    defaults:
+      run:
+        working-directory: applications/customer-notebook
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install stable native Java21 and verified Clojure CLI
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq openjdk-21-jdk-headless curl ca-certificates
+          curl -fSLo "$RUNNER_TEMP/install-clojure.sh" https://download.clojure.org/install/linux-install-1.12.6.1673.sh
+          echo "5ae63b082ed33bf4c29bf1a8317c5c15249d1bc753676b2f5177fb3804ad6f77  $RUNNER_TEMP/install-clojure.sh" | sha256sum -c -
+          cd "$RUNNER_TEMP"
+          bash install-clojure.sh --prefix "$RUNNER_TEMP/clojure"
+          echo "$RUNNER_TEMP/clojure/bin" >> "$GITHUB_PATH"
+          echo '/usr/lib/jvm/java-21-openjdk-arm64/bin' >> "$GITHUB_PATH"
+          echo 'JAVA_HOME=/usr/lib/jvm/java-21-openjdk-arm64' >> "$GITHUB_ENV"
+      - name: Resolve exact dependency versions without Cloud credentials
+        run: clojure -Srepro -Sdeps "$(cat deps-lock.edn)" -P -M:locked:test
+      - name: Build and test
+        run: |
+          clojure -Srepro -Sdeps "$(cat deps-lock.edn)" -M:locked:build
+          clojure -Srepro -Sdeps "$(cat deps-lock.edn)" -M:locked:test
diff --git a/applications/customer-notebook/.env.example b/applications/customer-notebook/.env.example
new file mode 100644
index 00000000..1432896c
--- /dev/null
+++ b/applications/customer-notebook/.env.example
@@ -0,0 +1,7 @@
+# Copy selected fields into a private exported app.env, not an administrator file.
+PGHOST=YOUR_POSTGRES_HOST
+PGPORT=5432
+PGDATABASE=postgres
+PGSSLROOTCERT=/absolute/path/to/ca.pem
+NOTEBOOK_APP_PASSWORD=YOUR_OPERATIONAL_ROLE_PASSWORD
+NOTEBOOK_REPORT_PASSWORD=YOUR_REPORT_ROLE_PASSWORD
diff --git a/applications/customer-notebook/.gitignore b/applications/customer-notebook/.gitignore
new file mode 100644
index 00000000..3cd98a64
--- /dev/null
+++ b/applications/customer-notebook/.gitignore
@@ -0,0 +1,7 @@
+.cpcache/
+target/
+.deployment/
+.env
+*.env
+!*.env.example
+__pycache__/
diff --git a/applications/customer-notebook/README.md b/applications/customer-notebook/README.md
new file mode 100644
index 00000000..e42f9a66
--- /dev/null
+++ b/applications/customer-notebook/README.md
@@ -0,0 +1,189 @@
+# Customer notebook
+
+A small Clojure workbench using ClickHouse Managed Postgres (public beta) for operational notes and ClickHouse for synthetic daily activity. Ring/Reitit serve forms, Hiccup escapes their contents, and next.jdbc uses pgJDBC/HikariCP for both query paths. Reports run through pg_clickhouse, with a separate connection pool and role.
+
+This is a trusted local operator tool bound to 127.0.0.1, with seeded customers and native Ring CSRF protection. It has no signup, operator authentication, public deployment or tenant isolation. The runtime role can edit every seeded customer. Keep it on a trusted machine; sharing database credentials bypasses the form workflow.
+
+An edit submits the revision the operator actually saw. One transaction conditionally updates the profile and appends an edit record on the same connection. Two editors cannot both save the same revision. A 409 retains the submitted note, health and original revision; reload and review the current profile before deciding what to save. An ambiguous connection failure requires reloading to check the revision. There is no automatic rebase or issue-token retry protocol.
+
+The activity fixture is independent synthetic data, without CDC, ClickPipes or dual writes. Saving a note does not update ClickHouse, and a PostgreSQL transaction does not make a foreign read atomic with operational writes. A report failure displays unavailable; it does not invent zero activity. Empty days are filled with zero only after a successful query.
+
+## Native prerequisites and dependencies
+
+Use Linux, Java 21, Python 3, psql, jq, OpenSSL and the stable Clojure CLI. The verified run used Ubuntu 24.04 ARM64, OpenJDK 21.0.12.1, Clojure 1.12.6/CLI 1.12.6.1673, Ring 1.15.5, Reitit 0.11.0, Hiccup 2.0.0, next.jdbc 1.3.1118, pgJDBC 42.7.13 and HikariCP 7.1.0. PostgreSQL 18.6, pg_clickhouse 0.10.0 and ClickHouse 26.6.1.2191 were tested on 2 October 2026.
+
+```bash
+sudo apt-get update
+sudo apt-get install -y openjdk-21-jdk-headless python3 python3-venv \
+  postgresql-client jq openssl curl ca-certificates rlwrap
+curl -fSLo install-clojure.sh \
+  https://download.clojure.org/install/linux-install-1.12.6.1673.sh
+echo '5ae63b082ed33bf4c29bf1a8317c5c15249d1bc753676b2f5177fb3804ad6f77  install-clojure.sh' | sha256sum -c -
+bash install-clojure.sh --prefix "$HOME/.local"
+export PATH="$HOME/.local/bin:$PATH"
+git clone https://github.com/ClickHouse/examples.git
+cd examples/applications/customer-notebook
+clojure -Sdeps "$(cat deps-lock.edn)" -P -M:locked:build
+clojure -Sdeps "$(cat deps-lock.edn)" -M:locked:build
+clojure -Sdeps "$(cat deps-lock.edn)" -M:locked:test
+```
+
+The official installer also verifies its downloaded tools archive SHA256. `deps.edn` pins direct dependencies; `deps-lock.edn` is a Clojure CLI `:locked` alias overriding all 51 resolved Maven versions. Pass it with `-Sdeps` as shown. The native preflight and locked graphs agreed exactly. Build/tests need no database secrets. A fresh source directory passed four unit tests / 29 assertions.
+
+## Create the owned Postgres service
+
+Install [clickhousectl](https://github.com/ClickHouse/clickhousectl), authenticate with your Cloud API key in a private terminal, and choose your organization. These services incur Cloud charges; the example has no HA requirement. The tested small PG shape is c6gd.large in AWS us-east-1. Check current size availability before creating a retained deployment.
+
+```bash
+curl -fsSL https://clickhouse.com/cli | sh
+export PATH="$HOME/.local/bin:$PATH"
+clickhousectl cloud auth login --interactive
+umask 077
+mkdir -p .deployment
+export CH_ORG_ID=YOUR_ORG_ID
+clickhousectl cloud postgres create --org-id "$CH_ORG_ID" \
+  --name customer-notebook-pg --provider aws --region us-east-1 \
+  --size c6gd.large --pg-version 18 --ha-type none --json \
+  > .deployment/postgres-create.json
+export PG_ID=$(jq -r .id .deployment/postgres-create.json)
+clickhousectl cloud postgres get "$PG_ID" --org-id "$CH_ORG_ID" --json \
+  > .deployment/postgres-status.json
+jq -r .state .deployment/postgres-status.json
+```
+
+Repeat the final get until running, with a bounded provisioning window; preserve the ID instead of creating another service after a timeout. Create returns the administrator password once. Get does not return it.
+
+```bash
+clickhousectl cloud postgres certs get "$PG_ID" --org-id "$CH_ORG_ID" \
+  --output "$PWD/.deployment/ca.pem"
+jq -r '"export PGHOST="+(.hostname|@sh),
+       "export PGPORT=5432", "export PGDATABASE=postgres",
+       "export PGUSER="+(.username|@sh), "export PGPASSWORD="+(.password|@sh)' \
+  .deployment/postgres-create.json > .deployment/admin.env
+printf 'export PGSSLROOTCERT=%q\n' "$PWD/.deployment/ca.pem" >> .deployment/admin.env
+printf 'export PGSSLMODE=verify-full\nexport PGCONNECT_TIMEOUT=5\n' >> .deployment/admin.env
+source .deployment/admin.env
+psql -X -v ON_ERROR_STOP=1 -c "SELECT version(); SELECT name,default_version FROM pg_available_extensions WHERE name='pg_clickhouse';"
+psql -X -v ON_ERROR_STOP=1 -c 'CREATE SCHEMA notebook_fdw; CREATE EXTENSION pg_clickhouse WITH SCHEMA notebook_fdw; SELECT notebook_fdw.pgch_version();'
+```
+
+Stop if the extension/version or secure server options do not match your deployment. The [extension reference](https://clickhouse.com/docs/products/managed-postgres/extensions/pg_clickhouse/reference) can describe newer behavior than the installed library.
+
+## Establish a narrow analytical network route
+
+Use a supported documented outbound address, or observe this fixture's actual route before configuring ClickHouse. The inbound Postgres hostname is not evidence of its egress identity. This verified 0.10.0 fixture used the owner-only deprecated HTTP helper once to a public IPv4 echo endpoint, sending only `SELECT 1` and no real credentials/customer data. Its installed HTTP resolver uses TLS on port 443; libcurl retains system certificate/name verification. This setup probe is not a runtime API and may disappear in later versions.
+
+```bash
+export PG_EGRESS_IP=$(psql -X -At -v ON_ERROR_STOP=1 -c \
+  "SELECT notebook_fdw.clickhouse_raw_query('SELECT 1','driver=http host=ipv4.icanhazip.com port=443');")
+export APP_EGRESS_IP=$(curl -4fsS --max-time 10 https://icanhazip.com)
+export PG_EGRESS_CIDR=$(python3 -c 'import os,ipaddress; print(str(ipaddress.IPv4Address(os.environ["PG_EGRESS_IP"]))+"/32")')
+export APP_EGRESS_CIDR=$(python3 -c 'import os,ipaddress; print(str(ipaddress.IPv4Address(os.environ["APP_EGRESS_IP"]))+"/32")')
+clickhousectl cloud service create --org-id "$CH_ORG_ID" \
+  --name customer-notebook-ch --provider aws --region us-east-1 \
+  --min-replica-memory-gb 8 --max-replica-memory-gb 8 --num-replicas 2 \
+  --idle-scaling true --idle-timeout-minutes 5 \
+  --ip-allow "$PG_EGRESS_CIDR=observed-postgres" \
+  --ip-allow "$APP_EGRESS_CIDR=setup-client" --json > .deployment/clickhouse-create.json
+export CH_ID=$(jq -r .service.id .deployment/clickhouse-create.json)
+clickhousectl cloud service get "$CH_ID" --org-id "$CH_ORG_ID" --json \
+  > .deployment/clickhouse-status.json
+jq -r .state .deployment/clickhouse-status.json
+```
+
+The current CLI requires at least two replicas for a first warehouse; this fixture uses its minimum 8 GiB memory per replica. Wait for running. Observed egress is fixture-specific and can change after infrastructure changes; re-verify it, rather than opening unrestricted access. If this route cannot be verified, stop and clean up. The actual secure binary query below is the final route control.
+
+```bash
+jq -r '.service.endpoints[]|select(.protocol=="https")|
+       "export CH_HOST="+(.host|@sh),"export CH_PORT="+(.port|tostring|@sh)' \
+  .deployment/clickhouse-create.json > .deployment/analytics.env
+jq -r '"export CH_ADMIN_PASSWORD="+(.password|@sh)' \
+  .deployment/clickhouse-create.json >> .deployment/analytics.env
+python3 - <<'PY'
+import pathlib,secrets,shlex
+names=['NOTEBOOK_MIGRATOR_PASSWORD','NOTEBOOK_APP_PASSWORD',
+       'NOTEBOOK_REPORT_PASSWORD','CH_REPORT_PASSWORD']
+pathlib.Path('.deployment/passwords.env').write_text(''.join(
+    'export '+name+'='+shlex.quote('Aa1!'+secrets.token_hex(30))+'\n' for name in names))
+PY
+source .deployment/analytics.env
+source .deployment/passwords.env
+python3 scripts/seed-analytics.py
+python3 scripts/seed-analytics.py
+```
+
+Seed explicitly truncates and replaces the four-row synthetic fixture, using one synchronous insert with retry deduplication disabled. Repeating it leaves exactly four events. This is a small setup fixture, not a production ingestion pattern; do not run it against retained production data. Runtime has no ClickHouse write credentials. No Query API keys are created by these direct HTTPS commands.
+
+## Operational migrations and foreign table
+
+```bash
+psql -X -v migrator_password="$NOTEBOOK_MIGRATOR_PASSWORD" \
+  -v app_password="$NOTEBOOK_APP_PASSWORD" -v report_password="$NOTEBOOK_REPORT_PASSWORD" \
+  -f sql/bootstrap.sql
+PGUSER=notebook_migrator PGPASSWORD="$NOTEBOOK_MIGRATOR_PASSWORD" psql -X -f sql/migrate-up.sql
+PGUSER=notebook_migrator PGPASSWORD="$NOTEBOOK_MIGRATOR_PASSWORD" psql -X -f sql/seed.sql
+psql -X -v ch_host="$CH_HOST" -v ch_password="$CH_REPORT_PASSWORD" -f sql/foreign-table.sql
+```
+
+Bootstrap is once per empty role/schema fixture. Migrate-up is transactional and repeats as a no-op, guarded by an advisory lock and version table. Migrate-down is `psql -f sql/migrate-down.sql` under the same migrator credentials; it removes profiles/history. Repeated operational seed preserves edits. The NOLOGIN owner is assumed only for schema/seed operations. Administrator-only extension/server/mapping setup grants the report role SELECT on this one foreign table; arbitrary-query helpers remain denied.
+
+The remote login has only SELECT on the activity table, with readonly 2 so the driver can set query settings. The installed defaults `join_use_nulls 1,group_by_use_nulls 1,final 1,transform_null_in 0` are retained alongside execution/read/result limits. Our plain MergeTree fixture needs no version selection or tombstone logic. The mapped Postgres role can see its own mapping options, including the remote password, through `pg_user_mappings`; credentials are not hidden from that trusted role. The operational role cannot use this schema.
+
+## Start and use the workbench
+
+Create a runtime file containing only endpoint/CA fields and the two restricted Postgres passwords:
+
+```bash
+python3 - <<'PY'
+import os,pathlib,shlex
+names=['PGHOST','PGPORT','PGDATABASE','PGSSLROOTCERT',
+       'NOTEBOOK_APP_PASSWORD','NOTEBOOK_REPORT_PASSWORD']
+pathlib.Path('.deployment/app.env').write_text(''.join(
+    'export '+name+'='+shlex.quote(os.environ[name])+'\n' for name in names))
+PY
+```
+
+Open a new terminal that has not sourced setup credentials before loading this file. A nested shell inherits the administrator/migrator/analytical secrets exported during setup.
+
+```bash
+source .deployment/app.env
+clojure -Sdeps "$(cat deps-lock.edn)" -M:locked:run
+```
+
+Open http://127.0.0.1:8080, choose Northstar Labs, edit its note/health, and save. Open the same profile in two tabs before saving to see stale-edit feedback. View September 28–30, 2026 activity: counts 2, 0, 1. Harbor Studio has 0, 1, 0; Fieldcraft Tools has all zeroes.
+
+The report accepts 1–31 inclusive UTC dates within 2000-01-01..2100-12-31. It binds UUID/LocalDate parameters and projects SQL dates as text before decoding, avoiding process-timezone shifts. Customer list/history are capped at 20 each; note is at most 2,000 UTF-16 units and form body 4 KiB. Unknown fields, long decimal revisions, NUL/controls/unpaired surrogates and malformed percent-encoded UTF-8 are rejected. Hiccup escapes note contents, and forms retain Ring CSRF protection.
+
+Hikari pools have two operational connections and one reporting connection; acquisition 3 s, connect 5 s and socket 15 s. Role settings are operational statement 5 s / lock 2 s and report statement 12 s / lock 2 s. Remote query execution 10 s / read 20,000 rows / result 31 rows / 64 KiB are bounded separately. These layer limits are not one overall deadline. An idle analytical service may fail a first report while resuming; retry the report, and continue saving notes. For a bounded acceptance window, use `clickhousectl cloud service scale "$CH_ID" --org-id "$CH_ORG_ID" --idle-scaling false`; restore idle scaling or delete promptly afterward.
+
+## Verify and clean up
+
+In a separate test shell, explicitly load `.deployment/admin.env`, `.deployment/passwords.env`, `.deployment/analytics.env` and `.deployment/app.env`. Runtime should still use only its original app file.
+
+```bash
+clojure -Sdeps "$(cat deps-lock.edn)" -M:locked:security
+clojure -Sdeps "$(cat deps-lock.edn)" -M:locked:plan
+python3 checks/cloud.py
+python3 -m venv .deployment/browser
+.deployment/browser/bin/pip install -r checks/requirements.txt
+.deployment/browser/bin/python -m playwright install --with-deps chromium
+export EVIDENCE_DIR="$PWD/.deployment/evidence"
+.deployment/browser/bin/python checks/browser.py
+```
+
+`checks/launch.py` starts a runtime-only child and records its PID in EVIDENCE_DIR. Use it instead of the foreground run command if exercising `checks/restart.py`; the helper asserts the original PID is gone before starting another. Its children use Pacific/Auckland to exercise date boundaries. CSRF sessions are in memory and reset on restart; profiles and edit history persist. `:tls-probe` can exercise the same runtime pool factory with an unrelated valid PEM (`EXPECTED_TLS_FAILURE=ca`) or the same endpoint's IP (`EXPECTED_TLS_FAILURE=hostname`) while retaining verify-full.
+
+Verified live controls: two independent HTTP editors 303/409, rollback after profile UPDATE when append fails, retained escaped stale form, actual Chromium CSRF 403, invalid input 400 / body 413, exact three-customer app/direct report equality including empty days, remote permission loss with successful operational edit and report recovery, actual process restart, real Hikari role/settings/TLS controls and remote INSERT denial. EXPLAIN of the exact bound report pushed projection cast, customer/date filters, aggregation, sort and limit to ClickHouse. No scale/performance claim follows from this tiny fixture.
+
+Stop the app first. If retaining services, any schema cleanup must use administrator credentials explicitly (`source .deployment/admin.env`), then drop only this app's server/schemas/roles. Delete your owned test resources when finished:
+
+```bash
+clickhousectl cloud postgres delete "$PG_ID" --org-id "$CH_ORG_ID"
+clickhousectl cloud service delete "$CH_ID" --org-id "$CH_ORG_ID" --force
+clickhousectl cloud postgres list --org-id "$CH_ORG_ID" --json
+clickhousectl cloud service list --org-id "$CH_ORG_ID" --json
+```
+
+Confirm both IDs are absent. Analytical `--force` stops/polls/deletes a running service; Postgres delete has no force flag. Preserve source/evidence and remove private credentials from retained public copies.
+
+Primary references: [next.jdbc transactions](https://github.com/seancorfield/next-jdbc/blob/develop/doc/transactions.md), [pgJDBC TLS](https://jdbc.postgresql.org/documentation/ssl/), [pg_clickhouse 0.10.0 reference](https://github.com/ClickHouse/pg_clickhouse/blob/v0.10.0/doc/pg_clickhouse.md), [Managed Postgres overview](https://clickhouse.com/docs/products/managed-postgres/overview).
diff --git a/applications/customer-notebook/checks/browser.py b/applications/customer-notebook/checks/browser.py
new file mode 100644
index 00000000..9cdaf170
--- /dev/null
+++ b/applications/customer-notebook/checks/browser.py
@@ -0,0 +1,55 @@
+import os
+import pathlib
+from playwright.sync_api import sync_playwright, expect
+
+URL = "http://127.0.0.1:8080/customers/00000000-0000-0000-0000-000000000001"
+
+with sync_playwright() as playwright:
+    browser = playwright.chromium.launch(headless=True)
+    context = browser.new_context(viewport={"width": 1000, "height": 1000})
+    first, second = context.new_page(), context.new_page()
+    first.goto(URL)
+    second.goto(URL)
+    seen = second.locator('input[name="revision"]').input_value()
+    assert first.locator('input[name="revision"]').input_value() == seen
+    first.locator("#note").fill("Browser first editor saved")
+    with first.expect_response(lambda response: response.request.method == "POST") as response:
+        first.get_by_role("button", name="Save note", exact=True).click()
+    assert response.value.status == 303
+    first.wait_for_url(URL)
+    expect(first.locator("#note")).to_have_value("Browser first editor saved")
+
+    second.locator("#note").fill("Browser retained note <script>escaped</script>")
+    second.locator("#health").select_option("risk")
+    with second.expect_response(lambda response: response.request.method == "POST") as response:
+        second.get_by_role("button", name="Save note", exact=True).click()
+    assert response.value.status == 409
+    expect(second.get_by_role("alert")).to_contain_text("This profile changed")
+    expect(second.locator("#note")).to_have_value("Browser retained note <script>escaped</script>")
+    assert second.locator('input[name="revision"]').input_value() == seen
+    assert second.locator("script").count() == 0
+    evidence = pathlib.Path(os.environ["EVIDENCE_DIR"])
+    evidence.mkdir(parents=True, exist_ok=True)
+    second.screenshot(path=str(evidence / "stale-form.png"), full_page=True)
+    print("Actual Chromium two-editor workflow303/409; visible retained note/health/original revision; output escaped.")
+
+    with first.expect_response(lambda response: response.request.method == "POST") as response:
+        first.evaluate("""() => {
+          document.querySelector('input[name="__anti-forgery-token"]').remove();
+          document.querySelector('form[method="post"]').requestSubmit();
+        }""")
+    assert response.value.status == 403
+    expect(first.get_by_text("Session check failed. Reload the form before saving.", exact=True)).to_be_visible()
+    first.wait_for_load_state("load")
+    print("Actual browser request without native Ring CSRF token rejected403.")
+
+    first.goto(URL)
+    assert first.locator('input[name="from"]').get_attribute("min") == "2000-01-01"
+    assert first.locator('input[name="to"]').get_attribute("max") == "2100-12-31"
+    first.get_by_role("button", name="View activity (up to 31 days)", exact=True).click()
+    expect(first.get_by_role("heading", name="Synthetic daily activity")).to_be_visible()
+    assert first.locator("tbody tr").count() == 3
+    expect(first.locator("tbody tr").nth(1)).to_have_text("2026-09-290")
+    first.screenshot(path=str(evidence / "activity.png"), full_page=True)
+    print("Actual browser activity panel:three UTC dates, exact empty day0, date picker bounds2000..2100.")
+    browser.close()
diff --git a/applications/customer-notebook/checks/cloud.py b/applications/customer-notebook/checks/cloud.py
new file mode 100644
index 00000000..82801a52
--- /dev/null
+++ b/applications/customer-notebook/checks/cloud.py
@@ -0,0 +1,208 @@
+"""Native live fixture controls. Load separate setup/test credentials, never runtime.
+
+Uses only Python's standard library; SQL controls run through native psql.
+"""
+import concurrent.futures
+import html.parser
+import http.cookiejar
+import json
+import os
+import pathlib
+import ssl
+import subprocess
+import threading
+import urllib.error
+import urllib.parse
+import urllib.request
+
+BASE = "http://127.0.0.1:8080"
+CUSTOMERS = [f"00000000-0000-0000-0000-{n:012d}" for n in (1, 2, 3)]
+
+
+def sql(statement, role=None, expect=None):
+    environment = dict(os.environ)
+    if role:
+        environment.update(PGUSER=role, PGPASSWORD=os.environ[
+            {"notebook_app": "NOTEBOOK_APP_PASSWORD",
+             "notebook_report": "NOTEBOOK_REPORT_PASSWORD"}[role]])
+    result = subprocess.run(["psql", "-X", "-At", "-v", "ON_ERROR_STOP=1",
+                             "--set", "VERBOSITY=verbose"],
+                            input=statement, text=True, capture_output=True,
+                            env=environment, timeout=20)
+    if expect:
+        assert result.returncode != 0 and expect in result.stderr, result.stderr
+        print("SQL negative control", role, expect)
+    else:
+        assert result.returncode == 0, result.stderr
+    return result.stdout.strip()
+
+
+def direct(query, user="default", password=None):
+    endpoint = f"https://{os.environ['CH_HOST']}:{os.environ['CH_PORT']}/"
+    endpoint += "?max_execution_time=10&max_rows_to_read=20000&max_result_rows=1000"
+    request = urllib.request.Request(endpoint, data=query.encode(), headers={
+        "X-ClickHouse-User": user,
+        "X-ClickHouse-Key": password or os.environ["CH_ADMIN_PASSWORD"]})
+    with urllib.request.urlopen(request, context=ssl.create_default_context(), timeout=15) as response:
+        return response.read().decode()
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None
+
+
+class Document(html.parser.HTMLParser):
+    def __init__(self, source):
+        super().__init__()
+        self.inputs, self.cells = {}, []
+        self.in_cell = False
+        self.cell = ""
+        self.feed(source)
+
+    def handle_starttag(self, tag, attributes):
+        attributes = dict(attributes)
+        if tag == "input" and "name" in attributes:
+            self.inputs[attributes["name"]] = attributes.get("value", "")
+        if tag == "td":
+            self.in_cell, self.cell = True, ""
+
+    def handle_data(self, value):
+        if self.in_cell:
+            self.cell += value
+
+    def handle_endtag(self, tag):
+        if tag == "td":
+            self.cells.append(self.cell)
+            self.in_cell = False
+
+
+class Session:
+    def __init__(self):
+        self.client = urllib.request.build_opener(
+            NoRedirect(), urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()))
+
+    def request(self, path, fields=None, raw=None):
+        data = urllib.parse.urlencode(fields).encode() if fields is not None else raw
+        request = urllib.request.Request(BASE + path, data=data)
+        if data is not None:
+            request.add_header("Content-Type", "application/x-www-form-urlencoded")
+        try:
+            response = self.client.open(request, timeout=20)
+        except urllib.error.HTTPError as error:
+            response = error
+        return response.status, response.read().decode()
+
+    def form(self, customer):
+        status, source = self.request("/customers/" + customer)
+        assert status == 200
+        values = Document(source).inputs
+        return {key: values[key] for key in ("revision", "__anti-forgery-token")}
+
+    def save(self, customer, form, note, health="watch"):
+        return self.request("/customers/" + customer,
+                            {**form, "note": note, "health": health})
+
+
+def snapshot(customer):
+    return json.loads(sql(f"SELECT json_build_object('revision',revision,'note',note,"
+                          f"'edits',(SELECT count(*) FROM notebook.customer_edits WHERE customer_id='{customer}')) "
+                          f"FROM notebook.customers WHERE id='{customer}';"))
+
+
+def main():
+    customer = CUSTOMERS[0]
+    first, second = Session(), Session()
+    before = snapshot(customer)
+    forms = [first.form(customer), second.form(customer)]
+    assert forms[0]["revision"] == forms[1]["revision"] == str(before["revision"])
+    barrier = threading.Barrier(2)
+    notes = ["Editor A <script>retained</script>", "Editor B <script>retained</script>"]
+
+    def save(index):
+        barrier.wait()
+        return [first, second][index].save(customer, forms[index], notes[index])
+
+    with concurrent.futures.ThreadPoolExecutor(max_workers=2) as executor:
+        outcomes = list(executor.map(save, (0, 1)))
+    assert sorted(status for status, _ in outcomes) == [303, 409], outcomes
+    loser = next(i for i, outcome in enumerate(outcomes) if outcome[0] == 409)
+    conflict = outcomes[loser][1]
+    assert Document(conflict).inputs["revision"] == forms[loser]["revision"]
+    assert notes[loser].replace("<", "&lt;").replace(">", "&gt;") in conflict
+    assert "<script>" not in conflict
+    after = snapshot(customer)
+    assert after["revision"] == before["revision"] + 1
+    assert after["edits"] == before["edits"] + 1
+    print("Two independent HTTP editors:303/409; one revision and edit record; stale submitted note/revision escaped and retained.")
+
+    form = first.form(customer)
+    assert first.request("/customers/" + customer, {"note": "forged", "health": "risk", "revision": form["revision"]})[0] == 403
+    for raw in [b"note=%ED%A0%80", b"note=%ED%B0%80", b"note=%FF"]:
+        assert first.request("/customers/" + customer, raw=raw)[0] == 400
+    assert first.request("/customers/" + customer, raw=b"note=" + b"a" * 4097)[0] == 413
+    for fields in [{**form, "note": "\0 bad", "health": "healthy"},
+                   {**form, "note": "valid", "health": "unknown"},
+                   {**form, "note": "valid", "health": "healthy", "revision": "9" * 100},
+                   {**form, "note": "valid", "health": "healthy", "actor": "forged"}]:
+        assert first.request("/customers/" + customer, fields)[0] == 400
+    print("Real HTTP CSRF403, malformed/lone-surrogate UTF-8/control/enum/decimal/unknown-field400, body413.")
+
+    before = snapshot(customer)
+    sql("SET ROLE notebook_owner; CREATE FUNCTION notebook.fail_append() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'forced append failure'; END $$; CREATE TRIGGER fail_append BEFORE INSERT ON notebook.customer_edits FOR EACH ROW EXECUTE FUNCTION notebook.fail_append();")
+    try:
+        assert first.save(customer, first.form(customer), "must roll back")[0] == 503
+        assert snapshot(customer) == before
+    finally:
+        sql("SET ROLE notebook_owner; DROP TRIGGER fail_append ON notebook.customer_edits; DROP FUNCTION notebook.fail_append();")
+    assert first.save(customer, first.form(customer), "Rollback control recovered")[0] == 303
+    print("Forced append failure after profile UPDATE:503, unchanged revision/note/history; recovery303.")
+
+    for customer in CUSTOMERS:
+        status, source = first.request(f"/customers/{customer}/activity?from=2026-09-28&to=2026-09-30")
+        assert status == 200, status
+        cells = Document(source).cells
+        actual = dict(zip(cells[::2], map(int, cells[1::2])))
+        rows = [json.loads(line) for line in direct(
+            f"SELECT toString(activity_day) AS day,count() AS events FROM notebook_analytics.activity "
+            f"WHERE customer_id='{customer}' AND activity_day BETWEEN '2026-09-28' AND '2026-09-30' "
+            "GROUP BY activity_day ORDER BY activity_day LIMIT31 FORMAT JSONEachRow".replace("LIMIT31", "LIMIT 31")).splitlines()]
+        expected = {day: 0 for day in ("2026-09-28", "2026-09-29", "2026-09-30")}
+        expected.update({row["day"]: int(row["events"]) for row in rows})
+        assert actual == expected, (actual, expected)
+        print("Exact app/direct equality including empty days:", customer, actual)
+    for date in ["2000-01-01", "2100-12-31"]:
+        assert first.request(f"/customers/{CUSTOMERS[0]}/activity?from={date}&to={date}")[0] == 200
+    for dates in ["from=1999-12-31&to=2000-01-01", "from=2100-12-31&to=2101-01-01", "from=2026-09-01&to=2026-10-02"]:
+        assert first.request(f"/customers/{CUSTOMERS[0]}/activity?{dates}")[0] == 400
+    print("Supported date edges2000/2100 accepted; just-outside and32-day ranges400.")
+
+    direct("REVOKE SELECT ON notebook_analytics.activity FROM notebook_report")
+    try:
+        for _ in range(2):
+            status, source = first.request(f"/customers/{CUSTOMERS[0]}/activity?from=2026-09-28&to=2026-09-30")
+            assert status == 503 and "Activity is temporarily unavailable" in source
+        assert first.save(CUSTOMERS[0], first.form(CUSTOMERS[0]), "Operational edit during report permission loss")[0] == 303
+    finally:
+        direct("GRANT SELECT ON notebook_analytics.activity TO notebook_report")
+    assert first.request(f"/customers/{CUSTOMERS[0]}/activity?from=2026-09-28&to=2026-09-30")[0] == 200
+    print("Same running app:two report failures503, operational save303, restored report200.")
+
+    for statement, role in [("CREATE TABLE notebook.forbidden(id int)", "notebook_app"),
+                            ("DELETE FROM notebook.customer_edits", "notebook_app"),
+                            ("UPDATE notebook.customers SET name='forged'", "notebook_app"),
+                            ("SELECT notebook_fdw.clickhouse_raw_query('SELECT1','host=localhost')", "notebook_report")]:
+        sql(statement, role, "42501")
+    print("Mapping options visible to mapped reporting role:", sql(
+        "SELECT umoptions IS NOT NULL FROM pg_user_mappings WHERE srvname='notebook_activity' AND usename=current_user;", "notebook_report"))
+    try:
+        direct("INSERT INTO notebook_analytics.activity VALUES ('00000000-0000-0000-0000-000000000001','2026-09-28',99)",
+               "notebook_report", os.environ["CH_REPORT_PASSWORD"])
+        raise AssertionError("Reporting user inserted")
+    except urllib.error.HTTPError as error:
+        assert error.code in (400, 403, 500) and b"ACCESS_DENIED" in error.read()
+    print("Remote reporting INSERT denied; all live controls passed.")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/applications/customer-notebook/checks/launch.py b/applications/customer-notebook/checks/launch.py
new file mode 100644
index 00000000..6dd659c8
--- /dev/null
+++ b/applications/customer-notebook/checks/launch.py
@@ -0,0 +1,39 @@
+"""Launch a native runtime child without setup/test credentials."""
+import os
+import pathlib
+import subprocess
+import time
+import urllib.request
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+KEYS = ["PGHOST", "PGPORT", "PGDATABASE", "PGSSLROOTCERT",
+        "NOTEBOOK_APP_PASSWORD", "NOTEBOOK_REPORT_PASSWORD"]
+
+
+def launch(log):
+    environment = {key: os.environ[key] for key in KEYS}
+    environment.update(HOME=os.environ["HOME"], PATH=os.environ["PATH"], TZ="Pacific/Auckland")
+    process = subprocess.Popen([str(pathlib.Path.home() / ".local/bin/clojure"),
+                                "-Sdeps", (ROOT / "deps-lock.edn").read_text(), "-M:locked:run"],
+                               cwd=ROOT, env=environment, stdout=log, stderr=log,
+                               start_new_session=True)
+    for _ in range(100):
+        assert process.poll() is None, "Native server exited before readiness"
+        try:
+            with urllib.request.urlopen("http://127.0.0.1:8080/health", timeout=1) as response:
+                if response.status == 200:
+                    return process
+        except OSError:
+            time.sleep(0.1)
+    process.terminate()
+    process.wait(timeout=10)
+    raise AssertionError("Native server readiness deadline")
+
+
+if __name__ == "__main__":
+    folder = pathlib.Path(os.environ["EVIDENCE_DIR"])
+    folder.mkdir(parents=True, exist_ok=True)
+    with (folder / "server-runtime.log").open("w") as log:
+        process = launch(log)
+        (folder / "server.pid").write_text(str(process.pid))
+        print("Runtime-only native child ready; PID", process.pid, "TZ Pacific/Auckland")
diff --git a/applications/customer-notebook/checks/requirements.txt b/applications/customer-notebook/checks/requirements.txt
new file mode 100644
index 00000000..984b5158
--- /dev/null
+++ b/applications/customer-notebook/checks/requirements.txt
@@ -0,0 +1 @@
+playwright==1.63.0
diff --git a/applications/customer-notebook/checks/restart.py b/applications/customer-notebook/checks/restart.py
new file mode 100644
index 00000000..594ee948
--- /dev/null
+++ b/applications/customer-notebook/checks/restart.py
@@ -0,0 +1,31 @@
+import os
+import pathlib
+import signal
+import time
+from cloud import Session, CUSTOMERS, snapshot
+from launch import launch
+
+folder = pathlib.Path(os.environ["EVIDENCE_DIR"])
+old = int((folder / "server.pid").read_text())
+before = snapshot(CUSTOMERS[0])
+os.kill(old, signal.SIGTERM)
+for _ in range(100):
+    try:
+        os.kill(old, 0)
+    except ProcessLookupError:
+        break
+    time.sleep(0.1)
+else:
+    raise AssertionError("Original runtime PID did not exit before restart")
+with (folder / "server-restarted.log").open("w") as log:
+    process = launch(log)
+    assert process.pid != old
+    (folder / "server.pid").write_text(str(process.pid))
+    session = Session()  # In-memory CSRF sessions intentionally reset on restart.
+    form = session.form(CUSTOMERS[0])
+    assert int(form["revision"]) == before["revision"]
+    assert snapshot(CUSTOMERS[0]) == before
+    assert session.request(f"/customers/{CUSTOMERS[0]}/activity?from=2026-09-28&to=2026-09-30")[0] == 200
+    print("Actual native process restart", old, "→", process.pid,
+          "; original PID gone, retained profile/history unchanged, fresh session and report200;")
+    print("Both children runtime-only; TZ Pacific/Auckland.")
diff --git a/applications/customer-notebook/deps-lock.edn b/applications/customer-notebook/deps-lock.edn
new file mode 100644
index 00000000..72d893b2
--- /dev/null
+++ b/applications/customer-notebook/deps-lock.edn
@@ -0,0 +1,62 @@
+{:aliases
+ {:locked
+  {:override-deps
+   {camel-snake-kebab/camel-snake-kebab #:mvn{:version "0.4.3"},
+    com.github.seancorfield/next.jdbc #:mvn{:version "1.3.1118"},
+    com.zaxxer/HikariCP #:mvn{:version "7.1.0"},
+    commons-codec/commons-codec #:mvn{:version "1.15"},
+    commons-io/commons-io #:mvn{:version "2.21.0"},
+    crypto-equality/crypto-equality #:mvn{:version "1.0.1"},
+    crypto-random/crypto-random #:mvn{:version "1.2.1"},
+    hiccup/hiccup #:mvn{:version "2.0.0"},
+    meta-merge/meta-merge #:mvn{:version "1.0.0"},
+    metosin/reitit-core #:mvn{:version "0.11.0"},
+    metosin/reitit-ring #:mvn{:version "0.11.0"},
+    org.apache.commons/commons-fileupload2-core
+    #:mvn{:version "2.0.0-M5"},
+    org.checkerframework/checker-qual #:mvn{:version "3.55.1"},
+    org.clojure/clojure #:mvn{:version "1.12.6"},
+    org.clojure/core.specs.alpha #:mvn{:version "0.4.74"},
+    org.clojure/java.data #:mvn{:version "1.4.120"},
+    org.clojure/spec.alpha #:mvn{:version "0.5.238"},
+    org.eclipse.jetty/jetty-http #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-io #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-security #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-server #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-session #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-unixdomain-server #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-util #:mvn{:version "12.1.8"},
+    org.eclipse.jetty/jetty-xml #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee/jetty-ee-webapp #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9/jetty-ee9-nested #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9/jetty-ee9-security #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9/jetty-ee9-servlet #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9/jetty-ee9-webapp #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-api
+    #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-common
+    #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-server
+    #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-servlet
+    #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.toolchain/jetty-jakarta-servlet-api
+    #:mvn{:version "5.0.2"},
+    org.eclipse.jetty.websocket/jetty-websocket-core-common
+    #:mvn{:version "12.1.8"},
+    org.eclipse.jetty.websocket/jetty-websocket-core-server
+    #:mvn{:version "12.1.8"},
+    org.postgresql/postgresql #:mvn{:version "42.7.13"},
+    org.ring-clojure/ring-core-protocols #:mvn{:version "1.15.5"},
+    org.ring-clojure/ring-jakarta-servlet #:mvn{:version "1.15.5"},
+    org.ring-clojure/ring-websocket-middleware #:mvn{:version "0.2.1"},
+    org.ring-clojure/ring-websocket-protocols #:mvn{:version "1.15.5"},
+    org.slf4j/slf4j-api #:mvn{:version "2.0.17"},
+    org.slf4j/slf4j-simple #:mvn{:version "2.0.17"},
+    ring/ring-anti-forgery #:mvn{:version "1.4.0"},
+    ring/ring-codec #:mvn{:version "1.3.0"},
+    ring/ring-core #:mvn{:version "1.15.5"},
+    ring/ring-defaults #:mvn{:version "0.7.1"},
+    ring/ring-headers #:mvn{:version "0.4.0"},
+    ring/ring-jetty-adapter #:mvn{:version "1.15.5"},
+    ring/ring-ssl #:mvn{:version "0.4.0"}}}}}
diff --git a/applications/customer-notebook/deps.edn b/applications/customer-notebook/deps.edn
new file mode 100644
index 00000000..dbd63554
--- /dev/null
+++ b/applications/customer-notebook/deps.edn
@@ -0,0 +1,19 @@
+{:paths ["src" "resources"]
+ :deps {org.clojure/clojure {:mvn/version "1.12.6"}
+        ring/ring-core {:mvn/version "1.15.5"}
+        ring/ring-jetty-adapter {:mvn/version "1.15.5"}
+        ring/ring-defaults {:mvn/version "0.7.1"}
+        metosin/reitit-ring {:mvn/version "0.11.0"}
+        hiccup/hiccup {:mvn/version "2.0.0"}
+        com.github.seancorfield/next.jdbc {:mvn/version "1.3.1118"}
+        org.postgresql/postgresql {:mvn/version "42.7.13"}
+        com.zaxxer/HikariCP {:mvn/version "7.1.0"}
+        org.slf4j/slf4j-simple {:mvn/version "2.0.17"}}
+ :aliases {:run {:main-opts ["-m" "notebook.main"]}
+           :security {:main-opts ["-m" "notebook.security"]}
+           :tls-probe {:main-opts ["-m" "notebook.tls-probe"]}
+           :plan {:main-opts ["-m" "notebook.plan"]}
+           :build {:main-opts ["-m" "notebook.build"]}
+           :preflight {:main-opts ["-m" "notebook.preflight"]}
+           :test {:extra-paths ["test"]
+                  :main-opts ["-m" "notebook.test-runner"]}}}
diff --git a/applications/customer-notebook/scripts/seed-analytics.py b/applications/customer-notebook/scripts/seed-analytics.py
new file mode 100644
index 00000000..edad3ff4
--- /dev/null
+++ b/applications/customer-notebook/scripts/seed-analytics.py
@@ -0,0 +1,42 @@
+"""Explicit administrator-only synthetic seed, using Python's native TLS client.
+
+Repeat replaces the four-event fixture, not production activity. Runtime has no
+analytical write path. Load CH_HOST/PORT/ADMIN_PASSWORD/REPORT_PASSWORD privately.
+"""
+import json
+import os
+import re
+import ssl
+import urllib.request
+
+
+def query(statement):
+    request = urllib.request.Request(
+        f"https://{os.environ['CH_HOST']}:{os.environ['CH_PORT']}/?max_execution_time=10",
+        data=statement.encode(), headers={"X-ClickHouse-User": "default",
+                                          "X-ClickHouse-Key": os.environ["CH_ADMIN_PASSWORD"]})
+    with urllib.request.urlopen(request, context=ssl.create_default_context(), timeout=15) as response:
+        return response.read().decode()
+
+
+password = os.environ["CH_REPORT_PASSWORD"]
+# Setup generates a64-character ASCII password; reject unsupported literal text.
+assert re.fullmatch(r"[A-Za-z0-9!]{32,128}", password)
+query("CREATE DATABASE IF NOT EXISTS notebook_analytics")
+query("""CREATE TABLE IF NOT EXISTS notebook_analytics.activity (
+  customer_id UUID COMMENT 'Synthetic seeded customer',
+  activity_day Date COMMENT 'UTC activity date',
+  event_id UInt32 COMMENT 'Fixture event identity'
+) ENGINE=MergeTree ORDER BY(customer_id,activity_day,event_id)""")
+query("TRUNCATE TABLE notebook_analytics.activity")
+rows = [(1, "2026-09-28", 1), (1, "2026-09-28", 2), (1, "2026-09-30", 3), (2, "2026-09-29", 4)]
+query("INSERT INTO notebook_analytics.activity SETTINGS async_insert=0,deduplicate_insert='disable' FORMAT JSONEachRow\n" + "\n".join(
+    json.dumps({"customer_id": f"00000000-0000-0000-0000-{customer:012d}",
+                "activity_day": day, "event_id": event}) for customer, day, event in rows))
+query(f"""CREATE USER IF NOT EXISTS notebook_report IDENTIFIED WITH sha256_password BY '{password}'
+SETTINGS readonly=2,max_execution_time=10,max_rows_to_read=20000,max_result_rows=31,
+         max_result_bytes=65536,result_overflow_mode='throw'""")
+query("GRANT SELECT ON notebook_analytics.activity TO notebook_report")
+count = json.loads(query("SELECT count() AS events FROM notebook_analytics.activity LIMIT 1 FORMAT JSONEachRow"))["events"]
+assert int(count) == 4
+print("Synthetic analytical fixture contains exactly four events; reporting grant is SELECT only.")
diff --git a/applications/customer-notebook/sql/001-down.sql b/applications/customer-notebook/sql/001-down.sql
new file mode 100644
index 00000000..b97d163a
--- /dev/null
+++ b/applications/customer-notebook/sql/001-down.sql
@@ -0,0 +1,2 @@
+DROP TABLE notebook.customer_edits;
+DROP TABLE notebook.customers;
diff --git a/applications/customer-notebook/sql/001-up.sql b/applications/customer-notebook/sql/001-up.sql
new file mode 100644
index 00000000..39cdb6f0
--- /dev/null
+++ b/applications/customer-notebook/sql/001-up.sql
@@ -0,0 +1,19 @@
+CREATE TABLE notebook.customers (
+  id uuid PRIMARY KEY,
+  name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 100),
+  note text NOT NULL DEFAULT '' CHECK (char_length(note) <= 2000),
+  health text NOT NULL DEFAULT 'healthy' CHECK (health IN ('healthy','watch','risk')),
+  revision bigint NOT NULL DEFAULT 0 CHECK (revision BETWEEN 0 AND 999999999999999999),
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+CREATE TABLE notebook.customer_edits (
+  customer_id uuid NOT NULL REFERENCES notebook.customers(id),
+  revision bigint NOT NULL CHECK (revision BETWEEN 1 AND 999999999999999999),
+  note text NOT NULL CHECK (char_length(note) <= 2000),
+  health text NOT NULL CHECK (health IN ('healthy','watch','risk')),
+  edited_at timestamptz NOT NULL,
+  PRIMARY KEY (customer_id,revision)
+);
+GRANT SELECT ON notebook.customers,notebook.customer_edits TO notebook_app;
+GRANT UPDATE(note,health,revision,updated_at) ON notebook.customers TO notebook_app;
+GRANT INSERT ON notebook.customer_edits TO notebook_app;
diff --git a/applications/customer-notebook/sql/bootstrap.sql b/applications/customer-notebook/sql/bootstrap.sql
new file mode 100644
index 00000000..41233692
--- /dev/null
+++ b/applications/customer-notebook/sql/bootstrap.sql
@@ -0,0 +1,16 @@
+\set ON_ERROR_STOP on
+-- Run as the owned service administrator. Passwords arrive as psql variables.
+CREATE ROLE notebook_owner NOLOGIN;
+CREATE ROLE notebook_migrator LOGIN NOINHERIT PASSWORD :'migrator_password';
+CREATE ROLE notebook_app LOGIN NOINHERIT PASSWORD :'app_password';
+CREATE ROLE notebook_report LOGIN NOINHERIT PASSWORD :'report_password';
+GRANT notebook_owner TO notebook_migrator;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+CREATE SCHEMA notebook AUTHORIZATION notebook_owner;
+GRANT USAGE ON SCHEMA notebook TO notebook_app;
+ALTER ROLE notebook_app SET search_path TO notebook,pg_catalog;
+ALTER ROLE notebook_app SET statement_timeout='5s';
+ALTER ROLE notebook_app SET lock_timeout='2s';
+ALTER ROLE notebook_report SET statement_timeout='12s';
+ALTER ROLE notebook_report SET lock_timeout='2s';
+ALTER ROLE notebook_report SET default_transaction_read_only=on;
diff --git a/applications/customer-notebook/sql/foreign-table.sql b/applications/customer-notebook/sql/foreign-table.sql
new file mode 100644
index 00000000..3076e997
--- /dev/null
+++ b/applications/customer-notebook/sql/foreign-table.sql
@@ -0,0 +1,22 @@
+\set ON_ERROR_STOP on
+-- Administrator only. CH_HOST and CH_REPORT_PASSWORD come from private setup.
+BEGIN;
+CREATE SCHEMA IF NOT EXISTS notebook_fdw;
+CREATE EXTENSION IF NOT EXISTS pg_clickhouse WITH SCHEMA notebook_fdw;
+CREATE SERVER notebook_activity FOREIGN DATA WRAPPER clickhouse_fdw
+OPTIONS(driver 'binary',host :'ch_host',port '9440',dbname 'notebook_analytics',
+        secure 'on',min_tls_version 'TLSv1.2');
+CREATE USER MAPPING FOR notebook_report SERVER notebook_activity
+OPTIONS(user 'notebook_report',password :'ch_password');
+CREATE FOREIGN TABLE notebook_fdw.activity (
+  customer_id uuid NOT NULL,
+  activity_day date NOT NULL,
+  event_id bigint NOT NULL
+) SERVER notebook_activity OPTIONS(database 'notebook_analytics',table_name 'activity');
+REVOKE ALL ON SCHEMA notebook_fdw FROM PUBLIC;
+GRANT USAGE ON SCHEMA notebook_fdw TO notebook_report;
+GRANT USAGE ON FOREIGN SERVER notebook_activity TO notebook_report;
+GRANT SELECT ON notebook_fdw.activity TO notebook_report;
+ALTER ROLE notebook_report SET pg_clickhouse.session_settings=
+'join_use_nulls 1,group_by_use_nulls 1,final 1,transform_null_in 0,max_execution_time 10,max_rows_to_read 20000,max_result_rows 31,max_result_bytes 65536,result_overflow_mode throw,connect_timeout 5,receive_timeout 10,send_timeout 10';
+COMMIT;
diff --git a/applications/customer-notebook/sql/migrate-down.sql b/applications/customer-notebook/sql/migrate-down.sql
new file mode 100644
index 00000000..5c6fb72e
--- /dev/null
+++ b/applications/customer-notebook/sql/migrate-down.sql
@@ -0,0 +1,10 @@
+\set ON_ERROR_STOP on
+BEGIN;
+SET LOCAL ROLE notebook_owner;
+SELECT pg_advisory_xact_lock(887002);
+SELECT EXISTS(SELECT 1 FROM notebook.schema_migrations WHERE version=1) AS apply \gset
+\if :apply
+  \ir 001-down.sql
+  DELETE FROM notebook.schema_migrations WHERE version=1;
+\endif
+COMMIT;
diff --git a/applications/customer-notebook/sql/migrate-up.sql b/applications/customer-notebook/sql/migrate-up.sql
new file mode 100644
index 00000000..f91291ab
--- /dev/null
+++ b/applications/customer-notebook/sql/migrate-up.sql
@@ -0,0 +1,11 @@
+\set ON_ERROR_STOP on
+BEGIN;
+SET LOCAL ROLE notebook_owner;
+SELECT pg_advisory_xact_lock(887002);
+CREATE TABLE IF NOT EXISTS notebook.schema_migrations(version integer PRIMARY KEY);
+SELECT NOT EXISTS(SELECT 1 FROM notebook.schema_migrations WHERE version=1) AS apply \gset
+\if :apply
+  \ir 001-up.sql
+  INSERT INTO notebook.schema_migrations(version) VALUES(1);
+\endif
+COMMIT;
diff --git a/applications/customer-notebook/sql/seed.sql b/applications/customer-notebook/sql/seed.sql
new file mode 100644
index 00000000..dc1e554c
--- /dev/null
+++ b/applications/customer-notebook/sql/seed.sql
@@ -0,0 +1,9 @@
+\set ON_ERROR_STOP on
+BEGIN;
+SET LOCAL ROLE notebook_owner;
+INSERT INTO notebook.customers(id,name) VALUES
+('00000000-0000-0000-0000-000000000001','Northstar Labs'),
+('00000000-0000-0000-0000-000000000002','Harbor Studio'),
+('00000000-0000-0000-0000-000000000003','Fieldcraft Tools')
+ON CONFLICT (id) DO NOTHING;
+COMMIT;
diff --git a/applications/customer-notebook/src/notebook/build.clj b/applications/customer-notebook/src/notebook/build.clj
new file mode 100644
index 00000000..18de0e69
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/build.clj
@@ -0,0 +1,9 @@
+(ns notebook.build
+  (:require [clojure.java.io :as io]))
+
+(defn -main [& _]
+  (.mkdirs (io/file "target/classes"))
+  (binding [*compile-path* "target/classes"]
+    (doseq [namespace '[notebook.inputs notebook.db notebook.views notebook.http notebook.main notebook.security]]
+      (compile namespace)))
+  (println "Application namespaces compiled without database credentials."))
diff --git a/applications/customer-notebook/src/notebook/db.clj b/applications/customer-notebook/src/notebook/db.clj
new file mode 100644
index 00000000..bcd5913e
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/db.clj
@@ -0,0 +1,82 @@
+(ns notebook.db
+  (:require [next.jdbc :as jdbc]
+            [next.jdbc.result-set :as rs])
+  (:import (com.zaxxer.hikari HikariConfig HikariDataSource)
+           (org.postgresql.ds PGSimpleDataSource)))
+
+(def options {:builder-fn rs/as-unqualified-lower-maps})
+
+(defn required [name]
+  (let [value (System/getenv name)]
+    (when (or (nil? value) (empty? value))
+      (throw (ex-info (str "Missing " name) {})))
+    value))
+
+(defn pool [user password size name]
+  ;; A real driver DataSource keeps passwords out of JDBC URLs and pool logs.
+  (let [source (doto (PGSimpleDataSource.)
+                 (.setServerNames (into-array String [(required "PGHOST")]))
+                 (.setPortNumbers (int-array [(Integer/parseInt (required "PGPORT"))]))
+                 (.setDatabaseName (required "PGDATABASE"))
+                 (.setUser user)
+                 (.setPassword password)
+                 (.setSslMode "verify-full")
+                 (.setSslRootCert (required "PGSSLROOTCERT"))
+                 (.setConnectTimeout 5)
+                 (.setSocketTimeout 15)
+                 (.setApplicationName name))
+        config (doto (HikariConfig.)
+                 (.setDataSource source)
+                 (.setPoolName name)
+                 (.setMaximumPoolSize size)
+                 (.setMinimumIdle 0)
+                 (.setConnectionTimeout 3000)
+                 (.setValidationTimeout 2000)
+                 (.setInitializationFailTimeout -1))]
+    (HikariDataSource. config)))
+
+(defn customer [source id]
+  (jdbc/execute-one! source
+    ["SELECT id,name,note,health,revision,updated_at FROM notebook.customers WHERE id=?" id]
+    options))
+
+(defn customers [source]
+  (jdbc/execute! source
+    ["SELECT id,name,health,revision FROM notebook.customers ORDER BY id LIMIT 20"] options))
+
+(defn history [source id]
+  (jdbc/execute! source
+    ["SELECT revision,note,health,edited_at FROM notebook.customer_edits
+       WHERE customer_id=? ORDER BY revision DESC LIMIT 20" id] options))
+
+(defn save! [source id {:keys [note health revision]}]
+  (jdbc/with-transaction [tx source]
+    (if-let [updated
+              (jdbc/execute-one! tx
+                ["UPDATE notebook.customers
+                    SET note=?,health=?,revision=revision+1,updated_at=clock_timestamp()
+                  WHERE id=? AND revision=? AND revision<999999999999999999
+                  RETURNING id,name,note,health,revision,updated_at"
+                 note health id revision] options)]
+      (do
+        ;; Use tx here: using source would open a different connection/transaction.
+        (jdbc/execute-one! tx
+          ["INSERT INTO notebook.customer_edits(customer_id,revision,note,health,edited_at)
+            VALUES (?,?,?,?,?)"
+           id (:revision updated) (:note updated) (:health updated) (:updated_at updated)])
+        updated)
+      (throw (ex-info "The profile changed; reload before saving again." {:status 409})))))
+
+(def activity-sql
+  "SELECT activity_day::text AS day,count(*) AS events
+     FROM notebook_fdw.activity
+    WHERE customer_id=? AND activity_day>=? AND activity_day<=?
+    GROUP BY activity_day ORDER BY activity_day LIMIT 31")
+
+(defn activity [source id {:keys [from to]}]
+  (let [rows (jdbc/execute! source
+               [activity-sql id from to] options)
+        counts (into {} (map (juxt :day :events)) rows)]
+    ;; SQL dates are projected as text to avoid process-timezone conversion.
+    (mapv (fn [day] {:day (str day) :events (get counts (str day) 0)})
+          (take-while #(not (.isAfter % to)) (iterate #(.plusDays % 1) from)))))
diff --git a/applications/customer-notebook/src/notebook/http.clj b/applications/customer-notebook/src/notebook/http.clj
new file mode 100644
index 00000000..604373a6
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/http.clj
@@ -0,0 +1,117 @@
+(ns notebook.http
+  (:require [notebook.db :as db]
+            [notebook.inputs :as input]
+            [notebook.views :as views]
+            [reitit.ring :as ring]
+            [ring.middleware.defaults :as defaults])
+  (:import (java.io ByteArrayInputStream ByteArrayOutputStream InputStream)
+           (java.nio ByteBuffer)
+           (java.nio.charset StandardCharsets CodingErrorAction)
+           (java.sql SQLException)))
+
+(defn html [status body]
+  {:status status
+   :headers {"Content-Type" "text/html; charset=utf-8"
+             "Cache-Control" "no-store"
+             "Content-Security-Policy" "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"}
+   :body body})
+
+(defn validate-form-encoding! [body]
+  ;; Ring's URL decoder can replace malformed UTF-8. Reject it before decoding.
+  (let [encoded (String. ^bytes body StandardCharsets/ISO_8859_1)
+        decoded (ByteArrayOutputStream.)]
+    (loop [index 0]
+      (when (< index (.length encoded))
+        (let [ch (.charAt encoded index)]
+          (if (= ch \%)
+            (do
+              (when (> (+ index 3) (.length encoded)) (input/invalid))
+              (let [hex (.substring encoded (inc index) (+ index 3))]
+                (when-not (re-matches #"[0-9a-fA-F]{2}" hex) (input/invalid))
+                (.write decoded (Integer/parseInt hex 16)))
+              (recur (+ index 3)))
+            (do (.write decoded (int ch)) (recur (inc index)))))))
+    (try
+      (-> (StandardCharsets/UTF_8)
+          (.newDecoder)
+          (.onMalformedInput CodingErrorAction/REPORT)
+          (.onUnmappableCharacter CodingErrorAction/REPORT)
+          (.decode (ByteBuffer/wrap (.toByteArray decoded))))
+      (catch java.nio.charset.CharacterCodingException _ (input/invalid)))))
+
+(defn wrap-body-limit [handler]
+  (fn [request]
+    (if (= :post (:request-method request))
+      (let [body (.readNBytes ^InputStream (:body request) 4097)]
+        (when (> (alength body) 4096)
+          (throw (ex-info "Body too large" {:status 413})))
+        (when-not (re-matches #"(?i)application/x-www-form-urlencoded(?:;.*)?"
+                             (get-in request [:headers "content-type"] ""))
+          (input/invalid))
+        (validate-form-encoding! body)
+        (handler (assoc request :body (ByteArrayInputStream. body))))
+      (handler request))))
+
+(defn wrap-errors [handler]
+  (fn [request]
+    (try (handler request)
+      (catch clojure.lang.ExceptionInfo error
+        (html (or (:status (ex-data error)) 500)
+              (views/error (case (:status (ex-data error))
+                             400 "Invalid fields or request encoding."
+                             413 "Form body exceeds 4 KiB."
+                             404 "Customer not found."
+                             "Request unavailable."))))
+      (catch SQLException error
+        ;; SQLState is useful evidence; SQL messages may contain private values.
+        (binding [*out* *err*] (println "Database request failed; SQLState" (.getSQLState error)))
+        (html 503 (views/error "Database request unavailable. Your note was not confirmed; reload to check its current revision."))))))
+
+(defn existing [operational id]
+  (or (db/customer operational id) (throw (ex-info "Missing customer" {:status 404}))))
+
+(defn handler [operational reporting]
+  (let [profile-response
+        (fn [id submitted conflict?]
+          (html (if conflict? 409 200)
+                (views/profile (existing operational id) (db/history operational id)
+                               submitted conflict?)))
+        routes
+        (ring/ring-handler
+          (ring/router
+            [["/" {:get (fn [_] (html 200 (views/index (db/customers operational))))}]
+             ["/health" {:get (fn [_] {:status 200 :body "ok"})}]
+             ["/customers/:id"
+              {:get (fn [request]
+                      (profile-response (input/uuid (get-in request [:path-params :id])) nil false))
+               :post (fn [request]
+                       (let [id (input/uuid (get-in request [:path-params :id]))
+                             submitted (input/edit (:form-params request))]
+                         (existing operational id)
+                         (try
+                           (db/save! operational id submitted)
+                           {:status 303 :headers {"Location" (str "/customers/" id)} :body ""}
+                           (catch clojure.lang.ExceptionInfo error
+                             (if (= 409 (:status (ex-data error)))
+                               (profile-response id submitted true)
+                               (throw error))))))}]
+             ["/customers/:id/activity"
+              {:get (fn [request]
+                      (let [id (input/uuid (get-in request [:path-params :id]))
+                            range (input/date-range (:query-params request))]
+                        (existing operational id)
+                        (try (html 200 (views/report id (db/activity reporting id range)))
+                          (catch SQLException error
+                            (binding [*out* *err*]
+                              (println "Analytical request failed; SQLState" (.getSQLState error)))
+                            (html 503 (views/error "Activity is temporarily unavailable. Operational notes can still be saved."))))))}]] )
+          (ring/create-default-handler
+            {:not-found (constantly (html 404 (views/error "Page not found.")))}))]
+    (-> routes
+        (defaults/wrap-defaults
+          (-> defaults/site-defaults
+              (assoc-in [:session :cookie-attrs :same-site] :strict)
+              (assoc-in [:security :anti-forgery]
+                {:error-response (html 403 (views/error "Session check failed. Reload the form before saving."))})))
+        wrap-body-limit
+        wrap-errors)))
diff --git a/applications/customer-notebook/src/notebook/inputs.clj b/applications/customer-notebook/src/notebook/inputs.clj
new file mode 100644
index 00000000..4ba45a44
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/inputs.clj
@@ -0,0 +1,60 @@
+(ns notebook.inputs
+  (:import (java.time LocalDate)
+           (java.time.temporal ChronoUnit)
+           (java.util UUID)))
+
+(defn invalid []
+  (throw (ex-info "Invalid input" {:status 400})))
+
+(defn safe-text? [value]
+  (and (string? value)
+       (loop [index 0]
+         (if (= index (.length ^String value))
+           true
+           (let [ch (.charAt ^String value index)]
+             (cond
+               (Character/isHighSurrogate ch)
+               (and (< (inc index) (.length ^String value))
+                    (Character/isLowSurrogate (.charAt ^String value (inc index)))
+                    (recur (+ index 2)))
+               (Character/isLowSurrogate ch) false
+               (and (Character/isISOControl ch) (not (#{\newline \return \tab} ch))) false
+               :else (recur (inc index))))))))
+
+(defn uuid [value]
+  (when-not (and (string? value)
+                 (re-matches #"(?i)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" value))
+    (invalid))
+  (UUID/fromString value))
+
+(defn revision [value]
+  ;; Bound the decimal representation before conversion, even for malicious forms.
+  (when-not (and (string? value) (<= 1 (count value) 18)
+                 (re-matches #"[0-9]+" value))
+    (invalid))
+  (Long/parseLong value))
+
+(defn edit [params]
+  (when-not (every? #{"note" "health" "revision" "__anti-forgery-token"} (keys params))
+    (invalid))
+  (let [note (get params "note")
+        health (get params "health")]
+    (when-not (and (safe-text? note) (<= (count note) 2000)
+                   (#{"healthy" "watch" "risk"} health))
+      (invalid))
+    {:note note :health health :revision (revision (get params "revision"))}))
+
+(defn date-range [params]
+  (when-not (every? #{"from" "to"} (keys params)) (invalid))
+  (let [parse-date (fn [value]
+                     (when-not (and (string? value)
+                                    (re-matches #"[0-9]{4}-[0-9]{2}-[0-9]{2}" value)) (invalid))
+                     (try (LocalDate/parse value) (catch Exception _ (invalid))))
+        from (parse-date (get params "from"))
+        to (parse-date (get params "to"))
+        length (inc (.between ChronoUnit/DAYS from to))]
+    (when-not (and (<= 1 length 31)
+                   (not (.isBefore from (LocalDate/parse "2000-01-01")))
+                   (not (.isAfter to (LocalDate/parse "2100-12-31"))))
+      (invalid))
+    {:from from :to to :length length}))
diff --git a/applications/customer-notebook/src/notebook/main.clj b/applications/customer-notebook/src/notebook/main.clj
new file mode 100644
index 00000000..32baa1d4
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/main.clj
@@ -0,0 +1,21 @@
+(ns notebook.main
+  (:gen-class)
+  (:require [notebook.db :as db]
+            [notebook.http :as http]
+            [ring.adapter.jetty :as jetty]))
+
+(defn -main [& _]
+  (let [operational (db/pool "notebook_app" (db/required "NOTEBOOK_APP_PASSWORD") 2 "notebook-operational")
+        reporting (db/pool "notebook_report" (db/required "NOTEBOOK_REPORT_PASSWORD") 1 "notebook-reporting")]
+    (try
+      (let [server (jetty/run-jetty (http/handler operational reporting)
+                     {:host "127.0.0.1" :port 8080 :join? false
+                      :min-threads 2 :max-threads 16 :max-idle-time 15000})]
+        (.addShutdownHook (Runtime/getRuntime)
+          (Thread. (fn [] (.stop server) (.close reporting) (.close operational))))
+        (println "Customer notebook listening on http://127.0.0.1:8080")
+        (.join server))
+      (catch Exception error
+        (.close reporting)
+        (.close operational)
+        (throw error)))))
diff --git a/applications/customer-notebook/src/notebook/plan.clj b/applications/customer-notebook/src/notebook/plan.clj
new file mode 100644
index 00000000..5d6cd0bb
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/plan.clj
@@ -0,0 +1,14 @@
+(ns notebook.plan
+  (:require [next.jdbc :as jdbc]
+            [notebook.db :as db])
+  (:import (java.util UUID)
+           (java.time LocalDate)))
+
+(defn -main [& _]
+  (with-open [source (db/pool "notebook_report" (db/required "NOTEBOOK_REPORT_PASSWORD") 1 "exact-report-plan")]
+    (doseq [row (jdbc/execute! source
+                 [(str "EXPLAIN(VERBOSE,COSTS OFF) " db/activity-sql)
+                  (UUID/fromString "00000000-0000-0000-0000-000000000001")
+                  (LocalDate/parse "2026-09-28") (LocalDate/parse "2026-09-30")]
+                 db/options)]
+      (println (get row (keyword "query plan"))))))
diff --git a/applications/customer-notebook/src/notebook/preflight.clj b/applications/customer-notebook/src/notebook/preflight.clj
new file mode 100644
index 00000000..92fb43a6
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/preflight.clj
@@ -0,0 +1,21 @@
+(ns notebook.preflight
+  "Load the complete stable dependency graph without database credentials."
+  (:require [hiccup2.core :as h]
+            [next.jdbc :as jdbc]
+            [reitit.ring :as ring]
+            [ring.adapter.jetty]
+            [ring.middleware.defaults])
+  (:import (com.zaxxer.hikari HikariConfig HikariDataSource)
+           (org.postgresql Driver)))
+
+(defn -main [& _]
+  (let [handler (ring/ring-handler
+                  (ring/router [["/health" {:get (fn [_] {:status 200 :body "ok"})}]]))
+        config (HikariConfig.)]
+    (assert (= 200 (:status (handler {:request-method :get :uri "/health"}))))
+    (assert (= "<p>&lt;synthetic&gt;</p>" (str (h/html [:p "<synthetic>"]))))
+    (.setMaximumPoolSize config 2)
+    (assert (= 2 (.getMaximumPoolSize config)))
+    (assert (.acceptsURL (Driver.) "jdbc:postgresql://example.invalid/notebook"))
+    (println "Stable Clojure/Ring/Reitit/Hiccup/next.jdbc/pgJDBC/Hikari graph loaded without a database.")
+    (println "Clojure" (clojure-version) "Java" (System/getProperty "java.version"))))
diff --git a/applications/customer-notebook/src/notebook/security.clj b/applications/customer-notebook/src/notebook/security.clj
new file mode 100644
index 00000000..6c552377
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/security.clj
@@ -0,0 +1,19 @@
+(ns notebook.security
+  (:require [next.jdbc :as jdbc]
+            [notebook.db :as db]))
+
+(defn -main [& _]
+  (with-open [operational (db/pool "notebook_app" (db/required "NOTEBOOK_APP_PASSWORD") 2 "security-operational")
+              reporting (db/pool "notebook_report" (db/required "NOTEBOOK_REPORT_PASSWORD") 1 "security-reporting")]
+    (doseq [[source role statement lock] [[operational "notebook_app" "5s" "2s"]
+                                        [reporting "notebook_report" "12s" "2s"]]]
+      (let [result (jdbc/execute-one! source
+                     ["SELECT current_user AS role,current_setting('statement_timeout') AS statement,
+                              current_setting('lock_timeout') AS lock,current_schemas(false)::text AS schemas,
+                              ssl,version AS tls FROM pg_stat_ssl WHERE pid=pg_backend_pid()"] db/options)]
+        (assert (= role (:role result)))
+        (assert (= statement (:statement result)))
+        (assert (= lock (:lock result)))
+        (assert (:ssl result))
+        (when (= role "notebook_app") (assert (= "{notebook,pg_catalog}" (:schemas result))))
+        (println result)))))
diff --git a/applications/customer-notebook/src/notebook/tls_probe.clj b/applications/customer-notebook/src/notebook/tls_probe.clj
new file mode 100644
index 00000000..7807f2c7
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/tls_probe.clj
@@ -0,0 +1,22 @@
+(ns notebook.tls-probe
+  (:require [clojure.string :as str]
+            [next.jdbc :as jdbc]
+            [notebook.db :as db]))
+
+(defn -main [& _]
+  (with-open [source (db/pool "notebook_app" (db/required "NOTEBOOK_APP_PASSWORD") 1 "tls-control")]
+    (try
+      (jdbc/execute-one! source ["SELECT 1"])
+      (assert (nil? (System/getenv "EXPECTED_TLS_FAILURE")))
+      (println "Same runtime factory positive verified TLS query passed.")
+      (catch java.sql.SQLException error
+        (let [causes (take-while some? (iterate #(.getCause ^Throwable %) error))
+              description (str/join " " (map #(.getMessage ^Throwable %) causes))
+              expected (System/getenv "EXPECTED_TLS_FAILURE")]
+          (assert (case expected
+                    "ca" (boolean (re-find #"(?i)PKIX|certification path|trust anchor" description))
+                    "hostname" (boolean (re-find #"(?i)hostname.*(verified|verify)|verify.*hostname" description))
+                    false))
+          ;; Only exception classes are emitted; messages can contain private DNS.
+          (println "Runtime factory TLS negative" expected "SQLState" (.getSQLState error)
+                   "causes" (mapv #(.getName (class %)) causes)))))))
diff --git a/applications/customer-notebook/src/notebook/views.clj b/applications/customer-notebook/src/notebook/views.clj
new file mode 100644
index 00000000..e842cd2d
--- /dev/null
+++ b/applications/customer-notebook/src/notebook/views.clj
@@ -0,0 +1,70 @@
+(ns notebook.views
+  (:require [hiccup2.core :as h]
+            [ring.middleware.anti-forgery :refer [*anti-forgery-token*]]))
+
+(def style
+  "body{font:17px system-ui;background:#f7f7f3;color:#18291f;max-width:780px;margin:40px auto;padding:0 20px}a{color:#245b42}textarea{width:100%;box-sizing:border-box;padding:12px;font:inherit}select,button,input{font:inherit;padding:8px;margin:5px 0}button{background:#245b42;color:white;border:0;border-radius:6px}section{background:white;padding:22px;margin:20px 0;border:1px solid #d9dfd7;border-radius:10px}.notice{background:#fff2cf;padding:14px}table{width:100%;border-collapse:collapse}td,th{text-align:left;padding:8px;border-bottom:1px solid #ddd}pre{white-space:pre-wrap;overflow-wrap:anywhere}")
+
+(defn page [title content]
+  (str "<!doctype html>"
+       (h/html [:html {:lang "en"}
+                 [:head [:meta {:charset "utf-8"}]
+                  [:meta {:name "viewport" :content "width=device-width,initial-scale=1"}]
+                  [:title title] [:style style]]
+                 [:body [:a {:href "/"} "Customer notebook"]
+                  [:p "Synthetic customers · trusted local operator workbench"] content]])))
+
+(defn index [rows]
+  (page "Customer notebook"
+    [:section [:h1 "Customer notebook"]
+     [:p "Keep a short operational note and a manual health label."]
+     [:ul (for [row rows]
+            [:li [:a {:href (str "/customers/" (:id row))} (:name row)]
+             (str " · " (:health row) " · revision " (:revision row))])]]))
+
+(defn profile [customer edits submitted conflict?]
+  (let [values (or submitted customer)
+        id (:id customer)]
+    (page (:name customer)
+      [:div
+       [:section [:h1 (:name customer)]
+        (when conflict?
+          [:div.notice {:role "alert"}
+           [:strong "This profile changed after you opened it."]
+           [:p "Your submitted values and original revision are retained below. Reload the profile, review its current values, then decide what to save."]
+           [:p (str "Current revision " (:revision customer) ", health " (:health customer))]
+           [:pre (:note customer)]
+           [:a {:href (str "/customers/" id)} "Reload current profile"]])
+        [:form {:method "post" :action (str "/customers/" id)}
+         [:input {:type "hidden" :name "__anti-forgery-token" :value *anti-forgery-token*}]
+         [:input {:type "hidden" :name "revision" :value (str (:revision values))}]
+         [:label {:for "note"} "Note (maximum 2,000 characters)"]
+         [:textarea {:id "note" :name "note" :rows 6 :maxlength 2000} (:note values)]
+         [:label {:for "health"} "Manual health"]
+         [:select {:id "health" :name "health"}
+          (for [value ["healthy" "watch" "risk"]]
+            [:option {:value value :selected (= value (:health values))} value])]
+         [:p (str "Editing revision " (:revision values))]
+         [:button {:type "submit"} "Save note"]]]
+       [:section [:h2 "Activity"]
+        [:p "View sample daily activity. If reports are unavailable, you can still save notes."]
+        [:form {:method "get" :action (str "/customers/" id "/activity")}
+         [:label "From " [:input {:type "date" :name "from" :value "2026-09-28" :min "2000-01-01" :max "2100-12-31" :required true}]]
+         [:label " To " [:input {:type "date" :name "to" :value "2026-09-30" :min "2000-01-01" :max "2100-12-31" :required true}]]
+         [:button "View activity (up to 31 days)"]]]
+       [:section [:h2 "Recent edits (20 maximum)"]
+        (if (empty? edits) [:p "No edits yet."]
+          [:ol (for [edit edits]
+                 [:li [:p (str "Revision " (:revision edit) " · " (:health edit) " · " (:edited_at edit))]
+                  [:pre (:note edit)]])])]])))
+
+(defn report [id rows]
+  (page "Customer activity"
+    [:section [:h1 "Synthetic daily activity"]
+     [:a {:href (str "/customers/" id)} "Return to profile"]
+     [:table [:thead [:tr [:th "UTC day"] [:th "Events"]]]
+      [:tbody (for [row rows]
+                [:tr [:td (:day row)] [:td (str (:events row))]])]]]))
+
+(defn error [message]
+  (page "Request unavailable" [:section [:h1 "Request unavailable"] [:p message]]))
diff --git a/applications/customer-notebook/test/notebook/inputs_test.clj b/applications/customer-notebook/test/notebook/inputs_test.clj
new file mode 100644
index 00000000..5fa67df3
--- /dev/null
+++ b/applications/customer-notebook/test/notebook/inputs_test.clj
@@ -0,0 +1,45 @@
+(ns notebook.inputs-test
+  (:require [clojure.test :refer [deftest is testing]]
+            [notebook.inputs :as input]
+            [notebook.http :as http]
+            [notebook.views :as views])
+  (:import (java.nio.charset StandardCharsets)))
+
+(deftest bounded-edit-input
+  (is (= {:note " Useful note " :health "watch" :revision 7}
+         (input/edit {"note" " Useful note " "health" "watch" "revision" "7"})))
+  (doseq [value ["" "-1" (apply str (repeat 10000 "9")) "18446744073709551615"]]
+    (is (thrown? clojure.lang.ExceptionInfo (input/revision value))))
+  (doseq [note [(str "\u0000" " x ") (str (char 0xD800)) (str (char 0xDC00))
+                (apply str (repeat 2001 "a"))]]
+    (is (thrown? clojure.lang.ExceptionInfo
+                 (input/edit {"note" note "health" "healthy" "revision" "0"}))))
+  (is (input/safe-text? "Line one\n\tLine two 😀"))
+  (is (thrown? clojure.lang.ExceptionInfo
+               (input/edit {"note" "ok" "health" "healthy" "revision" "0" "owner" "forged"}))))
+
+(deftest strict-wire-encoding
+  (doseq [body ["note=%ED%A0%80" "note=%ED%B0%80" "note=%FF" "note=%0" "note=%ZZ"]]
+    (is (thrown? clojure.lang.ExceptionInfo
+                 (http/validate-form-encoding! (.getBytes body StandardCharsets/UTF_8)))))
+  (is (some? (http/validate-form-encoding! (.getBytes "note=%F0%9F%98%80" StandardCharsets/UTF_8)))))
+
+(deftest bounded-utc-range
+  (is (= 31 (:length (input/date-range {"from" "2026-09-01" "to" "2026-10-01"}))))
+  (doseq [date ["2000-01-01" "2100-12-31"]]
+    (is (= 1 (:length (input/date-range {"from" date "to" date})))))
+  (doseq [params [{"from" "2026-09-01" "to" "2026-10-02"}
+                  {"from" "2026-09-30" "to" "2026-09-29"}
+                  {"from" "2026-02-30" "to" "2026-03-01"}
+                  {"from" "1999-12-31" "to" "2000-01-01"}
+                  {"from" "2100-12-31" "to" "2101-01-01"}]]
+    (is (thrown? clojure.lang.ExceptionInfo (input/date-range params)))))
+
+(deftest retained-stale-form-is-escaped
+  (let [html (views/profile {:id (input/uuid "00000000-0000-0000-0000-000000000001")
+                            :name "Synthetic" :note "Current" :health "healthy" :revision 8}
+                           [] {:note "<script>alert(1)</script>" :health "risk" :revision 7} true)]
+    (is (.contains html "&lt;script&gt;alert(1)&lt;/script&gt;"))
+    (is (.contains html "value=\"7\""))
+    (is (.contains html "Current revision 8"))
+    (is (not (.contains html "<script>")))))
diff --git a/applications/customer-notebook/test/notebook/test_runner.clj b/applications/customer-notebook/test/notebook/test_runner.clj
new file mode 100644
index 00000000..85e5fcfa
--- /dev/null
+++ b/applications/customer-notebook/test/notebook/test_runner.clj
@@ -0,0 +1,8 @@
+(ns notebook.test-runner
+  (:require [clojure.test :as test]
+            [notebook.inputs-test]))
+
+(defn -main [& _]
+  (let [results (test/run-tests 'notebook.inputs-test)]
+    (shutdown-agents)
+    (when (pos? (+ (:fail results) (:error results))) (System/exit 1))))

From faf4715b28ec8d685d461a048e4c117ac7337a1a Mon Sep 17 00:00:00 2001
From: sdairs <sdairs@users.noreply.github.com>
Date: Fri, 2 Oct 2026 21:31:28 +0100
Subject: [PATCH 2/2] docs: remove public beta qualifier

---
 applications/customer-notebook/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/customer-notebook/README.md b/applications/customer-notebook/README.md
index e42f9a66..4ae476e4 100644
--- a/applications/customer-notebook/README.md
+++ b/applications/customer-notebook/README.md
@@ -1,6 +1,6 @@
 # Customer notebook
 
-A small Clojure workbench using ClickHouse Managed Postgres (public beta) for operational notes and ClickHouse for synthetic daily activity. Ring/Reitit serve forms, Hiccup escapes their contents, and next.jdbc uses pgJDBC/HikariCP for both query paths. Reports run through pg_clickhouse, with a separate connection pool and role.
+A small Clojure workbench using ClickHouse Managed Postgres for operational notes and ClickHouse for synthetic daily activity. Ring/Reitit serve forms, Hiccup escapes their contents, and next.jdbc uses pgJDBC/HikariCP for both query paths. Reports run through pg_clickhouse, with a separate connection pool and role.
 
 This is a trusted local operator tool bound to 127.0.0.1, with seeded customers and native Ring CSRF protection. It has no signup, operator authentication, public deployment or tenant isolation. The runtime role can edit every seeded customer. Keep it on a trusted machine; sharing database credentials bypasses the form workflow.