[amar-python]

Follow-up to #172. Stacked on #211: this PR's base is that branch, not main. It needs #211's launcher-driven deployer and runtime launcher generation, so it cannot sit on main alone. Merge #211 first; GitHub then retargets this PR to main, and its diff is just the commit shown here.

What

infra/terraform-test and infra/terraform-staging already create te_test and te_staging for server admin pgadmin, but the deployer built te_mgmt_test and te_mgmt_staging owned by postgres: the same three-way disagreement #172 fixed for prod. Those stacks are code only (#31), so nothing is deployed and nothing is broken. This lands before #31 resumes, as recommended.

The names are now te_<env>, owned by pgadmin, for prod, test and staging. Dev stays te_mgmt_dev owned by postgres: it is local-only and has no stack.

	before	after
test	te_mgmt_test / postgres	te_test / pgadmin
staging	te_mgmt_staging / postgres	te_staging / pgadmin
prod (#211)	te_prod / pgadmin	same
dev	te_mgmt_dev / postgres	same

• Launchers: env_test.example.sql and env_staging.example.sql change db_name and db_owner. deploy_all.sh already reads both from the launcher, so no code change was needed there.
• Terraform: both stacks get the APP_USER_PASSWORD Key Vault secret and job wiring that RV-S1: align Terraform, deployer and entrypoint on the prod database (#172) #211 added for prod. Without it the entrypoint refuses to deploy, so a first run in either stack would fail.
• CI: the database-creation step now makes te_test, te_staging and te_prod owned by pgadmin, and dev owned by postgres.
• Consumers of the old names: evals Tier E, test_parity, the per-environment tests, run_tests.sh, config examples, the provisioning script, README and docs.
• Tests: tests/test_prod_db_naming.py is renamed tests/test_azure_db_naming.py and its static checks now run for all three Azure environments, so one test guards every stack. It also pins dev as unchanged and checks each job is given the app-role password.
• The decision record is extended rather than a new one written.

Verification

The new checks bite. With only the test/staging launchers and Terraform reverted to #211's versions, the test and staging subtests of test_each_launcher_names_the_canonical_database_and_owner, test_terraform_admin_is_the_launchers_owner and test_terraform_creates_the_same_database fail; prod's subtests still pass. With this change all 15 pass.

Clean image, fresh server (same method as #211: tree from git archive of the commit, /opt/migration layout, run as uid 1001, brand-new PostgreSQL 16 whose only role is pgadmin, scram-sha-256, database pre-created by pgadmin as Terraform does):

test:     Environment TEST deployed successfully    exit 0   owner pgadmin   12 tables in te_test
staging:  Environment STAGING deployed successfully exit 0   owner pgadmin   12 tables in te_staging
roles on the server: pgadmin,te_stg_user,te_test_user        (no 'postgres' role exists)
launchers left in image: []
staging, database absent:      Creating database: te_staging (owner: pgadmin) -> deployed
staging, PGDATABASE wrong:     ERROR: PGDATABASE is 'te_mgmt_staging' but env_staging.sql deploys to 'te_staging'.

terraform validate passes on all three stacks (terraform-prod, -test, -staging; Terraform 1.9.8). terraform plan was not run: it needs Azure credentials.

CI replica, on a live PostgreSQL 16 with the databases created by the workflow's own step:

evals tiers p,i,s,e              total 26 / passed 26 / failed 0 / skipped 0
deploy all four environments     all deployed, no ownership warning
owners                           te_mgmt_dev -> postgres; te_prod, te_staging, te_test -> pgadmin
full suite (--strict)            PASSED 380 / FAILED 0 / ERROR 0 / SKIPPED 0 / NOT RUN 0
make lint                        flake8 clean, bandit clean
make health                      88 passed, 0 failed

Please read

• Not verified: terraform plan/apply and any real Azure deploy; a real docker build/run.
• Anyone with local te_mgmt_test or te_mgmt_staging databases will get new empty te_test/te_staging ones on the next deploy and keep the old ones. Local build/config.local.env is gitignored and is not updated: change PG_DB_TEST and PG_DB_STAGING to the new names, or re-run build/setup.sh. Nothing is dropped automatically.
• docs/HANDOFF-20261104.md still lists the old names. It is a dated hand-off record, so I left it as written.

---

Generated by Claude Code

[amar-python]

Closing: this was stacked on #211, which is closed in favour of #213. The branch fix/test-staging-db-naming is kept.

Renaming test and staging to te_test/te_staging is not needed under #213's design: its entrypoint takes the database name from the job's PGDATABASE, which Terraform already sets from each stack's database resource, so the Azure test and staging stacks agree with the deployer by construction.

What is still worth doing, on top of #213 once it merges: infra/terraform-test and infra/terraform-staging have not been given the APP_DB_PASSWORD secret and job wiring, nor the azure.extensions allow-list, that #213 adds to terraform-prod. Without them a first deployment of either stack fails at the entrypoint. This PR's Terraform commit shows the wiring for the password (with the older variable name APP_USER_PASSWORD).

Closed by Claude at the owner's request.

---

Generated by Claude Code