fix(ci): stabilize nightly verification lanes

.github/workflows/load-soak-nightly.yml

@@ -156,7 +156,18 @@ jobs:
           Security__DisableHttpsRedirection: "true"
           Security__ConnectionEncryption__MasterKey: "test-master-key-32-chars-long-000000"
           ConnectionStrings__redis: "localhost:6379"
-          ConnectionStrings__DefaultConnection: Host=localhost;Port=5432;Database=${{ env.DB_NAME }};Username=${{ env.DB_USER }};Password=${{ env.DB_PASSWORD }};Maximum Pool Size=50
+          # PostgresDataSourceFactory applies Limits:Connections to the data source after
+          # parsing the connection string. Keep both settings aligned: setting only
+          # Maximum Pool Size here is otherwise overridden by the production default
+          # (200), which exceeds the GitHub service container's PostgreSQL client
+          # budget and produces "too many clients already" under the nightly load.
+          # Reserve ample capacity for the health check, migrations, and maintenance
+          # connections while keeping the application below the container limit.
+          Limits__Connections__MaxConcurrentQueries: "40"
+          Limits__Connections__MaxConnectionPoolSize: "40"
+          Limits__Connections__MinConnectionPoolSize: "0"
+          Limits__Connections__ConnectionAcquisitionTimeoutSeconds: "15"
+          ConnectionStrings__DefaultConnection: Host=localhost;Port=5432;Database=${{ env.DB_NAME }};Username=${{ env.DB_USER }};Password=${{ env.DB_PASSWORD }};Maximum Pool Size=40
         run: |
           dotnet run --project src/Honua.Server -c Release --no-build --no-launch-profile > server.log 2>&1 &
           echo $! > server.pid

docs/gis/CROSS_CLIENT_CERTIFICATION_EVIDENCE.md

@@ -232,7 +232,7 @@ This section describes how each evidence source will map to the evidence envelop
 | Playwright MapLibre suite | JS (MVT) | Automated: `tests/js-browser/maplibre/` renders MapLibre GL JS against live TileJSON/MVT endpoints and emits a `<run-id>-js-mvt.cert.json` envelope via the custom reporter. See [MapLibre MVT automated workflow](#maplibre-mvt-automated-workflow) below. A manual fallback remains documented for ad-hoc visual verification. |
 | Playwright CesiumJS suite | JS — Cesium (`js-cesium`) | Automated: `tests/js-browser/cesium/` exercises CesiumJS imagery providers (WMS, WMTS, OGC API Tiles, OGC API Maps) under `docker/client-compat/cesium/` in `client-interop-nightly.yml`; emits one envelope per protocol (`<run-id>-js-cesium-{wms,wmts,ogc-tiles,ogc-maps}.cert.json`). Vector-feature CERT-\* IDs and the visual / style slice IDs are recorded as `not-applicable` because Cesium imagery providers consume server-rendered raster output. |
 | ArcGIS Pro REST stub | `arcgis-stub` | Automated stub: `docker/client-compat/arcgis-stub/stub_runner.py` issues both the FeatureServer and MapServer REST sequences Pro itself emits and writes one envelope per protocol (`*-arcgis-stub-featureserver.cert.json` and `*-arcgis-stub-mapserver.cert.json`). The FeatureServer-applicable render IDs `CERT-RNDR-01`, `CERT-RNDR-02`, and the visual / style slice IDs `CERT-RNDR-{SYM,LIN,FIL,LBL,URL}-01` are recorded as `skip` with note `pending: licensed-arcgis-runner` until a licensed Windows runner is provisioned. `CERT-RNDR-SPR-01` is MVT-only per the matrix and is emitted as `not-applicable` for this lane. |
-| Licensed ArcGIS Pro desktop runner | `desktop-arcgis` | Manual/scheduled: `.github/workflows/arcgis-pro-desktop-evidence.yml` runs only on an explicitly enabled self-hosted Windows ArcGIS Pro runner and invokes `scripts/client-compat/arcgis-pro/run-arcgis-pro-evidence.py`. The runner emits `*-desktop-arcgis-featureserver.cert.json` and `*-desktop-arcgis-mapserver.cert.json`, captures logs/screenshots/project artifacts, exports render evidence through an active view or headless layout/map-frame fallback, writes an `artifact-manifest.json`, and keeps this evidence distinct from the REST-only `arcgis-stub` lane. Ordinary PR gates validate only the fixture/envelope contract; they do not require ArcGIS Pro. See [Licensed ArcGIS Pro Desktop Evidence](../internal/evidence/ARCGIS_PRO_LICENSED_EVIDENCE.md). |
+| Licensed ArcGIS Pro desktop runner | `desktop-arcgis` | Maintained externally in [`honua-esri-compat`](https://github.com/honua-io/honua-esri-compat), where the licensed Windows runner can execute without coupling this repository's nightly schedule to unavailable self-hosted capacity. The retained local runner contract, `scripts/client-compat/arcgis-pro/run-arcgis-pro-evidence.py`, emits `*-desktop-arcgis-featureserver.cert.json` and `*-desktop-arcgis-mapserver.cert.json`, captures logs/screenshots/project artifacts, exports render evidence through an active view or headless layout/map-frame fallback, writes an `artifact-manifest.json`, and keeps this evidence distinct from the REST-only `arcgis-stub` lane. Ordinary PR gates validate only the fixture/envelope contract; they do not require ArcGIS Pro. See [Licensed ArcGIS Pro Desktop Evidence](../internal/evidence/ARCGIS_PRO_LICENSED_EVIDENCE.md). |
 | GDAL/OGR pytest suite | CLI (`cli` via converter) | Automated: `tests/python/gdal_ogr/conftest.py:EvidenceCollector` writes `gdal-ogr-results.json`; the `gdal` lane runner invokes `scripts/client-compat/convert-gdal-results.py` to emit one cert envelope per protocol (`<run-id>-cli-gdal-ogc-features.cert.json`, `<run-id>-cli-gdal-wfs.cert.json`). The converter maps the GDAL category labels many-to-one onto CERT-* IDs with worst-status aggregation (`fail > pass > skip > not-applicable`): `discovery`/`feature_count` → CERT-DISC-01, `schema_introspection` → CERT-SCHM-01, `feature_read`/`read` → CERT-CONN-01, `attribute_query`/`spatial_query`/`query` → CERT-QFLT-01. The `export_*` categories are intentionally unmapped per the matrix CLI/SDK lane row (which excludes CERT-RNDR), so CERT-RNDR-01 and CERT-RNDR-02 are recorded as `not-applicable` rather than certified by an ogr2ogr export. Unknown labels surface as `::warning::` so test-side additions stay visible. |
 
 ### Manual Lane Workflow

docs/internal/ci/workflow-inventory.md

@@ -30,7 +30,6 @@
 | `warehouse-nightly.yml` | Warehouse Providers Nightly (Creds-Gated) | weekly | `schedule`, `workflow_dispatch` | No | Weekly Sunday 6:00 UTC (#2943); matrix over Honua.Snowflake/Redshift/Databricks/SqlServer.Tests, consuming optional repository secrets; surfaces passed/failed/skipped counts in the run summary so a missing secret reads as "not configured" rather than "silently absent from CI" |
 | `cross-server-consume-nightly.yml` | Cross-Server Consume Nightly | nightly | `schedule`, `workflow_dispatch` | No | Daily 7:00am UTC; runs Honua-as-client WMS/WFS/WMTS reads against reference GeoServer and MapServer containers via the Test-environment `/__test/cross-server-consume/proxy` endpoint, uploads TRX/report artifacts, and best-effort commits the refreshed gap report (warns instead of failing if push is blocked) |
 | `windows-client-compat-nightly.yml` | Windows Client Compatibility Certification | nightly | `schedule`, `workflow_dispatch` | No | Daily 7:15am UTC; full CERT-\* matrix (18 test cases × 4 protocol lanes: FeatureServer, OGC Features, MapServer, OData) with per-protocol `.cert.json` envelopes under `certification/`, plus `overall-summary.json`, per-lane transcripts, and `pack/`; supports `--profile smoke` (11-check MVP) and `--profile full` (default) |
-| `arcgis-pro-desktop-evidence.yml` | Licensed ArcGIS Pro Desktop Evidence | nightly/manual | `schedule`, `workflow_dispatch` | No | Weekly scaffold for `desktop-arcgis` licensed evidence. The self-hosted Windows ArcGIS Pro job runs only when manually dispatched with `run_licensed_lane=true` or when `ARCGIS_PRO_EVIDENCE_ENABLED=true`; no PR trigger. Invokes the ArcPy runner against a seeded Honua FeatureServer/MapServer target, emits `desktop-arcgis` `.cert.json` envelopes, captures active-view or layout/map-frame screenshots, validates live evidence refs and redaction, writes an artifact manifest, and uploads nightly-retention evidence. |
 | `pyqgis-client-compat-nightly.yml` | PyQGIS Client Compatibility Certification | nightly | `schedule`, `workflow_dispatch` | No | Daily 7:30am UTC; PyQGIS desktop client compatibility using real QGIS providers against `client-compat-v1.sql`; produces `desktop-qgis-ogc-features.cert.json` and `desktop-qgis-wfs.cert.json` envelopes |
 | `sdk-server-compatibility.yml` | SDK Server Compatibility | nightly | `schedule`, `workflow_dispatch` | No | Manifest-driven last-3 server refs x last-3 SDK sets matrix from `docs/developer/sdk-compatibility-versions.json`; manual dispatch can pin `server_current_ref` for release-candidate evidence; checks out `honua-sdk-js`, `honua-sdk-python`, and `honua-sdk-dotnet`, copies them to `$RUNNER_TEMP/sdk-compat`, and runs live compatibility smoke checks from the isolated copies so server repo build policy does not affect SDK source builds; records package versions/server commit/seed profile/surfaces/migration automation status/diagnostics in per-cell JSON evidence, and publishes `sdk-compatibility-matrix-<run-id>` with supported-cell regression failure |
 | `client-interop-nightly.yml` | Real-Client Interop Matrix (Nightly) | nightly | `schedule`, `workflow_dispatch` | No | Daily 7:00am UTC; runs the docker/client-compat matrix (`gdal`, `pyqgis`, `openlayers`, `cesium`, `arcgis-stub`) via Docker harnesses, diffs the per-lane `.cert.json` envelopes against `tests/baselines/client-compat/` (gated by `expected-pairs.json`), refreshes `docs/gis/gap-report.md`, and fails strict mode on any baseline `pass`→non-`pass` regression, missing current envelope, missing expected-pair, missing committed baseline, or new `fail` in an unbaselined case. Lane artifacts include `lane-exit-code.txt` and `compose.log` when a lane exits non-zero; workflow-dispatch subsets are scoped by `--client-lanes`. Promote to PR-blocking once 30 consecutive nightly passes are observed (#806) |