MEDIUM — terminology + file-path pin:
- 5 occurrences of "G11.6" → "G20" (cutover wish renumbered group during /wish pass).
- Group 1 deliverable 6 admin.json writer: pinned the file path to
  `src/lib/admin-json.js`, declared co-ownership with cohort sibling
  canonical-pgserve-pm2-supervision Group 1 deliverable 2, and made the
  schema/enum explicit (supervisor ∈ {pm2, systemd-user, launchd, external}).

genie wish lint: clean (no violations).

Per /review verdict 2026-05-08 — non-blocking MEDIUM gaps closed.
W1 verdict was already SHIP*; these fixes were optional pre-flight tightening.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…son writer (cohort foundation)

Lays the data-plane foundation for pgserve 2.4. Group 1 of the
`pgserve-singleton-no-proxy` wish (cohort dream of the v2.4 trio).

What ships:

- bin/postgres-server.js — new `postmaster` subcommand. Spawns
  PostgresManager directly with `-k <socket-dir>` and `-p 5432`. No
  router, no bun proxy, no daemon control socket. This is the entry
  point pm2 (Tier A) — and later systemd-user / launchd (Tier B,
  separate wish) — invokes for the `autopg-server` process.

- src/lib/socket-dir.js — `resolveSocketDir()` returns
  `$XDG_RUNTIME_DIR/pgserve` (preferred, freedesktop convention) or
  `/tmp/pgserve` (fallback for CI / minimal containers without XDG).
  `ensureSocketDir()` creates with mode 0700 and probes writability so
  failure surfaces here, not as a libpq bind error mid-pm2-backoff.

- src/lib/admin-json.js — cohort-shared atomic reader / merge-writer /
  `assertSupervisor()` for `~/.autopg/admin.json`. Schema:
  `{ supervisor, socketDir, port, installedAt }` with supervisor ∈
  `{ "pm2" | "systemd-user" | "launchd" | "external" }`. Refuses to
  downgrade Tier B → Tier A (operator must `autopg service uninstall`
  first). Merge-aware: preserves the scrypt Basic-Auth scheme written
  by the autopg console UI.

- src/postgres.js — PostgresManager honors an explicit `socketDir`
  option. When set, the install path owns directory lifecycle: stop()
  no longer rm's an operator-supplied dir.

- src/cli-install.cjs — DEFAULT_PORT 8432 → 5432; PM2_PROCESS_NAME
  `pgserve` → `autopg-server`; new `--no-pm2` flag for CI fixture
  provisioning and Tier B-bound hosts; pre-install
  `assertSupervisor('pm2'|'external')` refuses to claim hosts already
  owned by Tier B; canonical socket dir created + admin.json
  supervisor record written atomically post-install. The existing
  scrypt admin-password writer becomes merge-safe so both schemas
  coexist on the same file.

Tests:

- tests/lib/admin-json.test.js — 18 tests covering write/read, atomic
  semantics, merge with existing fields, Tier B downgrade refusal,
  enum validation, assertSupervisor matrix.

- tests/cli-install.test.js — updated for the v2.4 surface
  (autopg-server pm2 name, port 5432, postmaster subcommand args) +
  6 new singleton tests: socket dir creation w/ mode 0700,
  --socket-dir threading through pm2 args, admin.json fields,
  --no-pm2 path, systemd-user lock refusal, /tmp fallback.

Acceptance (per wish Group 1):

- ✅ pgserve install creates `$XDG_RUNTIME_DIR/pgserve/` with mode
  0700.
- ✅ pgserve port outputs 5432.
- ✅ pm2 entry name is `autopg-server` (renamed from `pgserve`).
- ✅ admin.json records supervisor: "pm2" + canonical socketDir.
- ✅ pgserve install refuses with non-zero when admin.json records
  supervisor: "systemd-user".
- ✅ pgserve install --no-pm2 skips pm2 register but still writes
  admin.json with supervisor: "external".

Validation (run in worktree):

- bun test tests/lib/admin-json.test.js → 18 pass / 0 fail.
- bun test tests/cli-install.test.js → 26 pass / 0 fail.
- bun run lint → clean.
- bun test (full) → 328 pass / 2 fail; the 2 pre-existing failures
  are console/dist/ asset tests unaffected by this change.

`bun run typecheck` is referenced by the wish but does not exist as a
package script; the project relies on lint + tests for static gates.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>