feat: add pinned inventory location enrichment

docs/verification.md

@@ -1,6 +1,6 @@
 # Verification record
 
-This record retains historical verification facts from earlier checkpoints. The current T07 checkpoint is a local/disposable prototype only: it makes no new deployed, live-ESI, or production-readiness claim. Dependency versions are pinned in `package.json`/`bun.lock`.
+This record retains historical verification facts from earlier checkpoints. The current T08 checkpoint is a local/disposable prototype only: it makes no deployed, live-ESI, live-Convex-capacity, or production-readiness claim. Dependency versions are pinned in `package.json`/`bun.lock`. T09 query/projection and T13 wallet work are not completion claims in this checkpoint.
 
 ## Initial offline/disposable-backend milestone
 
@@ -40,14 +40,14 @@ A subsequent operator test exposed `ERR_INVALID_RESPONSE` when submitting Connec
 
 Historical audit regressions covered native-form/CSRF boundaries, shared artifact-directory precedence, live readers rejecting fixture profiles, offline no-network behavior, archive receipts/replay, ZIP/TAR checksums and limits, duplicate records/JSON keys, Hoboleaks metadata, and immutable cache provenance/rollback/reuse. See [live setup](live-setup.md) and [reference operations](reference-operations.md).
 
-## T07 durable worker boundary regressions
+## Historical T07 durable worker boundary regressions
 
 - Full local `bun test`: **204 passed, 0 failed** across 27 files.
 - `bun test tests/t07-sync.test.ts tests/t07-worker-runtime.test.ts tests/t07-route-boundaries.test.ts`: deterministic queue/fencing/retry regressions plus runtime alias/startup, missing-job/AbortSignal polling, HTTP 429/503 structured outcomes, forbidden worker-environment, hostile-origin, session-ordering and bounded-body checks (31 passed in the focused run).
 - `bun build workers/sync.ts --target bun`: produces the same alias-resolved worker artifact copied by the Docker build to `build/sync-worker.js`. A no-cache Docker image build completed, and `docker run --rm --network none` started the image's bundled worker through `scripts/run-sync-worker.ts` with inert Convex/EVE values and `SYNC_WORKER_STARTUP_CHECK=1`; no live keys or network calls were used. `scripts/run-sync-worker.ts` is separately tested to reject general bridge/admin/JWT/JEV credentials without echoing them.
 - The operational startup is `bun run secrets:run --worker -- docker compose --profile worker up -d --build sync-worker`; `--deployment`/`--configure` is reserved for Convex administration and configuration, not worker startup. Plain `docker compose up` leaves the worker stopped.
 
-### T07 prototype stage manifest
+### Historical T07 prototype stage manifest (not the current T08 manifest)
 
 The T07 stage includes the following files. T08 core files are intentionally excluded:
 
@@ -92,6 +92,58 @@ workers/sync.ts
 
 Excluded T08 core files: `src/lib/domain/inventory-location.ts`, `src/lib/server/inventory/`, `tests/fixtures/inventory/`, `tests/inventory-containment.test.ts`, and `tests/inventory-location.test.ts`.
 
+## T08 local checkpoint
+
+**Status:** implemented locally and undeployed. No live credentials, deployed endpoint, production volume, or production reference artifact was used.
+
+- `bun test`: **254 passed, 0 failed** across 29 files. This is the combined local suite and includes parallel-core T09/T13 tests; it is not a T08-only count.
+- Focused T08/T07 regression run: `bun test tests/t07-sync.test.ts tests/inventory-location.test.ts tests/t07-worker-runtime.test.ts` — 54 passed, 0 failed.
+- `bunx tsc --noEmit`, `bun run check`, and `git diff --check` passed.
+- `bun run build` passed with the known non-fatal unresolved `bun:sqlite` external warning.
+- The 50k containment/enrichment checks and 2,500-row persistence check are synthetic local prototype validations, not measured live Convex capacity. Optional enrichment is conservatively capped before staging; larger/oversized payloads preserve raw assets and publish failed optional enrichment.
+- Real-query generation rollover, mixed helper batches, public/private fact forgery, forbidden structures, missing-parent/reference-unknown rows, and oversized worker envelopes have regression coverage.
+
+### Exact T08 checkpoint manifest
+
+The following files comprise the T08 implementation/checkpoint, including additive shared integration files:
+
+```text
+compose.yaml
+docs/architecture.md
+docs/design-records/t08-inventory-location.md
+docs/esi-operations.md
+docs/parallel-worktrees.md
+docs/roadmap.md
+docs/verification.md
+scripts/run-sync-worker.ts
+src/convex/functions.ts
+src/convex/schema.ts
+src/lib/domain/capabilities.ts
+src/lib/domain/inventory-location.ts
+src/lib/domain/model.ts
+src/lib/server/esi/index.ts
+src/lib/server/inventory/containment.ts
+src/lib/server/inventory/location-service.ts
+src/lib/server/inventory/private-structure-cache.ts
+src/lib/server/release-gate.ts
+src/lib/server/store.ts
+src/routes/auth/eve/+server.ts
+src/routes/characters/+page.server.ts
+src/routes/characters/+page.svelte
+tests/contracts.test.ts
+tests/esi.test.ts
+tests/fixtures/esi/transport-metadata.json
+tests/fixtures/inventory/cycles-and-missing.json
+tests/fixtures/inventory/nested-assets.json
+tests/inventory-containment.test.ts
+tests/inventory-location.test.ts
+tests/t07-sync.test.ts
+tests/t07-worker-runtime.test.ts
+workers/sync.ts
+```
+
+Explicitly excluded from this T08 manifest: accepted T09 core projection/query files `src/lib/server/inventory/projection.ts`, `src/lib/server/inventory/query-repository.ts`, `src/lib/server/inventory/query-service.ts`, `tests/inventory-query.test.ts`, and `tests/fixtures/inventory/query-assets.json`; all T13 wallet files/tests/fixtures under `src/lib/server/wallet/`, `tests/wallet-balance.test.ts`, `tests/fixtures/wallet/`, and `tests/fixtures/esi/wallet-balance-signed.json`.
+
 ## Optional disposable Convex smoke (not part of this checkpoint)
 
 Use a **disposable** backend, set its `CONVEX_SELF_HOSTED_URL` and admin key, generate application keys and configure/deploy as in the README, then run: