@@ -0,0 +1,16 @@
+---
+"everything-dev": minor
+---
+
+Regression harness runs on wiped file-backed pglite dirs — seed-phase integration
+
+`.env.test`'s in-memory pglite marker now substitutes per-workspace pglite dirs
+under `.bos/regression/db` (absolute paths; start-stack wipes the root per run),
+because an in-memory database cannot be seeded — nothing exists before its
+service process creates it, so the pre-spawn seed phase (#866) had nothing to
+address. A wiped dir keeps in-memory's isolation while opening the pre-spawn
+window: **apps that declare a `seed` block get it applied on every regression
+boot automatically**, which is also the migration path off direct-DB seed
+helpers and the postgres service containers they force. Explicit database URLs
+(postgres or custom pglite dirs) still pass through untouched, and dev-root
+URLs stay refused.
@@ -266,7 +266,10 @@ zero-config, but drizzle-kit commands (`db:studio`/`db:migrate`/`db:push`) requi
 divergence sets `TEST_DATABASE=postgres` + the external URL — no committed compose exists.
 
 **Dev/test isolation:** a committed `.env.test` (generated by `bos dev`) maps every
-`*_DATABASE_URL` to in-memory pglite and `BETTER_AUTH_SECRET` to the test secret. Test
+`*_DATABASE_URL` to in-memory pglite and `BETTER_AUTH_SECRET` to the test secret; the
+regression harness substitutes in-memory markers for wiped per-workspace pglite dirs
+under `.bos/regression/db` (start-stack wipes them per run) so a declared `seed` block
+runs pre-spawn on every regression boot. Test
 suites load `.env.test` instead of `.env`: the regression stack
 (`tests/regression/lib/start-stack.mjs`) injects it into spawned stacks,
 `tests/regression/lib/regression-env.mjs` resolves it with fail-fast guards that refuse
 
@@ -106,8 +106,10 @@ boundary above; until it lands, this document is the contract.
   cached session; mint a new state only when the fixtures don't cover it, and
   route the seeding through the shared HTTP helpers
   (`tests/regression/lib/http-seed.mjs` and the bootstrap-admin API key is
-  the supported path — the stack database is in-process pglite, so direct DB
-  writes are impossible).
+  the supported path — the stack database is a pglite data dir held open by
+  its service (ADR 0044's file lock), so direct DB writes are impossible
+  post-spawn. App fixtures belong in declared `seed` steps instead, which
+  the phase runs pre-spawn — see `docs/seed-phase.md).
 - **Serial by design**: `workers: 1`, `fullyParallel: false`, `retries: 1` —
   specs share ports and the seeded cookie cache. Don't write a spec that
   assumes a clean global state another spec might have breathed on; seed
 
@@ -104,6 +104,21 @@ admin user instead of minting a second user. Multi-segment accounts (whose
 sign-in email is unpredictable) are linked by the `near_account` row, not the
 email.
 
+## Regression: the phase runs on every boot
+
+The regression harness substitutes `.env.test`'s in-memory pglite markers for
+wiped per-workspace pglite dirs (`.bos/regression/db/<slug>`, absolute paths —
+services resolve relative pglite paths against their own workspace cwd), and
+start-stack wipes the root before the stack spawns. A fresh dir holds no
+marker, so **a declared `seed` block runs in full on every regression boot** —
+the phase's pre-spawn window is exactly what makes this possible.
+
+That is also the migration path for consumer apps whose test helpers open
+`pg` connections directly (e.g. seeding fixtures for browser specs): a direct
+connection requires a shared, externally-reachable database, which is what
+keeps postgres service containers in CI. Port those helpers to declared
+`seed` steps and the suite runs on pglite with no services at all.
+
 ## Production: supported, never implicit
 
 Production seeding never happens as a side effect of boot or deploy. Run it
 
@@ -83,23 +83,26 @@ export function readDotEnv(repoRoot, fileName = ".env") {
   return parse(fs.readFileSync(envPath));
 }
 
-function databaseSecrets(config) {
+function databaseSecretEntries(config) {
   const sections = [
-    config.app?.api?.secrets,
-    config.app?.auth?.secrets,
-    ...Object.values(config.plugins ?? {}).map((plugin) => plugin?.secrets),
+    { key: "api", secrets: config.app?.api?.secrets },
+    { key: "auth", secrets: config.app?.auth?.secrets },
+    ...Object.entries(config.plugins ?? {}).map(([key, plugin]) => ({
+      key,
+      secrets: plugin?.secrets,
+    })),
   ];
   const seen = new Set();
-  const secrets = [];
-  for (const list of sections) {
-    for (const secret of list ?? []) {
+  const entries = [];
+  for (const { key, secrets } of sections) {
+    for (const secret of secrets ?? []) {
       if (typeof secret === "string" && secret.endsWith("_DATABASE_URL") && !seen.has(secret)) {
         seen.add(secret);
-        secrets.push(secret);
+        entries.push({ secret, key });
       }
     }
   }
-  return secrets;
+  return entries;
 }
 /**
  * The compose-era local convention (`postgres://everythingdev:…@localhost:{5432,5433}/…`
@@ -125,26 +128,61 @@ function isDevDatabaseUrl(url) {
   );
 }
 
+/**
+ * Mirror of the framework's normalizeSlug (db/core) — the regression dirs
+ * must name themselves exactly as the dev layout (ADR 0044) does, so the
+ * pre-spawn seed phase and the services address the same files.
+ */
+function normalizeSlug(name) {
+  const basename = name.split("/").pop() ?? name;
+  return basename
+    .replace(/^@/, "")
+    .replace(/[^a-zA-Z0-9_-]/g, "_")
+    .replace(/-plugin$/i, "")
+    .replace(/-/g, "_")
+    .toLowerCase();
+}
+
+/**
+ * The regression database root: scratch, wiped per run (start-stack), one
+ * subdirectory per workspace. `.env.test`'s in-memory pglite marker means
+ * "harness-picked pglite" and is substituted for these dirs, because an
+ * in-memory database cannot be seeded — nothing exists before its service
+ * process creates it, so a pre-spawn seed phase (#866) has nothing to
+ * address. A wiped dir keeps in-memory's isolation (nothing survives a
+ * run) while opening the pre-spawn window the seed phase needs.
+ *
+ * The substituted URLs are ABSOLUTE: each service resolves a relative pglite
+ * path against its own workspace cwd (that is how the dev layout scatters
+ * `api/.bos/db/api` vs `.bos/db/auth`), and the wipe must own one root.
+ */
+const REGRESSION_DB_SUBDIR = path.join(".bos", "regression", "db");
+const IN_MEMORY_PGLITE_URLS = new Set(["pglite::memory:", "pglite:memory:"]);
+
 export function computeRegressionEnv({ repoRoot, env = process.env } = {}) {
   const root = repoRoot ?? findRepoRoot();
   if (!root) throw new Error("No authored config (bos.app.ts) found in any parent directory");
   const config = loadRegressionConfig(root);
   const fileEnv = readDotEnv(root);
   const testEnv = readDotEnv(root, ".env.test");
   const allowDevDb = env.REGRESSION_ALLOW_DEV_DB === "1";
+  const regressionDbRoot = path.join(root, REGRESSION_DB_SUBDIR);
 
   const dbUrls = {};
-  for (const secret of databaseSecrets(config)) {
+  for (const { secret, key } of databaseSecretEntries(config)) {
     const resolved = testEnv[secret] ?? env[secret] ?? fileEnv[secret] ?? TEST_DATABASE_DEFAULT;
-    if (!allowDevDb && isDevDatabaseUrl(resolved)) {
+    const url = IN_MEMORY_PGLITE_URLS.has(resolved)
+      ? `pglite:${regressionDbRoot}/${normalizeSlug(key)}`
+      : resolved;
+    if (!allowDevDb && isDevDatabaseUrl(url)) {
       throw new Error(
-        `refusing to run: ${secret} resolves to the dev database (${resolved}). ` +
+        `refusing to run: ${secret} resolves to the dev database (${url}). ` +
           "Regression tests must stay isolated from dev data. " +
           "Restore the generated .env.test (in-memory pglite — run `pnpm run bos dev` to regenerate), " +
           "or set REGRESSION_ALLOW_DEV_DB=1 to override deliberately.",
       );
     }
-    dbUrls[secret] = resolved;
+    dbUrls[secret] = url;
   }
 
   const baseUrl = env.REGRESSION_BASE_URL ?? fileEnv.REGRESSION_BASE_URL ?? DEFAULT_BASE_URL;
@@ -180,6 +218,7 @@ export function computeRegressionEnv({ repoRoot, env = process.env } = {}) {
     baseUrl,
     basePort,
     dbUrls,
+    dbRoot: regressionDbRoot,
     authSecret,
     bootstrapAdminKey,
     stalePorts,
 
@@ -113,15 +113,46 @@ void test("per-identity pglite dirs under the dev root are dev data too", () =>
   );
 });
 
-void test("in-memory pglite and external postgres URLs are accepted test targets", () => {
+void test("the in-memory test marker substitutes wiped per-workspace pglite dirs", () => {
   const repoRoot = fixture();
   writeFileSync(
     join(repoRoot, ".env.test"),
     "API_DATABASE_URL=pglite::memory:\nBETTER_AUTH_SECRET=test-secret\n",
   );
   const config = computeRegressionEnv({ repoRoot, env: {} });
-  assert.equal(config.dbUrls.API_DATABASE_URL, "pglite::memory:");
-  assert.equal(config.dbUrls.AUTH_DATABASE_URL, "pglite::memory:");
+  const dbRoot = join(repoRoot, ".bos", "regression", "db");
+  assert.equal(config.dbUrls.API_DATABASE_URL, `pglite:${dbRoot}/api`);
+  assert.equal(config.dbUrls.AUTH_DATABASE_URL, `pglite:${dbRoot}/auth`);
+  assert.equal(config.dbRoot, dbRoot);
+});
+
+void test("explicit database URLs pass through untouched (sslmode param preserved)", () => {
+  const repoRoot = fixture();
+  const url = "postgres://test:test@postgres-api-test:5432/api_test_db?sslmode=disable";
+  const config = computeRegressionEnv({
+    repoRoot,
+    env: { API_DATABASE_URL: url, BETTER_AUTH_SECRET: "test-secret" },
+  });
+  assert.equal(config.dbUrls.API_DATABASE_URL, url);
+});
+
+void test("plugin keys slug per-workspace regression dirs like the dev layout", () => {
+  const repoRoot = fixture();
+  writeFileSync(
+    join(repoRoot, "bos.config.json"),
+    JSON.stringify({
+      app: { api: { secrets: ["API_DATABASE_URL"] } },
+      plugins: {
+        "@acme/widget-plugin": { secrets: ["WIDGET_DATABASE_URL"] },
+      },
+    }),
+  );
+  writeFileSync(join(repoRoot, ".env.test"), "BETTER_AUTH_SECRET=test-secret\n");
+  const config = computeRegressionEnv({ repoRoot, env: {} });
+  assert.equal(
+    config.dbUrls.WIDGET_DATABASE_URL,
+    `pglite:${join(repoRoot, ".bos", "regression", "db")}/widget`,
+  );
 });
 
 void test("invalid modes fail before starting a stack", () => {
 
@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 // Boots the regression stack (dev/prod/backcompat) with the test environment
-// from .env.test (in-memory pglite) so regression runs never touch dev data
-// or dev ports.
+// from .env.test (wiped per-workspace pglite dirs) so regression runs never
+// touch dev data or dev ports.
 import { spawn } from "node:child_process";
-import { mkdirSync, openSync } from "node:fs";
+import { mkdirSync, openSync, rmSync } from "node:fs";
 import net from "node:net";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
@@ -72,6 +72,11 @@ if (!root) {
 }
 
 const regressionEnv = computeRegressionEnv({ repoRoot: root });
+// The regression DB root is scratch: wiped per run so every boot starts from
+// empty — the seed phase's marker lives in the api database, so a fresh dir
+// means the phase runs again. Wiped before the stack spawns; nothing holds
+// these dirs open yet.
+rmSync(regressionEnv.dbRoot, { recursive: true, force: true });
 const spec = regressionStackOptions(regressionEnv, mode);
 await waitForDatabases(regressionEnv.dbUrls);
 killStalePorts(regressionEnv.stalePorts);