fix(cli): defer premature capability gates to Phase F + address review

Remove the `backup --jobs`→CapParallel and `sync --stream`→CapNativeStream
preflight gates. Both guarded features that the current verbs do not yet
implement: app.Sync ignores opt.Stream (always pipes Backup→Restore via
io.Pipe), and pg_dump parallelism (-j/-Fd) is unwired ("not yet effective;
Phase F"). Gating them now would falsely reject valid operations the moment a
driver declaring NativeStream:false / Parallel:false lands, while gating a
no-op feature. The RequireCapability helper + Capabilities flags stay; the
gates get wired in Phase F alongside the features they guard.

Also from CodeRabbit review on PR #3:
- _testing/suite.go: the Cancel_PropagatesToSubprocess subtest could flake on
  fast hosts when the prior subtest's tiny fixture lets pg_dump finish before
  the 150ms cancel. Seed ~5 MiB via fx.SQLOpener so the dump is reliably
  in-flight at cancel time; keep the strong non-nil assertion. (Integration-tag
  only; not run in CI.)
- DRIVERS.md: add a `text` language tag to the architecture-diagram fence
  (markdownlint MD040), and correct the capability section + README/CHANGELOG
  to describe gating as helper-available-but-not-yet-wired, not CLI-wired.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nixrajput

CHANGELOG.md

@@ -14,6 +14,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Phase C interactive TUI dashboard: multi-panel Bubble Tea UI (profiles · dumps · jobs) with live job-progress subscription, backup/restore modal forms, an error overlay, and golden snapshot tests.
 - Phase D driver-layer hardening:
   - Shared cross-driver test harness `RunDriverSuite` under `internal/driver/_testing/`, giving every driver four contract tests for free (connect/inspect, backup→restore round-trip, cancel propagation, bad-credentials sentinel). The Postgres integration test now runs on it.
-  - Capability gating: `app.RequireCapability` resolves a profile to its driver and rejects unsupported affordances with a `CodeUser` error. Wired into the CLI so `backup --jobs N>1` is gated by `Parallel` and `sync --stream` by `NativeStream`.
+  - Capability gating helper: `app.RequireCapability` resolves a profile to its driver and rejects unsupported affordances with a `CodeUser` error. The helper and the `Capabilities` flags are in place; verbs are wired to it only where the gated feature is implemented. Streaming (`NativeStream`) and parallel backup (`Parallel`) are deferred to Phase F, so `sync --stream` / `backup --jobs` are not yet gated — the wiring lands with those features.
   - Connection-probe retry on Postgres `Connect` (3 attempts, exponential backoff) per spec §4.3; the generic `Retry` helper moved to `internal/jobs` to keep the driver layer free of an app-layer import.
   - `docs/DRIVERS.md` contributor guide documenting the driver contract, registration, the test harness, capability flags, and error mapping.

README.md

@@ -52,7 +52,7 @@ A single binary that turns the painful, error-prone sprawl of `pg_dump` → `pg_
 | **A** — Skeleton                  | Go module, Cobra CLI, TUI placeholder, `Driver` interface + registry, `errs`/`config`/`secrets`/`profile` packages, golangci-lint + depguard, cross-platform CI | ✅ Complete |
 | **B** — Postgres walking skeleton | `backup`, `restore`, `sync`, `verify`, `inspect`, `dumps`, `config`, `profile` working end-to-end against PostgreSQL                                            | ✅ Complete |
 | **C** — TUI dashboard             | Multi-panel Bubble Tea dashboard (profiles · dumps · jobs) with live job progress, backup/restore modal forms, and snapshot tests                               | ✅ Complete |
-| **D** — Driver hardening          | Shared cross-driver test harness (`RunDriverSuite`), capability gating (`RequireCapability`), connection-probe retry, and a `docs/DRIVERS.md` contributor guide | ✅ Complete |
+| **D** — Driver hardening          | Shared cross-driver test harness (`RunDriverSuite`), capability-gating helper (`RequireCapability`), Postgres connection-probe retry, and a `docs/DRIVERS.md` contributor guide | ✅ Complete |
 | **E** — MySQL + MariaDB           | Both drivers via a shared `_mysqlcommon` package                                                                                                                | ⏳ Planned  |
 | **F** — Advanced transfer         | Incremental backups, bounded-buffer streaming, cross-engine sync, CDC                                                                                           | ⏳ Planned  |
 | **G** — Ops features              | Cloud storage, secret backends, profile groups + 2FA, team mode, audit log, retention, telemetry                                                                | ⏳ Planned  |

docs/DRIVERS.md

@@ -24,7 +24,7 @@ that shells out to the engine's native tools for data movement (e.g.
 siphon is strictly layered; imports flow **downward only**, enforced at lint
 time by `golangci-lint`'s `depguard`:
 
-```
+```text
   internal/cli   internal/tui     presentation (Cobra · Bubble Tea)
         └──────┬───────┘
         internal/app              application verbs (backup, restore, sync, …)
@@ -120,13 +120,19 @@ type Capabilities struct {
 }
 ```
 
-**Declare these honestly.** The presentation layer gates affordances through
-`app.RequireCapability(deps, profileName, cap)` (in `internal/app/capgate.go`)
-before running a verb. If your driver declares `Parallel: false`, the CLI rejects
-`--jobs N` (with `N > 1`) up front with an `errs.ErrDriverUnsupported` error and
-an actionable hint — instead of crashing partway through. Over-declaring a
-capability you don't actually support turns that clean rejection into a runtime
-failure.
+**Declare these honestly.** A verb pre-flight can gate an affordance through
+`app.RequireCapability(deps, profileName, cap)` (in `internal/app/capgate.go`):
+if the resolved driver doesn't support `cap`, it returns an
+`errs.ErrDriverUnsupported` error with an actionable hint up front, instead of
+crashing partway through. Over-declaring a capability you don't actually support
+turns that clean rejection into a runtime failure.
+
+> **Status:** the gate helper and the `Capabilities` flags exist today, but the
+> verbs are only gated where a feature is actually wired. Native streaming
+> (`NativeStream`) and parallel backup (`Parallel`) are deferred to Phase F, so
+> `sync --stream` / `backup --jobs` are not yet gated — the gate will be wired in
+> alongside those features. Declare your flags honestly now so the gating is
+> correct the moment a verb starts honoring them.
 
 When you add support for a capability, flip its flag — that single change lights
 up the corresponding UI path.

internal/cli/backup.go

@@ -29,11 +29,6 @@ func newBackupCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			if parallel > 1 {
-				if err := app.RequireCapability(deps, profileName, app.CapParallel); err != nil {
-					return err
-				}
-			}
 			ch, _, err := app.Backup(c.Context(), deps, app.BackupOpts{
 				Profile:          profileName,
 				IncludeTables:    includeTables,

internal/cli/sync.go

@@ -27,13 +27,6 @@ func newSyncCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			if stream {
-				for _, name := range []string{fromName, toName} {
-					if err := app.RequireCapability(deps, name, app.CapNativeStream); err != nil {
-						return err
-					}
-				}
-			}
 			ch, _, err := app.Sync(c.Context(), deps, app.SyncOpts{
 				From: fromName, To: toName, Stream: stream, Tables: tables,
 			})

internal/driver/_testing/suite.go

@@ -4,13 +4,57 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"strconv"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/nixrajput/siphon/internal/driver"
 	"github.com/nixrajput/siphon/internal/errs"
 )
 
+// seedCancelLoad bulk-loads a table of wide rows via the fixture's raw SQL
+// connection so a subsequent Backup has enough data to stay in-flight past the
+// cancel delay. Uses only portable SQL (CREATE TABLE + parameterized INSERT in
+// one transaction), so it works for any engine the harness is pointed at.
+func seedCancelLoad(t *testing.T, fx Fixtures) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	db, err := fx.SQLOpener()
+	if err != nil {
+		t.Fatalf("seedCancelLoad: SQLOpener: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	if _, err := db.ExecContext(ctx,
+		`CREATE TABLE cancel_load (id integer primary key, payload text)`); err != nil {
+		t.Fatalf("seedCancelLoad: create table: %v", err)
+	}
+
+	// ~5000 rows of ~1 KiB each ≈ 5 MiB — large enough that the dump can't
+	// complete within the 150ms cancel window, small enough to load quickly.
+	// The payload is a fixed safe literal (no user input), so it's inlined
+	// rather than parameterized — this keeps the SQL placeholder-agnostic
+	// ($1 vs ? differs by engine) so the harness stays portable across drivers.
+	payload := strings.Repeat("x", 1024)
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		t.Fatalf("seedCancelLoad: begin: %v", err)
+	}
+	for i := 0; i < 5000; i++ {
+		if _, err := tx.ExecContext(ctx,
+			"INSERT INTO cancel_load (id, payload) VALUES ("+strconv.Itoa(i)+", '"+payload+"')"); err != nil {
+			_ = tx.Rollback()
+			t.Fatalf("seedCancelLoad: insert %d: %v", i, err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		t.Fatalf("seedCancelLoad: commit: %v", err)
+	}
+}
+
 // RunDriverSuite exercises the full Driver contract against a real
 // database. ctor returns the driver-under-test; fx provides the env.
 //
@@ -79,6 +123,13 @@ func RunDriverSuite(t *testing.T, ctor func() driver.Driver, fx Fixtures) {
 	})
 
 	t.Run("Cancel_PropagatesToSubprocess", func(t *testing.T) {
+		// Inflate the database so the dump takes long enough that cancel()
+		// reliably lands while pg_dump (or the engine's equivalent) is still
+		// streaming. With only the round-trip subtest's tiny fixture, the dump
+		// can finish in well under the cancel delay on a fast host, making
+		// Backup return a clean nil and the assertion below spuriously fail.
+		seedCancelLoad(t, fx)
+
 		conn, err := d.Connect(context.Background(), fx.Profile)
 		if err != nil {
 			t.Fatalf("Connect: %v", err)