openvibers/openvibe.reviews Commits

The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, REVIEWS_DB_PATH/dbPath (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently (VERDICT: SHIP). npm test 15/15 test files passed.

OP OpenVibers committed 29 Sept 2026 · 34916a41c7 · 13 files, +95 −72





Changes
ddiff --git a/.env.example b/.env.example
iindex 5a3a401..72508eb 100644
---- a/.env.example
++++ b/.env.example
@@@ -1,7 +1,7 @@
  # ═══════════════════════════════════════════════════════════════
  # OpenVibe.Reviews — Environment Configuration
  # Copy to .env and fill in values. In production this lives at /etc/openvibe/reviews.env (0600);
--# the systemd unit sets NODE_ENV, PORT and REVIEWS_DB_PATH itself. Names only here: never commit values.
++# the systemd unit sets NODE_ENV and PORT itself. Names only here: never commit values.
  # ═══════════════════════════════════════════════════════════════
  
  # Server
@@@ -18,16 +18,13 @@ NODE_ENV=development
  #REVIEWS_LIMITS_MINUTE=120
  #REVIEWS_LIMITS_HOUR=3000
  
--# Store (SQLite, WAL). Production: /var/lib/openvibe-reviews/reviews.db (systemd StateDirectory).
--# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh reviews: the runtime role through PgBouncer,
--# the owner on a direct connection (migrations and the one-time import), and Valkey (shared limit counters).
++# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh reviews: the runtime role through PgBouncer
++# and the owner on a direct connection (schema migrations). Valkey holds the shared limit counters.
  # Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
  DATABASE_URL=
  DATABASE_DIRECT_URL=
  VALKEY_URL=
  VALKEY_PREFIX=
--# The SQLite file of releases before PostgreSQL: read once by scripts/migrate-to-postgres.js.
--REVIEWS_DB_PATH=./data/reviews.db
  
  # Identity — OpenVibe.Network signs user JWTs (SSO) and service tokens. The public key is fetched
  # from <url>/api/.well-known/jwks (internal URL first) and retried every 30 s until it loads.
ddiff --git a/.gitignore b/.gitignore
iindex 07af271..bc8c8bd 100644
---- a/.gitignore
++++ b/.gitignore
@@@ -3,9 +3,6 @@ data/
  .env
  .env.*
  !.env.example
--*.db
--*.db-wal
--*.db-shm
  *.log
  *.pem
  *.key
ddiff --git a/README.md b/README.md
iindex 19b141e..40d6d00 100644
---- a/README.md
++++ b/README.md
@@@ -212,8 +212,8 @@ fnm exec --using=22.22.1 npm test         # every test/*.test.js on temp databas
  ```
  
  Production: `/opt/openvibe.reviews`, env `/etc/openvibe/reviews.env`, unit
--[deploy/systemd/openvibe-reviews.service](deploy/systemd/openvibe-reviews.service), store
--`/var/lib/openvibe-reviews/reviews.db`, nginx [deploy/nginx/openvibe.reviews.conf](deploy/nginx/openvibe.reviews.conf).
++[deploy/systemd/openvibe-reviews.service](deploy/systemd/openvibe-reviews.service), database `ov_reviews`
++on PostgreSQL (ADR-035), nginx [deploy/nginx/openvibe.reviews.conf](deploy/nginx/openvibe.reviews.conf).
  There is **no seed**: a fresh database holds no entity, signal, summary or rating. Entities are created
  by editors; signals arrive only from Sources.
  
@@@ -288,10 +288,7 @@ Production deploys with `sudo ovhost deploy reviews` on the host (strategy `git-
  fast-forward `/opt/openvibe.reviews`, install on a lockfile change, restart, wait for `/api/ready`).
  The unit is `openvibe-reviews.service` on `127.0.0.1:4830`, the env file `/etc/openvibe/reviews.env`. The database is
  `ov_reviews` on the host's data role (`sudo /opt/openvibe.host/roles/data/add-service.sh reviews` writes its settings); the
--release migrates it at boot. The one-time move from SQLite is `scripts/migrate-to-postgres.js` (openvibe-sdk
--`runSqliteMigration`, with a `--pglite` rehearsal mode), run while the service is stopped; the old
--`/var/lib/openvibe-reviews/reviews.db` stays read-only for 7 days as the rollback. The store is
--`/var/lib/openvibe-reviews/reviews.db`; the nginx reference is
++release migrates it at boot (schema in [migrations/](migrations/)). The nginx reference is
  [deploy/nginx/openvibe.reviews.conf](deploy/nginx/openvibe.reviews.conf) (the domain still serves the
  OpenVibe.Sites placeholder).
  Rollback: ovhost puts the previous sha back by itself when `/api/ready` does not answer 2xx after the
@@@ -308,7 +305,7 @@ following hold (plan §12.12):
  3. server-rendered public routes useful without JavaScript — **built**;
  4. real persistence and end-to-end workflows — **built** and deployed on the host (loopback only, empty database); no Sources review source is enabled yet;
  5. capability and event registration against OpenVibe.Contracts — **done** (openvibe-contracts v0.20.0);
--6. a migration/seed strategy (none: nothing to migrate, nothing seeded), a security/threat review, sitemap/robots/feed behaviour — discovery **built**; threat review **written**: [docs/threat-review.md](docs/threat-review.md) (the service authors' own, from the code: controls with file:line references, the gaps fixed in that pass and the ones that remain; an independent review is still to come);
++6. a migration/seed strategy (schema migrations in [migrations/](migrations/); nothing seeded), a security/threat review, sitemap/robots/feed behaviour — discovery **built**; threat review **written**: [docs/threat-review.md](docs/threat-review.md) (the service authors' own, from the code: controls with file:line references, the gaps fixed in that pass and the ones that remain; an independent review is still to come);
  7. acceptance tests proving the advertised functionality — **built** (`npm test`).
  
  The launch release removes `openvibe.reviews` from `OpenVibe.Sites/sites.json`, switches routing to
ddiff --git a/STATUS.json b/STATUS.json
iindex 6cba503..fd7642e 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -4,7 +4,7 @@
    "code": true,
    "wave": "W17",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026)",
--  "runtime": "node 22, express, better-sqlite3",
++  "runtime": "node 22, express, postgresql",
    "port": 4830,
    "domain": "openvibe.reviews",
    "contracts": "openvibe-contracts v0.76.0",
ddiff --git a/deploy/systemd/openvibe-reviews.service b/deploy/systemd/openvibe-reviews.service
iindex 818984b..4fa47da 100644
---- a/deploy/systemd/openvibe-reviews.service
++++ b/deploy/systemd/openvibe-reviews.service
@@@ -25,9 +25,6 @@ NoNewPrivileges=true
  PrivateTmp=true
  ProtectSystem=strict
  ProtectHome=true
--# The code tree stays read-only; the database lives in /var/lib/openvibe-reviews.
--StateDirectory=openvibe-reviews
--Environment=REVIEWS_DB_PATH=/var/lib/openvibe-reviews/reviews.db
  
  [Install]
  WantedBy=multi-user.target
ddiff --git a/package-lock.json b/package-lock.json
iindex 3202fc0..e940738 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -9,7 +9,6 @@
        "version": "0.1.0",
        "license": "AGPL-3.0-only",
        "dependencies": {
--        "better-sqlite3": "^11.10.0",
          "cookie-parser": "^1.4.7",
          "dotenv": "^16.4.7",
          "express": "^4.21.2",
@@@ -111,7 +110,9 @@
            "url": "https://feross.org/support"
          }
        ],
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/better-sqlite3": {
        "version": "11.10.0",
@@@ -119,6 +120,8 @@
        "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
        "hasInstallScript": true,
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "bindings": "^1.5.0",
          "prebuild-install": "^7.1.1"
@@@ -129,6 +132,8 @@
        "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
        "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "file-uri-to-path": "1.0.0"
        }
@@@ -138,6 +143,8 @@
        "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
        "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "buffer": "^5.5.0",
          "inherits": "^2.0.4",
@@@ -187,6 +194,8 @@
          }
        ],
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "base64-js": "^1.3.1",
          "ieee754": "^1.1.13"
@@@ -240,7 +249,9 @@
        "version": "1.1.4",
        "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
        "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
--      "license": "ISC"
++      "license": "ISC",
++      "optional": true,
++      "peer": true
      },
      "node_modules/cluster-key-slot": {
        "version": "1.1.2",
@@@ -314,6 +325,8 @@
        "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
        "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "mimic-response": "^3.1.0"
        },
@@@ -329,6 +342,8 @@
        "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
        "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "engines": {
          "node": ">=4.0.0"
        }
@@@ -366,6 +381,8 @@
        "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
        "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
        "license": "Apache-2.0",
++      "optional": true,
++      "peer": true,
        "engines": {
          "node": ">=8"
        }
@@@ -425,6 +442,8 @@
        "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
        "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "once": "^1.4.0"
        }
@@@ -479,6 +498,8 @@
        "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
        "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
        "license": "(MIT OR WTFPL)",
++      "optional": true,
++      "peer": true,
        "engines": {
          "node": ">=6"
        }
@@@ -570,7 +591,9 @@
        "version": "1.0.0",
        "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
        "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/finalhandler": {
        "version": "1.3.2",
@@@ -612,7 +635,9 @@
        "version": "1.0.0",
        "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
        "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/function-bind": {
        "version": "1.1.2",
@@@ -664,7 +689,9 @@
        "version": "0.0.0",
        "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
        "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/gopd": {
        "version": "1.2.0",
@@@ -752,7 +779,9 @@
            "url": "https://feross.org/support"
          }
        ],
--      "license": "BSD-3-Clause"
++      "license": "BSD-3-Clause",
++      "optional": true,
++      "peer": true
      },
      "node_modules/inherits": {
        "version": "2.0.4",
@@@ -764,7 +793,9 @@
        "version": "1.3.8",
        "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
        "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
--      "license": "ISC"
++      "license": "ISC",
++      "optional": true,
++      "peer": true
      },
      "node_modules/iovalkey": {
        "version": "0.4.0",
@@@ -1001,6 +1032,8 @@
        "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
        "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "engines": {
          "node": ">=10"
        },
@@@ -1013,6 +1046,8 @@
        "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
        "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "funding": {
          "url": "https://github.com/sponsors/ljharb"
        }
@@@ -1021,7 +1056,9 @@
        "version": "0.5.3",
        "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
        "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/ms": {
        "version": "2.0.0",
@@@ -1033,7 +1070,9 @@
        "version": "2.0.0",
        "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
        "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/negotiator": {
        "version": "0.6.3",
@@@ -1049,6 +1088,8 @@
        "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.96.0.tgz",
        "integrity": "sha512-rebQ/lz7i0EkoLzUVSrKRzA69zMkwLp95kKMWoMDkkM00Suxz0D7zEQPwRml5fQum24mj7bPvmlgLAmu2JCiYg==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "semver": "^7.3.5"
        },
@@@ -1085,6 +1126,8 @@
        "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
        "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
        "license": "ISC",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "wrappy": "1"
        }
@@@ -1310,6 +1353,8 @@
        "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
        "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "detect-libc": "^2.0.0",
          "expand-template": "^2.0.3",
@@@ -1353,6 +1398,8 @@
        "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
        "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "end-of-stream": "^1.1.0",
          "once": "^1.3.1"
@@@ -1403,6 +1450,8 @@
        "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
        "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
        "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "deep-extend": "^0.6.0",
          "ini": "~1.3.0",
@@@ -1418,6 +1467,8 @@
        "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
        "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "inherits": "^2.0.3",
          "string_decoder": "^1.1.1",
@@@ -1636,7 +1687,9 @@
            "url": "https://feross.org/support"
          }
        ],
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/simple-get": {
        "version": "4.0.1",
@@@ -1657,6 +1710,8 @@
          }
        ],
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "decompress-response": "^6.0.0",
          "once": "^1.3.1",
@@@ -1692,6 +1747,8 @@
        "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
        "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "safe-buffer": "~5.2.0"
        }
@@@ -1701,6 +1758,8 @@
        "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
        "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "engines": {
          "node": ">=0.10.0"
        }
@@@ -1710,6 +1769,8 @@
        "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.5.tgz",
        "integrity": "sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "chownr": "^1.1.1",
          "mkdirp-classic": "^0.5.2",
@@@ -1722,6 +1783,8 @@
        "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
        "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
        "license": "MIT",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "bl": "^4.0.3",
          "end-of-stream": "^1.4.1",
@@@ -1747,6 +1810,8 @@
        "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
        "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
        "license": "Apache-2.0",
++      "optional": true,
++      "peer": true,
        "dependencies": {
          "safe-buffer": "^5.0.1"
        },
@@@ -1780,7 +1845,9 @@
        "version": "1.0.2",
        "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
        "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
--      "license": "MIT"
++      "license": "MIT",
++      "optional": true,
++      "peer": true
      },
      "node_modules/utils-merge": {
        "version": "1.0.1",
@@@ -1804,7 +1871,9 @@
        "version": "1.0.2",
        "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
        "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
--      "license": "ISC"
++      "license": "ISC",
++      "optional": true,
++      "peer": true
      },
      "node_modules/xtend": {
        "version": "4.0.2",
ddiff --git a/package.json b/package.json
iindex 402b767..373c24e 100644
---- a/package.json
++++ b/package.json
@@@ -19,7 +19,6 @@
    "license": "AGPL-3.0-only",
    "repository": "github:OpenVibers/OpenVibe.Reviews",
    "dependencies": {
--    "better-sqlite3": "^11.10.0",
      "cookie-parser": "^1.4.7",
      "dotenv": "^16.4.7",
      "express": "^4.21.2",
ddiff --git a/scripts/migrate-to-postgres.js b/scripts/migrate-to-postgres.js
ddeleted file mode 100644
iindex bb5a029..0000000
---- a/scripts/migrate-to-postgres.js
++++ /dev/null
@@@ -1,26 +0,0 @@
--#!/usr/bin/env node
--'use strict';
--/**
-- * The one-time move of Reviews's SQLite database (REVIEWS_DB_PATH) into its PostgreSQL schema (ADR-035; the procedure is
-- * openvibe-sdk docs/migrating-to-postgresql.md, section 6, carried out by openvibe-sdk/db runSqliteMigration).
-- *
-- *   node scripts/migrate-to-postgres.js [--sqlite <file>] [--pglite] [--json]
-- *
-- * Applies migrations/ as the owner (DATABASE_DIRECT_URL), copies every table into emptied tables, verifies row counts
-- * and checksums, and exits 1 unless everything verified. The SQLite file is opened read-only. Every table keeps its
-- * name and columns.
-- */
--require('dotenv').config();
--const { runSqliteMigration } = require('openvibe-sdk/db');
--const configLib = require('../server/config');
--const { MIGRATIONS } = require('../server/db');
--
--const TABLES = {};
--
--if (require.main === module) {
--    const config = configLib.load();
--    runSqliteMigration({ service: 'reviews', sqlite: config.dbPath, directUrl: config.db.directUrl, migrations: MIGRATIONS, tables: TABLES })
--        .then((code) => process.exit(code), (err) => { console.error(`migrate-to-postgres failed: ${err.message}`); process.exit(1); });
--}
--
--module.exports = { TABLES };
ddiff --git a/server/config.js b/server/config.js
iindex fd46594..dc0c724 100644
---- a/server/config.js
++++ b/server/config.js
@@@ -34,8 +34,6 @@ function load(env = process.env) {
          // PostgreSQL (ADR-035): DATABASE_URL serves (PgBouncer), DATABASE_DIRECT_URL migrates (owner role).
          db: { url: env.DATABASE_URL || '', directUrl: env.DATABASE_DIRECT_URL || '' },
          valkey: { url: env.VALKEY_URL || '', prefix: env.VALKEY_PREFIX || 'ov:reviews:' },
--        // The SQLite file of releases before the switch: read once by scripts/migrate-to-postgres.js.
--        dbPath: env.REVIEWS_DB_PATH || './data/reviews.db',
  
          // Identity: OpenVibe.Network signs user JWTs (SSO) and service tokens (client credentials).
          networkUrl,
ddiff --git a/server/http/consumer.js b/server/http/consumer.js
iindex 31a1a4a..d5d87bc 100644
---- a/server/http/consumer.js
++++ b/server/http/consumer.js
@@@ -8,7 +8,7 @@
   *   sources.item.removed           category reviews: the item's signal is withdrawn at once; the next
   *                                  aggregate revision no longer counts it
   *
-- * Exactly once: the openvibe-sdk inbox claims (consumer, event_id) in the same SQLite transaction
++ * Exactly once: the openvibe-sdk inbox claims (consumer, event_id) in the same PostgreSQL transaction
   * as the change. The signature (X-OpenVibe-Signature, HMAC-SHA256 of the raw body with
   * REVIEWS_EVENTS_SECRET) is verified with openvibe-sdk's parseDelivery. Only events whose source
   * is `sources` are applied.
ddiff --git a/server/reviews/service.js b/server/reviews/service.js
iindex 44f9493..28d5d0a 100644
---- a/server/reviews/service.js
++++ b/server/reviews/service.js
@@@ -5,7 +5,7 @@
   * interpretation and publication layer; OpenVibe.Sources owns the items, Community the discussion,
   * OpenVibe.AI only proposes drafts.
   *
-- * Every write runs in one SQLite transaction together with the events it causes (transactional
++ * Every write runs in one PostgreSQL transaction together with the events it causes (transactional
   * outbox): reviews.entity.merged|split, reviews.signal.added|removed,
   * reviews.summary.published|updated|unpublished (a correction is an `updated` carrying
   * `correction`), and the Search index events reviews.index_document.upserted|deleted.
ddiff --git a/test/helpers.js b/test/helpers.js
iindex cde05d4..c670ee9 100644
---- a/test/helpers.js
++++ b/test/helpers.js
@@@ -6,9 +6,6 @@
   */
  const assert = require('assert');
  const crypto = require('crypto');
--const fs = require('fs');
--const os = require('os');
--const path = require('path');
  const { serviceAuth, ids } = require('openvibe-contracts');
  const { signDelivery, signDeliveryHeaders } = require('openvibe-sdk/events');
  const { load } = require('../server/config');
@@@ -150,11 +147,9 @@ function fakeCommunity() {
   * (default false) turns on the per-address and per-actor limits; limitsNow is the per-actor limiter's
   * clock; log is Reviews' logger (default quiet).
   */
--async function boot({ env = {}, sources = fakeSources(), community = null, dbPath, now, workers = false, rateLimits = false, limitsNow = null, log = quiet } = {}) {
--    const dir = dbPath ? path.dirname(dbPath) : fs.mkdtempSync(path.join(os.tmpdir(), 'reviews-test-'));
++async function boot({ env = {}, sources = fakeSources(), community = null, now, workers = false, rateLimits = false, limitsNow = null, log = quiet } = {}) {
      const config = load({
          NODE_ENV: 'test', PORT: '0', HOST: '127.0.0.1', BASE_URL: 'http://reviews.test',
--        REVIEWS_DB_PATH: dbPath || path.join(dir, 'reviews.db'),
          OV_NETWORK_URL: ISSUER, OV_NETWORK_INTERNAL_URL: '', REVIEWS_GATE_MIN_WORDS: '20',
          OV_SOURCES_INTERNAL_URL: 'http://sources.test', OV_COMMUNITY_INTERNAL_URL: 'http://community.test',
          REVIEWS_EDITORS: EDITOR, REVIEWS_EVENTS_SECRET: WEBHOOK_SECRET,
@@@ -173,7 +168,7 @@ async function boot({ env = {}, sources = fakeSources(), community = null, dbPat
          tokens: { getToken: async () => 'stub-token', authHeaders: async () => ({ Authorization: 'Bearer stub-token' }), invalidate() {} },
      });
      const base = `http://127.0.0.1:${h.server.address().port}`;
--    return { ...h, stop: async () => { await h.stop(); await testdb.close(); }, base, dir, sources, community };
++    return { ...h, stop: async () => { await h.stop(); await testdb.close(); }, base, sources, community };
  }
  
  async function req(h, method, p, { token, body, form, headers = {}, cookie } = {}) {
ddiff --git a/test/run.js b/test/run.js
iindex 92f14c7..237198f 100644
---- a/test/run.js
++++ b/test/run.js
@@@ -1,7 +1,7 @@
  #!/usr/bin/env node
  /**
   * Runs every test in test/ — the files named *.test.js — each in its own process, and fails if
-- * any of them fails. They use temp SQLite databases, a generated RSA key and stub upstreams; none
++ * any of them fails. They use temp PGlite databases, a generated RSA key and stub upstreams; none
   * of them needs the network or a running OpenVibe service.
   *
   *   npm test                   # everything