[iamwavecut]

Gradius advertising is allowed only in the initiating user's private chat with the bot. Apply the same identity check to dialogue, image, rates and check-in placements before VIP lookups, privacy redaction, reservations or provider requests. Advertising builders reject groups and channels, and the image path no longer checks group membership or selects public/ephemeral advertising. Ordinary group results continue without ads. Enable switches cannot override the restriction.

Remove the unused SQLx SQLite/MySQL dependency graph instead of excluding its advisories. Storage now exposes the existing sqlx-core/sqlx-postgres components through database.rs; application changes outside advertising are import wiring. Replace seven FromRow derives with explicit PostgreSQL mappings, preserving renamed/flattened fields and the missing-column default. Embed migrations in build.rs through SQLx's own resolver. A regression checks SQL, order, checksums and transaction flags. Ten packages leave Cargo.lock, no packages or versions are added, and cargo audit now runs without advisory exclusions. CI rejects reintroducing the multi-driver facade or SQLite/MySQL drivers.

Media banners retain the rich HTML path, including images, collages and URL buttons. Tests verify that the captured three-image banner survives preparation and durable enqueueing. A synthetic live API response contained three images and two buttons; two test image URLs returned HTTP 403 from the application host. No Telegram test message was sent.

Validation:

• cargo fmt --all -- --check: passed.
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings: passed.
• cargo test --locked --workspace: 2,697 passed, 10 ignored.
• With disposable PostgreSQL 17/pgvector: cargo test --locked -p openplotva-storage -- --test-threads=1: 186 passed, 1 ignored; includes entity field/flatten/default compatibility and embedded migration metadata.
• With the same database: cargo test --locked -p openplotva-app gradius -- --test-threads=1: 42 passed.
• bash tools/rust-dependency-gate.sh: passed with plain cargo audit, unchanged advisory policy, and no ignored advisories.
• python3 -m unittest discover -s tools/tests -v: 12 passed.

Deployment risk and verification: migration SQL, Compose assets, deployment scripts and the protected deployment contract are unchanged. Row decoding and migration embedding are the main compatibility risks; real PostgreSQL tests cover both. Deploy with advertising disabled, verify the running revision and database readiness, then restore the previously enabled placement switches. Check new audit records for non-private destinations. Reverting to an older image without the restriction requires disabling advertising first.

[github-actions]

	Warnings
⚠️	Production deploy workflow/assets changed; include an explicit deployment-risk note and verification plan.
⚠️	Large PR (1118 changed lines). Consider splitting unless this is generated/mechanical.

	Messages
📖	Danger checked 56 changed file(s).

Generated by 🚫 dangerJS against 0d857fd

[iamwavecut]

Addressed the deployment-risk warning in the PR description. The only deploy/production/ change is README documentation. Deployment scripts, Compose assets, migrations and the protected deployment contract are unchanged. The verification plan keeps advertising disabled until the private-chat restriction is installed and the running revision is verified.

[iamwavecut]

The larger diff is split into two commits: the private-chat advertising policy, then PostgreSQL-only SQLx dependencies. Most additional runtime files only redirect imports to the storage boundary. The substantive dependency changes are seven explicit row mappings and migration embedding through SQLx's existing resolver. PostgreSQL tests cover renamed/flattened fields, missing-column defaults, rejected row shapes and migration metadata. The deployment-risk plan is in the current description. Migration SQL, runtime schemas, Compose assets and deployment scripts are unchanged.