fix(db): enforce global nullpool session budget

apps/api/tests/test_executor_trust_boundary_readback.py

@@ -92,6 +92,7 @@ def _verified_receipt(source_sha: str = "abc123") -> dict[str, str]:
         "representative_db_preflights_verified": "true",
         "api_http_concurrency_probe_passed": "true",
         "api_database_null_pool": "true",
+        "api_database_null_pool_concurrency_limit": "2",
         "worker_database_null_pool": "true",
         "broker_database_null_pool": "true",
         "api_monolithic_secret_env_from_absent": "true",
@@ -128,6 +129,9 @@ def test_executor_trust_boundary_requires_live_controls_and_matching_source() ->
     assert database_boundary["controls"][
         "representative_db_preflights_verified"
     ] is True
+    assert database_boundary["controls"][
+        "api_null_pool_concurrency_limit_verified"
+    ] is True
     assert database_boundary["secret_values_read"] is False
     assert database_boundary["role_names_exposed"] is False
     assert database_boundary["signal_freshness"]["fresh"] is True
@@ -361,6 +365,23 @@ def test_executor_trust_boundary_requires_live_connection_headroom() -> None:
     )
 
 
+def test_executor_trust_boundary_requires_api_null_pool_concurrency_cap() -> None:
+    receipt = _verified_receipt()
+    receipt["api_database_null_pool_concurrency_limit"] = "0"
+
+    readback = build_executor_trust_boundary_readback(
+        receipt,
+        deployed_source_sha="abc123",
+    )
+
+    database_boundary = readback["database_identity_boundary"]
+    assert readback["full_workload_boundary_verified"] is False
+    assert database_boundary["connection_budget_verified"] is False
+    assert "api_null_pool_concurrency_limit_not_verified" in (
+        database_boundary["active_blockers"]
+    )
+
+
 def test_executor_trust_boundary_binds_budget_and_verifier_contract() -> None:
     wrong_budget = _verified_receipt()
     wrong_budget["worker_required_connection_budget"] = "4"