chore: mark US-021 complete and update progress log

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: NathanFlurry

progress.txt

@@ -2730,3 +2730,14 @@ PRD: ralph/kernel-hardening (46 stories)
   - sftp.rename() works through the sandbox with no additional bridge work needed
   - Deterministic payload generation (byte pattern loop) is simpler and more reliable than random data for parity testing
 ---
+
+## 2026-03-19 - US-021
+- Expanded pg-connect fixture with UPDATE, DELETE, and transaction operations
+- Added: UPDATE + SELECT verify, DELETE + SELECT verify (0 rows), BEGIN/ROLLBACK + verify row not inserted, BEGIN/COMMIT + verify row inserted
+- Output JSON now includes insert/update/delete/rollback/commit sections for full parity comparison
+- Files changed: packages/secure-exec/tests/e2e-docker/pg-connect/src/index.js
+- **Learnings for future iterations:**
+  - pg wire protocol for BEGIN/COMMIT/ROLLBACK works through the sandbox net bridge without issues
+  - Parameterized queries ($1, $2) work correctly for UPDATE and DELETE through the sandbox
+  - Transaction state tracking (rollback isolation, commit persistence) passes parity between host and sandbox
+---

scripts/ralph/prd.json

@@ -375,8 +375,8 @@
         "Tests pass"
       ],
       "priority": 21,
-      "passes": false,
-      "notes": "The current fixture only tests CREATE TABLE, INSERT, SELECT, DROP TABLE — missing UPDATE, DELETE, and all transaction semantics. If the sandbox breaks transaction state tracking, nothing catches it."
+      "passes": true,
+      "notes": "Completed. Expanded pg-connect fixture with UPDATE+verify, DELETE+verify, BEGIN/ROLLBACK (verify row not inserted), BEGIN/COMMIT (verify row inserted). All operations pass parity between host and sandbox."
     },
     {
       "id": "US-022",