@@ -19,6 +19,7 @@
 import sys
 import time
 import uuid
+from urllib.parse import unquote, urlsplit, urlunsplit
 
 from . import codec, legacy_import as legacy, scan_pacing
 from .embedding_spool import MAX_DIMS, MAX_SPOOL_BYTES, write_spool
@@ -748,6 +749,65 @@ def specification(bundle, report_ids):
         seed=0, config=config, mode='full', memory_bytes=4294967296, work_units=1), inputs=[], max_attempts=3)])
 
 
+# libpq TLS policy parameters the Rust job daemon does NOT reproduce. Its transport
+# verifies the server with verify-full against POLIS_JOBS_CA_FILE plus a hostname and
+# exact host-allowlist check and a TLS 1.2 floor (queue-rs jobs/transport.rs), but it
+# loads no CRL, no client identity, no GSS policy and no requested min/max protocol
+# version. Silently dropping one of these would hand the daemon a weaker policy than
+# the import's own connection uses, so the importer refuses a queue URL that carries
+# one rather than quietly change it. `sslmode`/`sslrootcert` are handled separately
+# (removed, because the daemon reproduces exactly what they ask for); `sslnegotiation`
+# is left in place, since the pinned tokio-postgres parser accepts and applies it.
+_DAEMON_UNREPRODUCED_TLS_PARAMS = frozenset({
+    'sslcert', 'sslkey', 'sslpassword', 'sslcrl', 'sslcrldir',
+    'sslcompression', 'sslsni', 'sslcertmode', 'sslkeylogfile',
+    'ssl_min_protocol_version', 'ssl_max_protocol_version',
+    'requiressl', 'gssencmode', 'gsslib', 'krbsrvname',
+})
+
+
+def _daemon_queue_url(dsn):
+    """The queue DSN the Rust daemon can parse. Production always uses the URL form
+    (postgresql://...), which is the only form supported here; a keyword/value DSN is
+    refused rather than rewritten, because its grammar (quoting, escapes, spaces around
+    `=`) cannot be edited safely by token splitting. Only the two libpq TLS parameters
+    the daemon reproduces from its own configuration are removed -- `sslmode` (verify-
+    full or require) and `sslrootcert`, replaced by its verify-full CA/hostname/allowlist
+    checks. Any other libpq TLS policy parameter the daemon does not reproduce is
+    refused, not dropped. Every surviving span (user, the percent-encoded password,
+    host, port, dbname and each kept query token) is preserved byte for byte; only
+    parameter names and the `sslmode` value are percent-decoded for comparison, matching
+    how tokio-postgres reads keys, and nothing is re-encoded. The result still carries
+    the password: never log it."""
+    if not dsn.startswith(('postgresql://', 'postgres://')):
+        raise ValueError('queue database URL must be a postgresql:// URL')
+    # urlsplit silently deletes a raw tab, newline or carriage return (even inside the
+    # password or a retained value) and treats a raw '#' as the start of a fragment,
+    # which would hide query parameters from the checks below. libpq reads all four as
+    # ordinary bytes, so a caller must percent-encode them (%09/%0A/%0D/%23); the
+    # encoded forms are passed through and preserved. Refuse the raw bytes instead of
+    # handing the daemon a different password or a dropped parameter.
+    if any(ch in dsn for ch in '\t\n\r#'):
+        raise ValueError('queue database URL must percent-encode tab, newline, carriage return and #')
+    parts = urlsplit(dsn)
+    kept = []
+    for token in parts.query.split('&'):
+        if not token:
+            continue
+        raw_key, _, raw_value = token.partition('=')
+        key = unquote(raw_key).lower()
+        if key == 'sslmode':
+            if unquote(raw_value).lower() in ('verify-full', 'require'):
+                continue  # the daemon forces its own verified TLS instead
+            raise ValueError('unexpected sslmode in queue database URL')
+        if key == 'sslrootcert':
+            continue  # reproduced by POLIS_JOBS_CA_FILE
+        if key in _DAEMON_UNREPRODUCED_TLS_PARAMS:
+            raise ValueError('queue database URL carries a TLS policy parameter the daemon does not reproduce')
+        kept.append(token)
+    return urlunsplit(parts._replace(query='&'.join(kept)))
+
+
 def import_all(bundles, reports, environment, timeout, scope):
     """Run the actual daemon in a dedicated import environment; never publish."""
     import psycopg2
@@ -758,9 +818,17 @@ def import_all(bundles, reports, environment, timeout, scope):
         raise ValueError('invalid import scope')
     dsn = os.environ['QUEUE_DATABASE_URL']
     from psycopg2.extensions import parse_dsn
-    if os.environ.get('POLIS_JOBS_TRANSPORT', 'tls') != 'loopback' and parse_dsn(dsn).get('sslmode') != 'verify-full':
+    transport = os.environ.get('POLIS_JOBS_TRANSPORT', 'tls')
+    if transport != 'loopback' and parse_dsn(dsn).get('sslmode') != 'verify-full':
         raise ValueError('verified queue database TLS required')
-    worker_env = {**os.environ, 'QUEUE_ENV': environment, 'POLIS_JOBS_ENABLED': '1',
+    # The daemon parses QUEUE_DATABASE_URL with tokio-postgres, which cannot read the
+    # libpq verify-full/sslrootcert parameters this import requires. Under tls it
+    # verifies the server from its own POLIS_JOBS_* configuration, so hand it the same
+    # URL with exactly those two parameters removed (and any TLS policy parameter it
+    # cannot reproduce refused). Other transports keep the DSN as-is.
+    queue_url = _daemon_queue_url(dsn) if transport == 'tls' else dsn
+    worker_env = {**os.environ, 'QUEUE_DATABASE_URL': queue_url,
+                  'QUEUE_ENV': environment, 'POLIS_JOBS_ENABLED': '1',
                   'POLIS_JOBS_WORKER_CLASS': 'delphi', 'POLIS_JOBS_STAGES': 'graph_narrative',
                   'POLIS_JOBS_PYTHON': sys.executable, 'DELPHI_APP_PATH': '/app',
                   'POLIS_JOBS_WORK_DIR': '/import/work', 'POLIS_JOBS_JOURNAL_DIR': '/import/journal'}
 
@@ -67,8 +67,12 @@
     'source identity mapping changed',
     'source key schema mismatch',
     'source table disappeared during scan',
+    'queue database URL carries a TLS policy parameter the daemon does not reproduce',
+    'queue database URL must be a postgresql:// URL',
+    'queue database URL must percent-encode tab, newline, carriage return and #',
     'unapproved missing source table',
     'unexpected published import',
+    'unexpected sslmode in queue database URL',
     'unquarantined source row',
     'verified queue database TLS required',
     'verified source database TLS required',
 
@@ -361,3 +361,168 @@ def test_flag_off_materialize_is_unchanged(tmp_path):
     assert 'embeddings_table' not in manifest and 'embeddings' not in manifest
     assert manifest['families'][FAMILY]['rows'] == 2
     assert codec.decode_family((tmp_path/'off'/plain[0]['digest']/(FAMILY+'.jsonl')).read_bytes())[1] == rows
+
+
+def test_daemon_queue_url_strips_only_libpq_tls_params():
+    """The exact production QUEUE_DATABASE_URL shape: import_worker login, verify-full
+    and a pinned CA bundle. The daemon DSN drops only the libpq TLS parameters the
+    Rust parser rejects and keeps the user, password, host, port and dbname."""
+    from psycopg2.extensions import parse_dsn
+    # 44-char password, letters+digits only (the genpw alphabet, URL-safe with no encoding).
+    password = ('aZ09' * 11)
+    dsn = ('postgresql://import_worker:%s@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem' % password)
+    derived = imp._daemon_queue_url(dsn)
+    assert 'sslmode' not in derived and 'sslrootcert' not in derived
+    # Every stripped parameter is gone; everything else is byte-for-byte unchanged.
+    assert derived == 'postgresql://import_worker:%s@db.example.internal:5432/polis' % password
+    parsed = parse_dsn(derived)
+    assert parsed['user'] == 'import_worker' and parsed['password'] == password
+    assert parsed['host'] == 'db.example.internal' and parsed['port'] == '5432'
+    assert parsed['dbname'] == 'polis'
+    assert 'sslmode' not in parsed and 'sslrootcert' not in parsed
+
+
+def test_daemon_queue_url_preserves_percent_encoding_and_other_params():
+    """A percent-encoded password byte and a non-TLS parameter tokio-postgres accepts
+    survive unchanged; only the TLS keys are dropped."""
+    from psycopg2.extensions import parse_dsn
+    dsn = ('postgresql://import_worker:p%40ss%2Fword@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem'
+           '&application_name=import&connect_timeout=10')
+    derived = imp._daemon_queue_url(dsn)
+    assert derived == ('postgresql://import_worker:p%40ss%2Fword@db.example.internal:5432/polis'
+                       '?application_name=import&connect_timeout=10')
+    parsed = parse_dsn(derived)
+    assert parsed['password'] == 'p@ss/word'  # the percent-encoding round-trips
+    assert parsed['application_name'] == 'import' and parsed['connect_timeout'] == '10'
+
+
+def test_daemon_queue_url_odd_password_in_url_form_is_byte_preserved():
+    """An odd password in URL form (percent-encoded quotes, spaces and reserved bytes)
+    is kept byte for byte; only the TLS keys are dropped."""
+    from psycopg2.extensions import parse_dsn
+    # Encodes the literal password:  'a b'@=&/
+    encoded = "%27a%20b%27%40%3D%26%2F"
+    dsn = ('postgresql://import_worker:%s@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem' % encoded)
+    derived = imp._daemon_queue_url(dsn)
+    assert derived == 'postgresql://import_worker:%s@db.example.internal:5432/polis' % encoded
+    # The userinfo bytes were never decoded or re-encoded; libpq recovers the original.
+    assert parse_dsn(derived)['password'] == "'a b'@=&/"
+
+
+def test_daemon_queue_url_recognizes_percent_encoded_tls_keys():
+    """tokio-postgres percent-decodes parameter names, so an encoded sslmode/sslrootcert
+    key must be recognized and stripped, not passed through as an unknown name."""
+    # ssl%6Dode -> sslmode ; sslroot%63ert -> sslrootcert
+    dsn = ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+           '?ssl%6Dode=verify-full&sslroot%63ert=/ca/global-bundle.pem&application_name=import')
+    derived = imp._daemon_queue_url(dsn)
+    assert derived == ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+                       '?application_name=import')
+
+
+def test_daemon_queue_url_drops_duplicate_tls_params_keeps_tls_text_in_values():
+    """Repeated TLS keys are all removed; a non-TLS value that merely looks like a TLS
+    parameter (even percent-encoded) is left untouched."""
+    dsn = ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/a.pem&sslrootcert=/ca/b.pem'
+           '&application_name=sslmode%3Dverify-full')
+    derived = imp._daemon_queue_url(dsn)
+    assert derived == ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+                       '?application_name=sslmode%3Dverify-full')
+
+
+def test_daemon_queue_url_preserves_sslnegotiation():
+    """sslnegotiation is accepted and applied by the pinned tokio-postgres parser, so it
+    is preserved rather than stripped under the 'remove only what the daemon reproduces'
+    contract."""
+    dsn = ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem&sslnegotiation=direct')
+    derived = imp._daemon_queue_url(dsn)
+    assert derived == ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+                       '?sslnegotiation=direct')
+
+
+@pytest.mark.parametrize('dsn', [
+    'host=db.example.internal port=5432 user=import_worker dbname=polis sslmode=verify-full',
+    "host=db.example.internal user=import_worker password='a b' sslmode=verify-full",
+    'user=import_worker dbname=polis sslmode = verify-full sslrootcert = /ca/global-bundle.pem',
+])
+def test_daemon_queue_url_refuses_keyword_dsns(dsn):
+    """Keyword/value DSNs are refused, not rewritten: their grammar cannot be edited
+    safely by token splitting, and production never uses them."""
+    with pytest.raises(ValueError, match='postgresql'):
+        imp._daemon_queue_url(dsn)
+
+
+@pytest.mark.parametrize('param', [
+    'sslcrl=/ca/revoked.pem',
+    'sslcrldir=/ca/crls',
+    'ssl_min_protocol_version=TLSv1.3',
+    'ssl_max_protocol_version=TLSv1.3',
+    'sslcert=/ca/client.pem',
+    'sslkey=/ca/client.key',
+    'sslpassword=secret',
+    'gssencmode=require',
+    'sslcompression=1',
+    'ssl_%6Din_protocol_version=TLSv1.3',  # encoded 'm' -> ssl_min_protocol_version
+])
+def test_daemon_queue_url_refuses_unreproduced_tls_params(param):
+    """A TLS policy parameter the daemon does not reproduce is refused, never silently
+    dropped (which would hand the daemon a weaker policy than the import requires)."""
+    dsn = ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem&' + param)
+    with pytest.raises(ValueError, match='does not reproduce'):
+        imp._daemon_queue_url(dsn)
+
+
+@pytest.mark.parametrize('raw', ['\t', '\n', '\r', '#'], ids=['tab', 'lf', 'cr', 'hash'])
+def test_daemon_queue_url_refuses_raw_tab_newline_cr_and_hash_in_password(raw):
+    """urlsplit deletes a raw tab/newline/CR and treats a raw '#' as a fragment start,
+    either of which would change the password libpq sees. Refuse the raw byte and make
+    the caller percent-encode it."""
+    dsn = ('postgresql://import_worker:a' + raw + 'b@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem')
+    with pytest.raises(ValueError, match='percent-encode'):
+        imp._daemon_queue_url(dsn)
+
+
+def test_daemon_queue_url_refuses_raw_hash_that_would_hide_a_policy_param():
+    """A raw '#' in a query value would push the parameters after it into urlsplit's
+    fragment, bypassing the TLS-policy refusal below. Refuse it."""
+    dsn = ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem'
+           '&application_name=a#b&ssl_min_protocol_version=TLSv1.3')
+    with pytest.raises(ValueError, match='percent-encode'):
+        imp._daemon_queue_url(dsn)
+
+
+@pytest.mark.parametrize('raw', ['\t', '\n', '\r'], ids=['tab', 'lf', 'cr'])
+def test_daemon_queue_url_refuses_raw_whitespace_in_a_retained_value(raw):
+    """The same raw-byte refusal applies to a retained (non-TLS) query value, not only
+    the password."""
+    dsn = ('postgresql://import_worker:pw@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem'
+           '&application_name=a' + raw + 'b')
+    with pytest.raises(ValueError, match='percent-encode'):
+        imp._daemon_queue_url(dsn)
+
+
+def test_daemon_queue_url_preserves_percent_encoded_control_bytes():
+    """The percent-encoded counterparts (%09 tab, %0A LF, %0D CR, %23 '#') pass through
+    untouched in both the password and a retained value, and libpq recovers the literal
+    bytes."""
+    from psycopg2.extensions import parse_dsn
+    pw = 'a%09b%0Ac%0Dd%23e'          # tab, LF, CR, '#'
+    appname = 'x%09y%23z'
+    dsn = ('postgresql://import_worker:' + pw + '@db.example.internal:5432/polis'
+           '?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem'
+           '&application_name=' + appname)
+    derived = imp._daemon_queue_url(dsn)
+    assert derived == ('postgresql://import_worker:' + pw + '@db.example.internal:5432/polis'
+                       '?application_name=' + appname)
+    parsed = parse_dsn(derived)
+    assert parsed['password'] == 'a\tb\nc\rd#e'
+    assert parsed['application_name'] == 'x\ty#z'
@@ -200,4 +200,27 @@ mod tests {
         assert!(parse("postgresql://u@127.0.0.1/d", &TransportKind::Local).is_err());
         assert!(parse("host=relative/dir user=u", &TransportKind::Local).is_err());
     }
+
+    #[test]
+    fn tls_accepts_the_importer_derived_dsn_and_rejects_the_libpq_tls_form() {
+        // The production queue login reaches the database with libpq verify-full and a
+        // pinned CA bundle; the importer hands this parser the same DSN with those two
+        // parameters stripped, because the daemon verifies the server itself.
+        let kind = TransportKind::Tls {
+            ca_file: "/ca/global-bundle.pem".into(),
+            host_allowlist: vec!["db.example.internal".into()],
+        };
+        let derived = "postgresql://import_worker:aZ09aZ09aZ09@db.example.internal:5432/polis";
+        let config = parse(derived, &kind);
+        // It parses, the host is allowed, and TLS is still demanded (verification is
+        // done by the TLS connector, built-in roots off).
+        assert!(matches!(
+            config.map(|c| c.get_ssl_mode()),
+            Ok(SslMode::Require)
+        ));
+        // The original libpq form is what tokio-postgres cannot read: it is refused.
+        let original = "postgresql://import_worker:aZ09aZ09aZ09@db.example.internal:5432/polis\
+                        ?sslmode=verify-full&sslrootcert=/ca/global-bundle.pem";
+        assert!(parse(original, &kind).is_err());
+    }
 }