docs(architecture): ADR-008 — trait size probe, fleet GC, fs-tier engines; requirements anchor

- requirements.md (new): the three use cases pinned as REQ-1..4 with
  the node/pool/fleet/engine vocabulary defined once — ends per-session
  re-derivation of consumer facts. REQ-2 (replicator fleet over one
  shared pg pool, incl. large-blob serving) is recorded as a planning
  fact predating all POCs, on the operator's authority.
- ADR-008: Backend trait gains size(key) length probe (before any
  backend ships data — ADR-002 one-way-door discipline); fleet GC
  mechanism (DB-backed pin rows committed atomically with entries,
  TTL+renewal semantics, liveness = embedder-owned table, protect
  callback is single-node-only, advisory-locked single sweeper,
  staged re-arbitrated delete window on both engines); fs tier becomes
  engine-selectable (local default; pg-lo named candidate) with the
  fleet locality contract (shared media or re-routing; mixed tiers are
  a documented deployment invariant, not a constructor-provable one).
- poc-pglo-spec.md (new): POC #7 spec — pg Large Objects as the fs
  tier's pg-lo engine; instruments, decision gate, registered in
  phase-0.md OQ-BL-06.
- ADR-003/005 status amendments point to ADR-008's extensions; specs
  ripple (backends/store-api/gc/ops/overview/README).
- open-questions.md: deferral-policy header gains the decisions-vs-
  sequenced-work distinction; pg-lo's why-not-parked audit trail
  recorded.
- research fixes: postgres POC renumbered #4->#5 to the canonical
  register (phase-0 OQ-BL-06), redb cross-refs fixed, thinking-
  artifact sentence in B1 replaced with the honest reading.

Verification: docs-only change; reference-integrity sweep across the
tree (ADR/REQ/POC refs resolve); architecture-reviewer pass on the
delta — original 3 criticals addressed, its follow-up (fleet liveness
form, pin TTL, staged-delete semantics, enforceability, shared-media
caveats) fixed in this commit.

docs/architecture/README.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-02
+last_updated: 2026-10-03
 ---
 
 # alkblobs — Architecture
@@ -36,12 +36,24 @@ there — not inherited as hedges:
   (POCs #3/#5/#6); the would-be "deployment trigger" framing was caught
   at review as circular hedging (a deployment running alkblobs cannot
   pre-exist the engine) and closed on the OQ-09 precedent.
+- **ADR-008** (2026-10-03) repairs the seams ADR-007 stressed, against
+  the pinned consumer requirement REQ-2 (requirements.md — a replicator
+  node may run a **fleet** of store instances sharing one pg pool, a
+  planning fact predating all POCs): the `Backend` trait gains a
+  `size` probe (before any backend ships data); fleet GC gets
+  DB-backed pins, an advisory-locked single sweeper, and SQL-level
+  delete arbitration (single-node postures unchanged); and the fs tier
+  becomes engine-selectable (`local` default; `pg-lo` named candidate,
+  admission-gated on POC #7). It also adds
+  [requirements.md](requirements.md) — the REQ anchor that ends
+  per-session re-derivation of consumer facts.
 
 ## Architecture Documents
 
 | Document | Scope | Status |
 |---|---|---|
 | [overview.md](overview.md) | Purpose, consumers, layer map, dependency posture | draft |
+| [requirements.md](requirements.md) | Consumer requirements REQ-1..4, node/pool/fleet vocabulary | draft |
 | [hashing-and-keys.md](hashing-and-keys.md) | Canonical hash, key encoding (the one-way door) | draft |
 | [store-api.md](store-api.md) | Store facade: put/get/stat/range/pin/batch/sweep surface, errors, invariants | draft |
 | [backends-and-dispatch.md](backends-and-dispatch.md) | Backend trait contract, shipped backends, size-threshold dispatch | draft |
@@ -60,6 +72,7 @@ there — not inherited as hedges:
 | [005](decisions/005-pooled-cas-and-gc-mechanism.md) | Pooled CAS, liveness seams, mark-and-sweep, delete windows | Accepted |
 | [006](decisions/006-verification-posture-and-transfer-encoding.md) | Whole-blob verification; transfer encoding excluded by scoping | Accepted |
 | [007](decisions/007-two-kv-engines-sqlite-and-postgres.md) | Two kv engines (sqlite + postgres) behind one trait; constructor-selected | Accepted |
+| [008](decisions/008-trait-size-probe-fleet-gc-and-fs-engines.md) | Trait `size` probe; fleet GC (DB-backed pins, advisory-locked sweeper); fs-tier engines | Accepted |
 
 ## Open Questions
 
@@ -68,7 +81,11 @@ Tracked in [open-questions.md](open-questions.md). The Phase 0 register
 remain parked — OQ-07/OQ-08 externally-owned (alkgit seam mapping,
 alkfs intake; carried for visibility, gating nothing here). OQ-09
 (namespace-visibility default) resolved closed-by-default; OQ-10
-(second kv engine) resolved by ADR-007. **Deferral
+(second kv engine) resolved by ADR-007. The pg-lo fs-engine question
+resolved to *sequenced work*, not a parked question: REQ-2/ADR-008
+named it the candidate fs-tier engine and POC #7
+(`docs/research/poc-pglo-spec.md`) is its admission evidence — a task,
+not a wait. **Deferral
 policy (the "Schrödinger's code" rule):** a *decision this crate needs
 before shipping* may not be deferred on a dependency that is itself
 waiting for this crate to exist. Two parking kinds remain legitimate: