docs(architecture): ADR-007 — two kv engines (sqlite + postgres) behind one trait

Dissolve OQ-10's circular "standing offer" framing and record the
engine decision the POC evidence already supported:

- ADR-007 (new): kv tier ships sqlite (default) + postgres (feature
  `postgres`, default-off), constructor-selected per node; records the
  deployment economics (classical kv+fs+relational downstream stack
  collapses to one relational engine + fs), the pg impl contract
  (POC #5 B5 posture deltas), the CI sweep-safety gate under
  --all-features, redb ruled out (POC #6), and posture defaults as
  deferred cost in the ADR-006 pattern
- ADR-003: amended status (engine pin widened by ADR-007); kv entry
  notes the widened engine set
- ADR-004: reconciliation note — the "two backends" count is tiers,
  not engines
- backends-and-dispatch.md: tier≠engine distinction, pg engine
  section, co-tenancy note (same-file consumer writes share sqlite's
  single-writer ceiling), substitution-door precedent
- open-questions.md: OQ-10 resolved-by-ADR-007, with the
  why-this-is-not-Schrödinger's-code record (a deployment running
  alkblobs cannot pre-exist the pg engine — OQ-09 precedent); parked
  index narrowed to OQ-07/OQ-08
- overview.md: layer map + dependency posture reflect the `postgres`
  feature; README.md: ADR-007 in tables + corollary applications
- phase-0.md / pg+redb findings: promotion + supersession notes

Trigger framing survives only as deployment guidance (which engine a
node chooses — topology, not throughput), not as a gate on the crate's
own work.

Verified: cargo test, clippy --all-targets -D warnings, fmt --check.
Docs-only change (Phase 1 architecture); no implementation yet.

docs/architecture/overview.md

@@ -60,7 +60,10 @@ or three times.
 │   size-threshold dispatch (ADR-003)                        │
 └───────┬───────────────────┬───────────────────────────────┘
         ▼                   ▼
-   kv backend           fs backend        (ADR-003: exactly two)
+    kv backend           fs backend        (ADR-003: exactly two tiers;
+        │                                     ADR-007: kv = 2 engines)
+        ▼
+  engine per node: sqlite (default) | postgres (feature "postgres")
 
    transport: none, anywhere. alkgit/alkfs or the embedder dials;
    an alkcall Connection is handed in at the ops boundary.
@@ -71,13 +74,15 @@ or three times.
 | Layer | Dependencies | Notes |
 |---|---|---|
 | base crate (store core + backends) | `tokio`, `thiserror`, `parking_lot`, plus `rusqlite` behind the `kv` feature and nothing behind `fs`/`mem` | no alkcall, no serialization frameworks |
+| `postgres` feature (ADR-007) | adds `tokio-postgres` + `deadpool-postgres` behind the kv tier's second engine, default-off | same `Backend` contract, own sweep-safety CI gate under `--all-features` |
 | `ops` feature | adds `alkcall` (feature-gated, default-off) | JSON op specs + binary channels + `AccessControl`; ADR-001 |
 | consumer crates | depend on alkblobs (and on alkcall directly when they speak ops) | alkgit, alkfs |
 
 Backends are feature-gated; both `kv` and `fs` ship default-on
-(batteries-included, the alkgit feature-model pattern); the `ops`
-feature is default-off. Wasm: the backends are not a wasm story; a wasm
-client is a consumer of the `ops` surface (which rides alkcall, itself
+(batteries-included, the alkgit feature-model pattern); the `kv` tier's
+postgres engine (`postgres`, ADR-007) and the `ops` feature are
+default-off. Wasm: the backends are not a wasm story; a wasm client is a
+consumer of the `ops` surface (which rides alkcall, itself
 wasm-clean), never an in-process embedder (ADR-001 §Consequences).
 
 ## Non-goals (each enforced by an ADR)
@@ -105,6 +110,7 @@ wasm-clean), never an in-process embedder (ADR-001 §Consequences).
 | [004](decisions/004-two-backends-no-third.md) | Two backends, no third | manifest layers are consumer-side |
 | [005](decisions/005-pooled-cas-and-gc-mechanism.md) | Pooled CAS & GC | flat pool, registered liveness, delete windows |
 | [006](decisions/006-verification-posture-and-transfer-encoding.md) | Verification posture | whole-blob verification; chunk trees excluded by scoping |
+| [007](decisions/007-two-kv-engines-sqlite-and-postgres.md) | Two kv engines | sqlite default + postgres behind one trait; one relational engine + fs per node |
 
 ## Open Questions
 
@@ -117,6 +123,8 @@ crate level:
 - **OQ-09**: default namespace visibility in network ops —
   resolved closed-by-default (deny-unlisted; reopen only on a named
   open-read requirement)
+- **OQ-10**: second kv engine — resolved by ADR-007 (sqlite + postgres
+  shipped behind one trait; per-node constructor choice)
 
 ## References