docs(architecture): ADR-012 — pre-decomposition consistency rulings; tree verified single-valued

Full-tree review before task decomposition found five composition
defects (mechanisms specced correctly in isolation, composition
unruled) and a set of caller-facing gaps. ADR-012 rules each:

- Sweeps are never errors: aborts are GcAbortCause report data in
  Ok(SweepReport) (ProtectFailed / SweeperLock / NoLivenessSources);
  GcAborted retired from the error enum; direct-delete refusal is
  the GcRefuse error covering the full protection set
- Pin token gains its wire shape: blobs/put response {token, digest};
  blobs/have's token-renewal form (one digest + token); token
  validity domain = the minting serving node, process-lifetime
  mapping
- Fleet mode is an explicit constructor declaration (fleet: true),
  never inferred from engine choice
- All fleet GC state hosts on the fleet's kv engine (postgres) — one
  arbitration domain; large=pg-lo fleet nodes required onto the same
  pg instance (composite predicate's new clause); large=local fleet
  puts pin-row-first, publish-second
- Engine-state seam reduced: sqlite pin/sweep-lock bodies dropped
  (dead machinery); non-SQL engines stage delete-window candidates
  in-process; one-window-host rule per instance
- Facade clarifications: fall-through for all key-addressed ops,
  kv-only put-time rejection, mem+local dual-tier valid, error-model
  member/return-shape ruling (trait/facade family split), has ->
  bool, PinState variants, fleet liveness-table registration form,
  window executor = the next sweep

Alignment edits across all specs and ADR-005/008/009/010/011
(bracketed corrections per the established pattern); OQ-11 (pg-only-kv
feature graph) added to the parked index for auditability.

Verification: two independent review passes; all findings resolved;
verdict READY for task decomposition.

docs/architecture/open-questions.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-03
+last_updated: 2026-10-03 (ADR-012 round — no new OQs; overview's pg-only-kv feature-graph deferral recorded in the parked index)
 ---
 
 # Open Questions
@@ -47,8 +47,9 @@ is pending; deferral policy applies to decisions, not to work.
 
 **Index of active OQs:** OQ-07, OQ-08 (externally-owned, carried
 for visibility). OQ-09 and OQ-10 are resolved (recorded below).
-Promoted Phase 0 questions OQ-BL-01..06 are recorded here with their
-resolutions for traceability.
+OQ-11 (deferred(scope), parked index) records a feature-graph
+deferral. Promoted Phase 0 questions OQ-BL-01..06 are recorded here
+with their resolutions for traceability.
 
 ---
 
@@ -236,6 +237,17 @@ resolutions for traceability.
 |---|---|---|
 | OQ-07 | externally-owned | alkgit's architecture process (answerable on paper anytime; gates nothing here) |
 | OQ-08 | externally-owned | alkfs Phase 0 intake |
+| OQ-11 | deferred(scope) | a named deployment requirement for a pg-only kv node (postgres kv engine without rusqlite in the build) — overview.md's feature-graph note |
+
+OQ-11 records [overview.md](overview.md)'s dependency-posture deferral
+(a pg-only kv node — the `kv` feature's rusqlite pull decoupled from
+default-on feature graphing) for auditability: the deciding fact is a
+*deployment requirement that arrives from outside this crate*
+(Schrödinger's-code rule compliant — it is not a fact this crate
+creates), the accepted v1 shape (base `kv` feature pulls rusqlite,
+default-on) stands until then, and the deferral is a feature-graph
+work item, not an open architecture decision. No spec or ADR gates on
+it.
 
 OQ-09 was `deferred(scope)` on the first embedded ops deployment — a
 deciding fact that could only exist once the ops module ships, i.e. a