docs(architecture): ADR-012 — pre-decomposition consistency rulings; tree verified single-valued

Full-tree review before task decomposition found five composition
defects (mechanisms specced correctly in isolation, composition
unruled) and a set of caller-facing gaps. ADR-012 rules each:

- Sweeps are never errors: aborts are GcAbortCause report data in
  Ok(SweepReport) (ProtectFailed / SweeperLock / NoLivenessSources);
  GcAborted retired from the error enum; direct-delete refusal is
  the GcRefuse error covering the full protection set
- Pin token gains its wire shape: blobs/put response {token, digest};
  blobs/have's token-renewal form (one digest + token); token
  validity domain = the minting serving node, process-lifetime
  mapping
- Fleet mode is an explicit constructor declaration (fleet: true),
  never inferred from engine choice
- All fleet GC state hosts on the fleet's kv engine (postgres) — one
  arbitration domain; large=pg-lo fleet nodes required onto the same
  pg instance (composite predicate's new clause); large=local fleet
  puts pin-row-first, publish-second
- Engine-state seam reduced: sqlite pin/sweep-lock bodies dropped
  (dead machinery); non-SQL engines stage delete-window candidates
  in-process; one-window-host rule per instance
- Facade clarifications: fall-through for all key-addressed ops,
  kv-only put-time rejection, mem+local dual-tier valid, error-model
  member/return-shape ruling (trait/facade family split), has ->
  bool, PinState variants, fleet liveness-table registration form,
  window executor = the next sweep

Alignment edits across all specs and ADR-005/008/009/010/011
(bracketed corrections per the established pattern); OQ-11 (pg-only-kv
feature graph) added to the parked index for auditability.

Verification: two independent review passes; all findings resolved;
verdict READY for task decomposition.

docs/architecture/overview.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-03 (ADR-010/011 — I/O seams pinned; vocabulary fs→large, mem joins kv)
+last_updated: 2026-10-03 (ADR-012 — OQ-11 parking reference; ADR-012 row added)
 ---
 
 # Overview
@@ -65,7 +65,8 @@ or three times.
 │   hashing & keys (ADR-002) · put/get/stat/range/pin seams  │
 │   mark-and-sweep GC + liveness registration (ADR-005)      │
 │   size-threshold dispatch (ADR-003); GC state owned        │
-│   here, hosted by SQL engines via the seam (ADR-010)       │
+│   here; fleet state hosts on the fleet's kv engine         │
+│   via the seam (ADR-010/012)                               │
 └───────┬───────────────────┬───────────────────────────────┘
         ▼                   ▼
 ┌──────────────────────┐  ┌─────────────────────────────────┐
@@ -105,7 +106,8 @@ optimizes for — feature-graph work for it is deferred until a named
 requirement exists (the base `kv` feature pulling rusqlite is the
 accepted v1 shape; convention 8's lean-base principle applies to
 *default* builds, which stay lean since `kv` is what the feature model
-controls, not what default-on means downstream). Wasm: the tier
+controls, not what default-on means downstream; tracked as OQ-11 in
+open-questions.md's parked index). Wasm: the tier
 engines are not a wasm story; a wasm client is a consumer of the `ops`
 surface (which rides alkcall, itself wasm-clean), never an in-process
 embedder (ADR-001 §Consequences).
@@ -139,6 +141,7 @@ embedder (ADR-001 §Consequences).
 | [008](decisions/008-trait-size-probe-fleet-gc-and-large-engines.md) | `size` probe + fleet GC + large-tier engines | trait length probe; fleet pins/sweeps engine-backed; the large tier (now `large`) engine-selectable |
 | [009](decisions/009-pg-lo-large-tier-engine.md) | pg-lo large engine | postgres Large Objects as the large tier's second engine, admitted on POC #7; a fleet node can run postgres-only |
 | [010](decisions/010-backend-io-seams-and-fleet-state-home.md) | I/O seams + GC-state home | read cursor / staged put; store-core-owned GC state via the engine-state seam; kv fleet-validity rule; pin-token renewal |
+| [012](decisions/012-pre-decomposition-consistency-rulings.md) | Sweep-abort shape + composition rulings | sweeps never error (`GcAborted` retired, `GcRefuse` for direct-delete); token wire shape; fleet mode = constructor declaration; GC state hosts on the kv engine; sqlite seam reduction |
 | [011](decisions/011-vocabulary-tiers-engines-and-fleet-state.md) | Vocabulary + rename | tier/engine/instance/node/fleet pinned; mem joins the kv tier; large tier renamed `large`; constructor modes |
 
 ## Open Questions
@@ -154,6 +157,8 @@ crate level:
   open-read requirement)
 - **OQ-10**: second kv engine — resolved by ADR-007 (sqlite + postgres
   shipped behind one trait; per-node constructor choice)
+- **OQ-11**: pg-only kv node feature graph — deferred(scope), parked
+  (see [open-questions.md](open-questions.md))
 - **POC #7** (`docs/research/poc-pglo-findings.md`): pg Large Objects
   as the large tier's `pg-lo` engine — **passed** 2026-10-03; admitted as
   a shipped engine by ADR-009 (REQ-2's consolidation option)