docs(architecture): ADR-013 — family composition, reactive boundary, sweep lease; OQ-11 resolved

- No sibling (alkstore) dependency in-core; reactivity is
  deployment-layer composition above the facade — cadence stays
  embedder-owned (ADR-005), with alkstore the named substrate for it;
  in-crate notify/scheduler/queues/invalidation hooks are non-goals.
- Fleet sweeper lock pinned as 'named exclusive sweep lease'
  semantics; shipped provider unchanged (pg advisory clause);
  provider swaps are ADR-007-shaped substitution doors.
- Composition contract for downstream ADRs: co-tenancy of CAS/GC
  state + reactive machinery + consumer/liveness tables on one fleet
  host; no-cross-store-atomicity ruled; compensation rests on
  idempotent re-puts, windowed deletes, sweeps-as-report-data.
- OQ-11 resolved (the register's one live circular hedge): engine
  features pull their own driver clusters — sqlite becomes feature
  'sqlite' (default-on, carries rusqlite); 'kv'/'large' tier features
  retired; 'local' ungated; pg-pure builds are supported,
  non-default. Deciding fact already in-tree (REQ-2/ADR-009).
- requirements.md: UC-4/REQ-5 records the composition facts
  (operator record 2026-10-11, corroborated by alkstore's
  consumer-inventory).
- Publish guard stated pre-code: facade ships before publish;
  semver-is-contract from first publish (alkstore ADR-017 discipline).
- Amended accepted ADRs' feature wording (ADR-010 §1, ADR-011 §3/§4,
  ADR-003) with supersession notes; README/overview/open-questions/
  backends/store-api/gc aligned; parked index now empty.

Verification: docs-only round (no Rust surface touched); full-tree
single-value check on the feature graph and sweep-lease wording.
This commit is contained in:
glm-5.3-flash committed 2026-10-11 16:47:22 +00:00
1 parent 7b9d904b8a
commit bee86b0dbd
11 files changed
+433 -64

No files matched your search

+32 -8
View File
@@ -1,6 +1,6 @@
---
status: draft
last_updated: 2026-10-03 (ADR-012 — pre-decomposition consistency rulings: sweep-abort shape, token wire shape, fleet activation, GC-state host)
last_updated: 2026-10-11 (ADR-013 — family composition: no sibling dependency in-core, sweep-lease semantics, co-tenancy/no-cross-store-atomicity rulings, OQ-11 resolved, feature graph re-pinned to engine features)
---
# alkblobs — Architecture
@@ -106,6 +106,25 @@ there — not inherited as hedges:
repaired (pin/sweep-lock bodies dropped; window staging for
non-SQL engines is in-process). The tree is now single-valued on
every implementation-facing signature.
- **ADR-013** (2026-10-11, the composition round): with the sibling
substrate **alkstore** shipped (v0.1.0 — the reactive coordination
crate the first consumers co-deploy), this ADR rules the
composition so nothing waits on anything downstream or upstream:
the core keeps **no alkstore dependency and no reactive machinery**
(notify/scheduler/queues/invalidation hooks are non-goals — cadence
stays embedder-owned per ADR-005, with alkstore the named
deployment-layer substrate for it); the fleet sweeper's
single-flighter is pinned as **named exclusive sweep lease**
semantics (shipped provider: the pg advisory-lock clause — provider
swaps are new-ADR substitution doors); **co-tenancy and
no-cross-store-atomicity** are ruled as the downstream-facing
composition contract (consumer liveness tables co-tenant the fleet
host; compensation rests on idempotent re-puts, windowed deletes,
sweeps-as-report-data); and **OQ-11 is resolved** — engine features
pull their own driver clusters (`sqlite` default-on carrying
rusqlite; `kv`/`large` tier features retired; `local` ungated), so
pg-pure builds are supported non-default configurations. REQ-5
records the composition facts; the parked index is now empty.
## Architecture Documents
@@ -136,17 +155,21 @@ there — not inherited as hedges:
| [010](decisions/010-backend-io-seams-and-fleet-state-home.md) | Backend I/O seams (read cursor, staged put); GC state store-core-owned via the engine-state seam; kv fleet-validity; pin-token renewal | Accepted |
| [012](decisions/012-pre-decomposition-consistency-rulings.md) | Pre-decomposition rulings: sweep aborts are report data (`GcAborted` retired); pin-token wire shape; fleet-mode constructor declaration; GC state hosts on the kv engine; sqlite seam reduction | Accepted |
| [011](decisions/011-vocabulary-tiers-engines-and-fleet-state.md) | Vocabulary: tier/engine/instance/node/fleet; mem joins kv; large tier renamed `large`; constructor modes | Accepted |
| [013](decisions/013-family-composition-reactive-boundary-and-feature-graph.md) | Family composition: no sibling dependency in-core; sweep lease; co-tenancy & no-cross-store-atomicity; OQ-11 resolved (engine features pull own drivers) | Accepted |
## Open Questions
Tracked in [open-questions.md](open-questions.md). The Phase 0 register
(OQ-BL-01..06) is promoted there with its resolutions; three questions
are parked — OQ-07/OQ-08 externally-owned (alkgit seam mapping,
alkfs intake; carried for visibility, gating nothing here) and
OQ-11 `deferred(scope)` (the pg-only-kv feature graph; a named
requirement from outside this crate decides it). OQ-09
(OQ-BL-01..06) is promoted there with its resolutions; two questions
remain externally-owned — OQ-07/OQ-08 (alkgit seam mapping,
alkfs intake; carried for visibility, gating nothing here) — and the
parked index is **empty**: OQ-09
(namespace-visibility default) resolved closed-by-default; OQ-10
(second kv engine) resolved by ADR-007. The pg-lo large-engine question
(second kv engine) resolved by ADR-007; OQ-11 (the pg-only-kv feature
graph, once `deferred(scope)` on a "named deployment requirement from
outside") resolved by ADR-013 §4 — its deciding fact already existed
in-tree (REQ-2's consolidation posture; ADR-009), the caught example
of the circular form. The pg-lo large-engine question
resolved to *sequenced work*, not a parked question: REQ-2/ADR-008
named it the candidate large-tier engine and POC #7
(`docs/research/poc-pglo-spec.md`) was its admission evidence — a
@@ -167,7 +190,8 @@ corollary worth restating, because it recurs: a fact this crate must
create (its own first deployment, its own first consumer) is never a
deciding input — decisions stand on evidence in hand, and future needs
reopen via named requirements, not via waiting. (Corollary
applications so far: OQ-09 and OQ-10 both resolved on it.)
applications so far: OQ-09, OQ-10, and OQ-11 — ADR-013's audit round —
all resolved on it.)
## Lifecycle