ADR-024 — the mem engine adopted as the family's third engine (wave 6; release readiness renumbered to wave 7)

Row-first gate: consumer-inventory.md gains an engine-tier section — the mem-engine need recorded operator-authority, dated 2026-10-10 (wasm32 sandboxing across the alk protocol family + downstream ffi/napi/python-adapter economics; rusqlite/tokio-postgres structurally out on wasm, so mem is the only triad member the sandbox can carry).

ADR-024 (decisions/024-mem-engine.md) pins the decision set: (1) separate `alkstore-mem` crate — discharges and amends ADR-001 §4 (superseded in part: full contract-v1 engine, not an "implementation convenience"; annotation on ADR-001 §4 + Status, class-1 window still open); (2) honest-ephemeral posture — no durability, single-process, ephemeral by design, never fleet-valid (ADR-010 §3's shared-pool predicate fails structurally), riding ADR-016's carriers unchanged (identity + docs + matrix); (3) full contract v1 tier with the asymmetry classification — `PayloadTooLarge` never produced (SQLite arm), no reconnection concept (reconnect-wake/watcher rows absent from mem's per-engine column), receiver close at engine drop, wake coalescing N/A; (4) `MemStore::new()` engine-native constructor — the one documented exception to the open-prose, core-contract.md Store concept amended; shared-instance (two opens → one engine) rejected with the ADR-016 §4-style re-entry gate (consumer-inventory row), register stays closed; (5) wasm32 — compile-clean for wasm32-unknown-unknown plus the suite's mem column green on host under a current-thread runtime flavor are wave-6 acceptance items; on-target suite execution scoped out with a named collapse condition (wasm-bindgen-test adapter crate) — a scope decision, not a pending-client hedge; (6) mem is not a core dev-dependency — core's doc examples stay mock-based, ADR-001 §4's doctest posture declines.

engine-mem.md (draft): the in-process mapping — guarded per-mechanism state (no pool, no schema bootstrap, no forwarder, no spawn_blocking seam), the tx overlay (staged *_tx effects merged atomically at commit; read-your-own-writes easy, drop-=-rollback trivial; wake-at-commit structural — the seam pg needed pg-fix-tx-wake for, mem pins from birth via the existing tx-commit-atomicity rows), ADR-012 §2 third owner of the curve/opts/@every arithmetic (three-way equivalence, ADR-022's StoreFactory reused verbatim — born pinned).

deployment.md: host-semantics row (single-process, ephemeral, never fleet-valid, wasm32-clean), mem connection-budget subsection (none — nothing to budget), durability-knobs row (the honest row is the absence), toolchain row (wasm32 subset + current-thread-clean, acceptance-cited). README/overview: engine-mem.md row, ADR-024 row, family table entry (alkstore-mem, no driver deps), current-state updated to the implementation phase with engine specs' stable statuses reflected.

implementation.md: wave table gains wave 6 (mem engine, depends waves 1 + 5) and renumbers release readiness to wave 7 (fuzzing decision — the one remaining decided-at-implementation deferral — rides wave 7); wave-6 section records the born-pinned posture, acceptance items, the one suite-harness pre-task (past_stamp_sleep blocking sleep → async sleep, review 003's properties.rs:1683 note), and the window riders (review 003 Finding 1: the pg transient-fault seam, MEDIUM, rides wave 6; Findings 2–3 follow their park into wave 7's pre-release); wave-6 review gate defined; Decided points updated (mem discharged, fuzzing renumbered); stale wave-6 references swept across review docs and the landed tasks' notes (release-readiness items renumbered or annotated).

Docs-only change; verified by cross-reference audit (all ADR/OQ/anchor references resolve, residual wave-6 mentions are correct under the new numbering or carry dated annotations).

docs/plans/implementation.md

@@ -1,6 +1,8 @@
 ---
 status: draft
-last_updated: 2026-10-10 (wave 5 implemented and reviewed — review-wave-5 verified the discharge map, stamps, dispositions and green-on-both-engines; engine specs flipped to stable)
+last_updated: 2026-10-10 (ADR-024 — the mem engine adopted as wave 6
+and decomposed-in-place documentation; release readiness renumbered
+to wave 7. Waves 1–5 implemented and reviewed; engine specs stable.)
 ---
 
 # alkstore — Implementation plan
@@ -23,12 +25,14 @@ boundaries.
 ## The waves
 
 Dependency logic in one line: core → (substrate fork ∥ postgres
-engine) → sqlite engine → contract suite → release readiness. The
-substrate fork is contract-blind (ADR-012 §2), so it needs only the
-workspace scaffold from wave 1; the Postgres engine needs only the core
-crate. Waves 2 and 4 are therefore independent of each other and could
-run in either order (or in parallel, if agents are ever available in
-parallel).
+engine) → sqlite engine → contract suite → mem engine → release
+readiness. The substrate fork is contract-blind (ADR-012 §2), so it
+needs only the workspace scaffold from wave 1; the Postgres engine
+needs only the core crate. Waves 2 and 4 are therefore independent of
+each other and could run in either order (or in parallel, if agents
+are ever available in parallel). The mem engine (wave 6) needs the
+core crate plus the finished suite (wave 5) — born pinned, per
+[ADR-024](../architecture/decisions/024-mem-engine.md).
 
 | Wave | Contents | Depends on | Status |
 |---|---|---|---|
@@ -37,7 +41,8 @@ parallel).
 | [3](#wave-3--sqlite-engine) | SQLite engine: connection architecture, re-derived queue ops on contract v1, scheduler/outbox, tx seam, SQLite backlog column | waves 1 + 2 | implemented + reviewed (2026-10-08) |
 | 4 | [Postgres engine](#wave-4--postgres-engine): schema bootstrap, pool/open, listener/forwarder, all mechanisms, tx seam, pg backlog column | wave 1 | implemented + reviewed (2026-10-08) |
 | 5 | [Contract suite](#wave-5--contract-suite): the cross-engine equivalence properties (core-contract.md §Verification backlog), version-stamped per ADR-017 | waves 3 + 4 | implemented + reviewed (2026-10-10) |
-| 6 | Release readiness: crate docs, deployment matrix final pass, README (written last, honestly), publish prep; mem-engine and fuzzing decisions | wave 5 | not yet decomposed |
+| 6 | [Mem engine](#wave-6--mem-engine): separate `alkstore-mem` crate, full contract v1 over in-memory mechanisms (tx overlay, queue/scheduler/streams/locks/wakes), the suite's third factory column (born pinned), wasm32 compile-clean acceptance | waves 1 + 5 | not yet decomposed |
+| 7 | [Release readiness](#wave-7--release-readiness): crate docs, deployment matrix final pass, README (written last, honestly), publish prep; fuzzing decision | wave 6 | not yet decomposed |
 
 ## Wave 1 — Foundations
 
@@ -99,7 +104,7 @@ shaped this wave's task set:
   wiring (the constructor task).
 - **Staying put as ordered**: M-1's retention-failure test and N-5's
   panic probe → wave 5's contract-suite rows; N-1's growth-posture
-  review → wave 6.
+  review → wave 7.
 
 ## Wave 4 — Postgres engine
 
@@ -244,6 +249,79 @@ expected answer, recorded per case); whether the scheduler rows
 demand the pg fire-wake parity the wave-4 fix-batch gate recorded;
 and what the SQLite lock busy-path actually returns under contention.
 
+## Wave 6 — Mem engine
+
+The third engine ([ADR-024](../architecture/decisions/024-mem-engine.md),
+2026-10-10): a separate `alkstore-mem` crate implementing the full
+contract v1 over guarded in-memory mechanisms — the honest-ephemeral
+tier (no durability, single-process, ephemeral by design, never
+fleet-valid), adopted for the wasm/sandbox and downstream-adapter
+economics the consumer inventory's engine-tier row records
+(operator-authority, 2026-10-10 — the row-first gate satisfied before
+this wave was assumed). Release readiness moved to wave 7.
+
+The wave's shape mirrors the engine waves' rhythm: constructor + tx
+overlay → mechanisms in parallel → scheduler/outbox → suite
+integration → review gate. What mem carries: the queue state machine
+(visibility/reclaim/dead-letter/sweep), scheduler boundaries +
+catch-up + leadership (trivially owned single-instance, still run —
+engine-uniform per ADR-009 §4), streams with per-consumer offsets and
+trim, TTL locks, wakes. What it does not carry: no pooling, no schema
+bootstrap, no forwarder, no `spawn_blocking` seam, no reconnection
+concept — the distributed machinery that made wave 4 build-heavy
+doesn't exist here. The wave is estimated at pg-wave scale or
+somewhat smaller.
+
+The load-bearing artifact is the **tx overlay**: `*_tx` effects stage
+in a handle-private overlay; commit merges it atomically and fires
+the overlay's pending wakes; drop discards it — read-your-own-writes
+easy, drop-=-rollback trivial, and *wake-at-commit* structural. That
+last property is the seam review 002 found broken pg-side
+(`pg-fix-tx-wake`); mem gets it pinned from birth by the suite's
+existing tx-commit-atomicity rows.
+
+Born pinned: [ADR-022](decisions/022-contract-suite-layout.md)'s
+`StoreFactory` is reused verbatim as a third factory column wired
+onto already-authored, version-stamped rows — no re-derivation. The
+engine re-owns its own copies of the backoff curve, opts resolution,
+and the `@every` parser ([ADR-012](decisions/012-forked-substrate-design.md)
+§2's one-owner rule, third owner); the suite now pins that arithmetic
+three-way.
+
+**Acceptance items** ([ADR-024](../architecture/decisions/024-mem-engine.md)
+§5): the crate compiles clean for `wasm32-unknown-unknown` (target
+already installed in the dev environment); workspace host gates stay
+green; the suite's mem column passes on the host, run under a
+**current-thread runtime flavor** — the test that keeps internals
+wasm-clean (no `spawn_blocking`, tokio sync + time only). The
+current-thread flavor rides one harness pre-task: the suite's
+`past_stamp_sleep` blocking sleep (review 003's posture note at
+`properties.rs:1683`) becomes an async sleep — the only suite-side
+change the wave carries. Running the suite itself *on* the wasm
+target is scoped out with a named collapse condition (a
+wasm-bindgen-test adapter crate) — a scope decision recorded in
+ADR-024 §5, not a pending-client hedge.
+
+Deliverables beyond code: `engine-mem.md` (the spec — drafted with
+this wave's adoption), the deployment matrix's mem rows (landed with
+ADR-024), and the mem factory's suite wiring.
+
+Riding the window: review 003's Finding 1 (the pg scheduler
+transient-error retry loop, MEDIUM — engine-side, small,
+mem-independent); Findings 2–3 follow their park recommendation into
+wave 7's pre-release pass.
+
+## Wave 7 — Release readiness
+
+The original wave 6, renumbered when the mem engine inserted at wave
+6 ([ADR-024](../architecture/decisions/024-mem-engine.md)): crate
+docs, the deployment matrix final pass (across all three engines now),
+the crate README (written last, honestly), publish prep, N-1's
+growth-posture review — and the **fuzzing decision** (the
+alksocks/alktty/alktunnels pattern), the one remaining
+decided-at-implementation deferral. Decomposes after wave 6's review
+gate, with review 003's Findings 2–3 riding the pre-release pass.
+
 ## Decided points
 
 - **Contract-suite layout — option (a)**: a small internal
@@ -262,11 +340,21 @@ and what the SQLite lock busy-path actually returns under contention.
   (self-hosted Gitea; supply-chain posture). No CI-wiring task exists;
   the merge gates (`cargo test`, `cargo clippy --all-targets --
   -D warnings`, `cargo fmt --check`) are run coordinator-side.
-- **Mem engine** (ADR-001 §4) and **fuzzing adoption** (the
-  alksocks/alktty/alktunnels pattern): both are "decided at
-  implementation" deferrals, recorded here so they surface as explicit
-  decision points in wave 6 (or earlier if the test story demands the
-  mem engine sooner) rather than ambushing a later session.
+- **Mem engine** (ADR-001 §4): **decided 2026-10-10, pre-decomposition
+  ([ADR-024](../architecture/decisions/024-mem-engine.md))** — a
+  separate `alkstore-mem` crate, full contract v1, honest-ephemeral
+  posture, wasm32 compile-clean acceptance; wave 6, with release
+  readiness renumbered to wave 7. The deferral discharged: its
+  collapse condition ("implementation time") was reached early via
+  the consumer pause + the wasm/sandbox motivation, with the row-first
+  gate satisfied by the consumer inventory's engine-tier row
+  (operator-authority, 2026-10-10).
+- **Fuzzing adoption** (the alksocks/alktty/alktunnels pattern):
+  remains the one decided-at-implementation deferral, recorded here
+  so it surfaces as an explicit decision point in wave 7 (per
+  AGENTS.md's no-fuzzing posture, revisit only if a task or ADR
+  introduces it). Renumbered from wave 6 together with the mem
+  decision's move.
 
 ## Review gates
 
@@ -285,6 +373,12 @@ decomposes. Specific gates:
 - **Wave 5 review** — the suite as compatibility instrument: every
   backlog row present, version-stamped, green on both engines; this is
   the gate that flips the engine specs to `stable`.
+- **Wave 6 review** — mem-engine-vs-contract conformance (the
+  born-pinned gate): the suite's third column green on the host, the
+  wasm32 compile gate clean, the current-thread-flavor column run
+  (harness pre-task disposed), the engine's own mechanism tests, and
+  the `engine-mem.md` spec read against the pinned ADR-024 text —
+  the gate that flips the mem spec toward `stable`.
 
 ## Review rounds so far
 
@@ -296,7 +390,7 @@ decomposes. Specific gates:
   `docs/reviews/001-waves-1-2-general-review.md`) — M-1 fixed
   inline (sweep savepoint scope); M-2/N-2/N-4/N-6 resolved as ADR-023
   pre-decomposition; lint removal + suite adds folded into waves 3/5;
-  N-1 recorded for wave 6.
+  N-1 recorded for release readiness (now wave 7).
 - **Wave 3 review gate** (`review-wave-3`) — engine-vs-contract
   conformance code-read clean; two findings fixed inline (the
   `open_writer_connection` boundary move out of `substrate/mod.rs`;