ADR-012: forked-substrate design — contract-blind boundary, fidelity posture, port deltas

Follow-through on OQ-06/ADR-011: pin the fork's structural decisions
(alkstore-substrate as a vendored path-dep crate, contract-blind API
boundary with contract formulas computed engine-side and pinned
equivalent by the contract suite, keep-the-kept-half API fidelity for
cheap cherry-picks, the W-1/W-2/dead-man's-switch/W-4 port deltas
decided per item, bootstrap re-keying off error-string matching, no
rename migration, deliberate upstream tracking).

Consistency sweep across the doc set for the fork: annotate ADR-003/
005/009/010 and core-contract for superseded ownership facts, fix
schedule-storage table naming (ADR-009 §5, queues.md), re-key ADR-010
§6's notifications hygiene to the at-attach cap the fork scope
realizes, add OQ-11 (scaffold-time residue), and complete both ADR
indexes. Independent review: 0 critical, warnings addressed.

docs/architecture/decisions/011-sqlite-substrate-fork.md

@@ -54,17 +54,22 @@ Three facts drive this decision:
 code: fork honker-core at the reference revision
 (`/workspace/honker` @ `f4e53c6`, MIT OR Apache-2.0, provenance
 recorded per AGENTS.md §3) into the alkstore family, ported to the
-family standard (tokio-facing consumers, no comments discipline, panics
-out of library code), re-derived on contract v1 where ADR-010 pinned
-semantics honker's functions don't provide.
+family standard (the discipline deltas — no comments discipline,
+panics out of library code — with tokio-facing consumers at the engine
+seam above; per [ADR-012](012-forked-substrate-design.md) §4 the
+substrate itself stays sync), re-derived on contract v1 where ADR-010
+pinned semantics honker's functions don't provide.
 
 Per-scope (the full register with keeps/re-derivations/drops is
 `docs/research/quality-read-honker-core.md` §6):
 
 - **Inherited near-verbatim:** the PRAGMA/WAL open posture,
   `Writer`, `Readers`, the polling watcher + `SharedUpdateWatcher` +
-  `WatcherDeathGuard` + dead-man's switch (with two port fixes the read
-  named: reconnect backoff, fallible watcher spawn), the
+  `WatcherDeathGuard` + dead-man's switch (with three port deltas the
+  read named / ADR-012 decided: reconnect backoff, fallible watcher
+  spawn, and the dead-man's-switch panic replaced by a deliberate
+  watcher-fatal death — [ADR-012](012-forked-substrate-design.md) §4),
+  the
   `in_savepoint` mutation-discipline machinery, arg-coercion helpers,
   the notify scalar + notifications table (renamed, with engine-
   internal hygiene per ADR-010 §6), streams, locks.
@@ -126,4 +131,7 @@ crate (provenance + license recorded), not re-published.
 - [ADR-001](001-crate-split.md) — packaging (engine crate's
   single-driver substrate).
 - [engine-sqlite.md](../engine-sqlite.md) — the living spec, updated
-  to the forked substrate.
+  to the forked substrate.
+- [ADR-012](012-forked-substrate-design.md) — the fork's design
+  decisions (crate identity, contract-blind boundary, fidelity
+  posture, port deltas, bootstrap machinery, upstream tracking).