docs: resolve OQ-04 — contract v1 pinned (ADR-008): surface partition, TxHandle-on-handle-trait, Wake/WakeReceiver, reserved __alkstore_ namespace, error taxonomy, engine-crate constructors, locks guarantee row

docs/architecture/open-questions.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-04
+last_updated: 2026-10-05
 ---
 
 # alkstore — Open Questions
@@ -11,10 +11,12 @@ The Phase 0 register's questions (`OQ-ST-01..08` in
 mirror OQ-ST-01..08 one-to-one**, keeping their Phase 0 statuses
 (a resolved register question stays listed here as resolved, with the
 ADR that carries its decision). New Phase 1 questions append from
-OQ-09. Suggested resolution order: **OQ-04 first** (the contract
-surface everything else hangs off), then OQ-09/OQ-10 (scoped to
-OQ-04's outcome), then OQ-05/OQ-08 (OQ-05 has an independent design
-track; OQ-08 depends only on the trait's shape, OQ-04).
+OQ-09. Resolution order so far: **OQ-04 resolved** (2026-10-05,
+[ADR-008](decisions/008-contract-v1-pinning.md) — the contract surface
+everything else hangs off). Next: OQ-05/OQ-09 (the queue semantics
+track; OQ-09 also owns the scheduler guarantee row), OQ-06
+(the SQLite dependency gate), OQ-08 (rides the now-pinned trait
+shape), OQ-10 (versioning discipline for contract extensions).
 
 Resolved questions stay listed with their resolution; they are not
 deleted.
@@ -78,7 +80,7 @@ deleted.
 
 ## Theme: Core contract
 
-### OQ-04: Contract pinning — the exact trait surface and its semantics *(== OQ-ST-04)*
+### OQ-04: Contract pinning — the exact trait surface and its semantics *(== OQ-ST-04)* — **RESOLVED**
 
 *(Retitled in promotion: OQ-ST-04's framing — "the reactive
 abstraction — what does the unified notify surface look like?" —
@@ -87,38 +89,30 @@ narrowed to the pinning work its own record already scoped.)*
 - **Origin**: [core-contract.md](core-contract.md),
   [ADR-006](decisions/006-wake-and-delivery-contract.md),
   [ADR-007](decisions/007-transactional-seam.md)
-- **Status**: open (de-risked; both engine sides POC-verified — this is
-  paper work over a complete evidence base)
+- **Status**: resolved (2026-10-05, Phase 1 — [ADR-008](decisions/008-contract-v1-pinning.md))
 - **Priority**: high
-- **Resolution**: open. The decisions that bound it are made
-  ([ADR-006](decisions/006-wake-and-delivery-contract.md): opaque-wake + re-read, the delivery-guarantee table, the
-  reserved namespace's existence; [ADR-007](decisions/007-transactional-seam.md): caller-held `TxHandle`
-  with `*_tx` methods). What remains to pin, per the honker-rs surface
-  as starting artifact against the inventory rows:
-  - Which surface parts are contract v1 and which are engine-extension
-    (queue depth, scheduler surface, lock semantics details).
-  - `TxHandle` representation: `dyn` + per-engine downcast (POC
-    sketch, works, two recorded frictions) vs generic/enum handle.
-  - The reserved/meta namespace: exact strings (Postgres
-    reconnect-wake channel like `__listener_reconnected__`), and
-    whether SQLite-side internal names carry an equivalent prefix.
-  - Error taxonomy: what callers can match on per mechanism (e.g.
-    `PayloadTooLarge` is POC-verified pg-side; SQLite's notify has no
-    8000-byte limit — is the error universal?).
-  - Naming/grouping of the honker-rs surface where renames clarify
-    (e.g. what `listen()` returns — a wake receiver? a subscription
-    handle?).
-  - The `Store::open` config shape — what engine-configuration
-    (durability knobs, pool sizing, listener posture) is consumer
-    surface vs engine crate docs.
-  - Verification backlog for properties the POCs pinned on one engine
-    only — e.g. lock TTL/expiry re-acquisition is POC-pinned on
-    Postgres but rests on honker's machinery on SQLite; the contract
-    test suite must pin the SQLite side too.
-  - Delivery-guarantee rows for locks and scheduler (the guarantee
-    table in [ADR-006](decisions/006-wake-and-delivery-contract.md) covers notify/streams/queues; lock-vs-TTL-race
-    and scheduler-tick guarantees need either rows there or an
-    explicit "scheduler is queues" absorption via OQ-09).
+- **Resolution**: Pinned as contract v1 by
+  [ADR-008](decisions/008-contract-v1-pinning.md): (1) the v1
+  surface partition — notify/streams/queue-skeleton/locks/outbox/tx
+  seam are contract; queue depth rides OQ-05, scheduler shape rides
+  OQ-09, capabilities ride OQ-08, `claim_waker` stays engine-internal,
+  cut-flag rows stay out. (2) `TxHandle`: the `*_tx` methods live on
+  the handle trait — boxed `dyn` handle, no downcast, no enum (the
+  enum would invert ADR-001's dependency direction); the POCs'
+  `as_any_mut` friction dissolves by construction. (3) `listen()`
+  returns a `WakeReceiver` delivering opaque `Wake { channel }` —
+  honker's payload transport is not surfaced (uniformity with the
+  opaque contract, ADR-006). (4) Reserved prefix `__alkstore_`, with
+  `__alkstore_listener_reconnected__` as the one v1-reserved string
+  (the POC's ad-hoc `__listener_reconnected__` renamed at
+  implementation). (5) Error taxonomy: `PayloadTooLarge` /
+  `ReservedName` / `InvalidName` / `Closed` / `Codec` / `Database`,
+  pinned by the act-differently rule. (6) `Store::open` is engine-crate
+  surface; the contract is the trait it returns. (7) Locks guarantee
+  row added to ADR-006's table (TTL-bounded mutual exclusion, silent
+  expiry); the scheduler row is explicitly transferred to OQ-09's
+  resolution. A verification backlog (core-contract.md §Verification
+  backlog) tracks the one-engine-pinned properties.
 - **Cross-references**: OQ-01, OQ-10, OQ-09, OQ-08.
 
 ## Theme: Queues and scheduling
@@ -155,7 +149,11 @@ narrowed to the pinning work its own record already scoped.)*
   inspectable/pausable schedule objects (`add/pause/resume/update/
   list/remove`), it stays a first-class mechanism (the full honker
   shape). Decided against the inventory rows, not the whole honker
-  menu.
+  menu. **Also owns the delivery-guarantee table's scheduler row**
+  (transferred by [ADR-008](decisions/008-contract-v1-pinning.md) §7:
+  under collapse the scheduler inherits the queues row; otherwise a
+  dedicated row is pinned with the surface decision). The scheduler
+  surface is *not* part of contract v1 ([ADR-008](decisions/008-contract-v1-pinning.md) §1).
 - **Cross-references**: OQ-05, OQ-04.
 
 ## Theme: Engines and dependencies
@@ -190,7 +188,8 @@ narrowed to the pinning work its own record already scoped.)*
   honker's honesty posture, inherited). The unified surface must not
   pretend SQLite is multi-host. Options: per-engine capability flags
   (`Store::capabilities()`), a documented deployment matrix only
-  ([deployment.md] carries the facts), or compile-time knowledge only
+  ([deployment.md](deployment.md) carries the facts), or compile-time
+  knowledge only
   (a consumer choosing the SQLite engine knows). Rides OQ-04: the
   trait's shape constrains where capability differences can surface.
 - **Cross-references**: OQ-04, [ADR-006](decisions/006-wake-and-delivery-contract.md).