ADR-016: deployment honesty — no runtime capability surface; compile-time identity + matrix (OQ-08 resolved)

docs/architecture/open-questions.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-05
+last_updated: 2026-10-06
 ---
 
 # alkstore — Open Questions
@@ -27,13 +27,17 @@ is OQ-11); **the fork packaging folded** (2026-10-05,
 **OQ-12 resolved** (2026-10-05,
 [ADR-015](decisions/015-streams-depth.md) — streams depth pinned:
 carried-metadata keys, global-FIFO ordering row, `StreamEvent` shape,
-`publish_with_key_tx`, `trim_to`).
-Next: **OQ-08** (rides the now-pinned trait
-shape and the ADR-011 substrate fork), OQ-10 (versioning discipline
+`publish_with_key_tx`, `trim_to`); **OQ-08 resolved** (2026-10-06,
+[ADR-016](decisions/016-deployment-honesty.md) — no runtime
+capability surface; the honest boundary lives in compile-time engine
+identity + the documented deployment matrix).
+Next: **OQ-10** (versioning discipline
 for contract extensions; note ADR-011 changes its substrate-side facts
 for SQLite — the forked machinery lives in-tree inside the engine
 crate per [ADR-013](decisions/013-fold-substrate-into-sqlite.md), so
-the engine/core contract pairing is what the discipline must track),
+the engine/core contract pairing is what the discipline must track;
+OQ-08's resolution also narrowed its surface — no capability struct
+to govern),
 OQ-11 (fork follow-through items — substrate-side, non-consumer-facing).
 
 Resolved questions stay listed with their resolution; they are not
@@ -288,23 +292,52 @@ narrowed to the pinning work its own record already scoped.)*
 
 ## Theme: Deployment and capabilities
 
-### OQ-08: Where does the honest single-host/multi-host boundary live in the trait surface? *(== OQ-ST-08)*
+### OQ-08: Where does the honest single-host/multi-host boundary live in the trait surface? *(== OQ-ST-08)* — **RESOLVED**
 
 - **Origin**: [deployment.md](deployment.md)
-- **Status**: open
+- **Status**: resolved (2026-10-06, Phase 1 —
+  [ADR-016](decisions/016-deployment-honesty.md))
 - **Priority**: medium
-- **Resolution**: open. The pg engine is natively multi-host (POC #2
-  verified — no single-host assumption to remove); SQLite is
-  single-machine by nature (file-backed, NFS-two-writers unsupported —
-  honker's honesty posture, inherited by the forked substrate). The
-  unified surface must not pretend SQLite is multi-host. Options:
-  per-engine capability flags (`Store::capabilities()`), a documented
-  deployment matrix only ([deployment.md](deployment.md) carries the
-  facts), or compile-time knowledge only (a consumer choosing the
-  SQLite engine knows). Rides the now-pinned contract shape
-  ([ADR-008](decisions/008-contract-v1-pinning.md)): the trait
-  constrains where capability differences can surface.
-- **Cross-references**: OQ-04, [ADR-006](decisions/006-wake-and-delivery-contract.md), [ADR-012](decisions/012-forked-substrate-design.md) (the substrate inherits the honesty posture).
+- **Resolution**: Pinned by
+  [ADR-016](decisions/016-deployment-honesty.md): **no runtime
+  capability surface — in v1 and by default ever**. The honest
+  single-host/multi-host boundary lives in the two places it is
+  already true, which compose rather than rival: (1)
+  **compile-time engine identity** — the engine crate a binary
+  depends on *is* the deployment statement (single-driver binaries,
+  [ADR-001](decisions/001-crate-split.md); constructors in engine
+  crates, [ADR-008](decisions/008-contract-v1-pinning.md) §6 —
+  "the engine choice is a dependency-graph fact, not a runtime
+  branch"); (2) **deployment.md's documented matrix** — the
+  ops-facing facts of record, unchanged. Option 2
+  (`Store::capabilities()`) rejected field-by-field under ADR-008
+  §5's act-differently rule generalized to surface: host semantics
+  admit no in-process action (a flag would invite the engine-type
+  branch principle 4 bans); payload limits already have their runtime
+  carriage — the universal, contract-wide matchable
+  `PayloadTooLarge` variant (a `capabilities()` field would be a
+  second normative home); wake cadence and knobs are engine-crate
+  config (§6's split); and no consumer-inventory row names any
+  runtime-adapt need. No `engine_name()`, no `#[cfg]` capability
+  axes. The "must not pretend SQLite is multi-host" obligation
+  resolves into three standing statements (contract text carries
+  asymmetries via the taxonomy, engine-crate docs carry posture,
+  deployment.md carries ops facts); the misconfiguration case
+  (SQLite as shared network storage) follows the family's
+  deployment-asserts-truth posture (alkblobs precedent) — documented
+  boundary, no fabricated detection. Contract-suite row added:
+  `PayloadTooLarge` occurrence asymmetry (pg client-side pre-round-
+  trip, SQLite never) — with no capabilities API, the variant is the
+  one runtime carriage of an engine asymmetry, so its matchability
+  is pinned. Re-entry gate: a consumer-inventory row naming a
+  runtime-adapt need.
+- **Cross-references**: OQ-04 (the pinning that parked this),
+  OQ-10 (narrowed by this — no capability struct to govern), OQ-11,
+  [ADR-001](decisions/001-crate-split.md),
+  [ADR-006](decisions/006-wake-and-delivery-contract.md),
+  [ADR-008](decisions/008-contract-v1-pinning.md) §1/§5/§6,
+  [ADR-012](decisions/012-forked-substrate-design.md),
+  [deployment.md](deployment.md).
 
 
 
@@ -416,6 +449,6 @@ narrowed to the pinning work its own record already scoped.)*
 ## Deferred / Blocked
 
 None currently. Every open OQ above is actionable Phase 1 work
-(capability-surface shape, versioning discipline, fork-scaffold
+(versioning discipline, fork-scaffold
 follow-through) with its evidence base complete — no
 external arrivals are being waited on.