OQ-06 resolved: honker-core quality read fires the fork trigger (ADR-011)

Quality read of honker-core's watcher/transactional core cross-checked against the published crates.io artifact: the core itself is clean (Writer/Readers, polling-watcher failure handling, WatcherDeathGuard all verified), but published 0.5.0 predates upstream's unreleased fix train carrying the issue-#133 savepoint hardening (silent job loss in the dead-letter paths) and five .ok() error swallows — and ADR-010's queue depth requires engine-owned queue SQL in any posture. Resolution: fork honker-core at the reference revision, inherit the clean machinery and test suites, re-derive queue ops on contract v1, rename tables to __alkstore_*. - docs/research/quality-read-honker-core.md — full evidence - docs/architecture/decisions/011-sqlite-substrate-fork.md — decision - OQ-06 resolved in open-questions.md; ADR-003/005/008, engine-sqlite, queues, README annotated for consistency
2026-10-05 03:39:46 +00:00
1 parent 79a135c934
commit befbe2e714
@@ -25,9 +25,9 @@ pending architecture review and OQ resolution.
 |---|---|---|---|
 | [overview.md](overview.md) | draft | Crate family, feature surface, non-goals, evidence base | — |
 | [core-contract.md](core-contract.md) | draft | The unified trait surface, delivery guarantees, tx seam | OQ-08, OQ-10 |
-| [engine-sqlite.md](engine-sqlite.md) | draft | SQLite engine: honker-core/rusqlite mapping | OQ-05 (resolved), OQ-06, OQ-09 (resolved) |
+| [engine-sqlite.md](engine-sqlite.md) | draft | SQLite engine: forked-substrate/rusqlite mapping | OQ-05, OQ-06, OQ-09 (all resolved) |
 | [engine-postgres.md](engine-postgres.md) | draft | Postgres engine: tokio-postgres/LISTEN mapping | OQ-05 (resolved), OQ-08, OQ-09 (resolved) |
-| [queues.md](queues.md) | draft | Queue/scheduler/outbox semantics depth (resolved: ADR-009/ADR-010) | OQ-06 (rides) |
+| [queues.md](queues.md) | draft | Queue/scheduler/outbox semantics depth (resolved: ADR-009/ADR-010) | OQ-06 (resolved) |
 | [deployment.md](deployment.md) | draft | Host semantics, connection budgets, knobs, matrix | OQ-08 |
 | [open-questions.md](open-questions.md) | draft | OQ tracker (promoted from OQ-ST register) | — |

@@ -51,12 +51,12 @@ pending architecture review and OQ resolution.
 Tracked in [open-questions.md](open-questions.md) (OQ-01..NN; the
 Phase 0 register's OQ-ST-01..08 promote one-to-one — OQ-NN mirrors
 OQ-ST-NN — with new Phase 1 questions appended after). Highlights,
-in suggested resolution order (OQ-04, OQ-09, OQ-05 resolved):
+in suggested resolution order (OQ-04, OQ-09, OQ-05, OQ-06 resolved):

- **OQ-06** (high): honker-core quality read — fork-trigger gate;
-  now carries two concrete fork candidates from the queue-depth
-  design (the no-stranded-rows sweep fix, dead-row `get_job`
-  visibility — complement vs fork is the read's call).
+- **OQ-06** (high): honker-core quality read — **resolved**
+  (2026-10-05, [ADR-011](decisions/011-sqlite-substrate-fork.md)): the
+  fork trigger fired; SQLite substrate is owned code forked from
+  honker-core's lineage, queue ops re-derived on contract v1.
 - **OQ-08** (medium): capability-surface shape.
 - **OQ-10** (medium): contract versioning across engine crates.

@@ -83,7 +83,9 @@ comparable reuse.

 - honker-core pins rusqlite ^0.40.1; version movement in honker-core
  moves our rusqlite. A honker-core quality read is the recorded fork
-  trigger ([ADR-005], OQ-06).
+  trigger ([ADR-005], OQ-06) — *(resolved 2026-10-05: the trigger
+  fired, [ADR-011](011-sqlite-substrate-fork.md) forks the substrate;
+  its rusqlite pin is then ours to move deliberately.)*
 - rustc ≥ 1.99 required by rusqlite 0.40.x — binaries linking this
  engine carry that toolchain floor (deployment-matrix row,
  [deployment.md](../deployment.md)).
@@ -27,7 +27,7 @@ when a named trigger fires. Per subsystem:

 | Subsystem | Posture | Notes |
 |---|---|---|
-| honker-core (SQLite engine machinery) | published library, `honker-core = 0.5` | Fork trigger: the Phase 1 quality read of the watcher/transactional core finds a defect, OR a needed change upstream won't take. OQ-06 tracks the read. |
+| honker-core (SQLite engine machinery) | published library, `honker-core = 0.5` — **trigger fired 2026-10-05**: forked per [ADR-011] | Fork trigger: the Phase 1 quality read of the watcher/transactional core finds a defect, OR a needed change upstream won't take. OQ-06 tracked the read; the read fired the trigger (published 0.5.0 carries the unreleased-fix-train defect class + ADR-010's queue depth requires engine-owned queue SQL in any posture). |
 | rusqlite | published, riding honker-core's pin | Pin movement is honker-core's; we ride it ([ADR-003]). |
 | tokio-postgres + deadpool-postgres | published library, as-is | Clean, zero conflicts, actively maintained (POC #2). |
 | postgres-notify | **not adopted** (derive-not-adopt) | Lazy reconnect, connect_script skipped at initial connect, unquoted-identifier LISTENs, single maintainer. Hand-rolled forwarder instead ([ADR-004]). Fallback if upstream improves materially. |
@@ -43,7 +43,9 @@ to this posture.
 **Positive**

 - Zero vendored code in the tree by default; upgrades are
-  `cargo update` work, not patch-management work.
+  `cargo update` work, not patch-management work. *(Exception now
+  live: the [ADR-011] fork is a vendored family crate — the named
+  trigger, not a posture change.)*
 - The fork triggers are concrete and named *before* the quality read,
  so the read produces a decision, not a debate.
 - Per-subsystem votes are recorded with evidence, so no future
@@ -53,6 +55,10 @@ to this posture.

 - honker-core 0.5 remains alpha-quality software per its own README in
  the link graph; the quality read (OQ-06) is the mitigation gate.
+  *(Resolved 2026-10-05: the read fired the trigger — [ADR-011].
+  This row's negative consequence is retired with it; the
+  "zero vendored code" positive consequence now carries ADR-011's
+  named exception.)*
 - The pg queue machinery is written by us — the pg-boss family's
  battle-tested edge cases must be re-earned by design + tests
  ([queues.md]).
@@ -208,8 +208,9 @@ struct Wake { channel: String }
  - SQLite: honker's machinery owns two categories of internal names,
    and the contract treats them differently. Its `_honker_*` *table*
    family (`_honker_dead`, `_honker_locks`, …) is storage-internal —
-    not part of any consumer namespace; its fate rides the quality
-    read (OQ-06, [ADR-005](005-dependency-ownership.md)). Its
+    not part of any consumer namespace; its fate resolved with the
+    quality read (OQ-06, [ADR-011](011-sqlite-substrate-fork.md) — the
+    fork re-owns the names as `__alkstore_*`). Its
    **consumer-namespace derived names** are a real collision surface:
    honker-rs materializes an outbox's backing queue as
    `_outbox:{name}` inside the queue-name namespace — a consumer
@@ -0,0 +1,129 @@
+# ADR-011: SQLite substrate — fork honker-core into owned code
+
+## Status
+
+Accepted (2026-10-05, Phase 1 — OQ-06's resolution; the fork trigger
+ADR-005 named, fired)
+
+## Context
+
+ADR-005 fixed the dependency posture: published honker-core 0.5 by
+default, with the fork trigger being the Phase 1 quality read finding a
+defect the POCs wouldn't surface. ADR-010 handed the read two concrete
+fork candidates (the expired-processing-row zombie hole; dead-row
+`get_job` visibility) and made the SQLite realization of contract v1's
+queue depth contingent on it. OQ-06 is the tracked assessment; the
+evidence is `docs/research/quality-read-honker-core.md` (full read of
+all five honker-core sources at the reference revision, cross-checked
+against the published crates.io artifact).
+
+Three facts drive this decision:
+
+1. **The published artifact carries confirmed silent-job-loss defects.**
+   crates.io's newest honker-core is 0.5.0 (2026-08-23). The upstream
+   fix train for its own documented defect class — issue #133's
+   savepoint hardening of the DELETE→INSERT dead-letter paths (a job
+   stranded in neither table on mid-flight error = silent job loss) and
+   the five `.ok()` error-swallows that map every SQLite error to "no
+   row"/"not our claim"/"lock held" — sits in the repository
+   *unreleased*, alongside `claimed_at` and six weeks of hardening. The
+   ride posture's core value ("defects inherited for free" cuts both
+   ways: fixes do too) currently inherits the defects, not the fixes.
+2. **Contract v1 requires re-deriving the queue-op surface in any
+   posture.** Per-job option stamps (ADR-010 §3a — visibility/backoff/
+   retention stamped at enqueue, honored per-row in the claim
+   statement), the no-stranded-rows sweep (§5), and dead-visible
+   `get_job` with stamps (§1) all mean the engine owns enqueue / claim
+   / retry / fail / sweep / get_job SQL whether riding or forking. The
+   post-fork ride would cover only ack/heartbeat/cancel, locks,
+   streams, notify transport, scheduler storage, and the watcher/
+   connection plumbing — the minority of what the engine touches, dual-
+   owning the `_honker_*` schema with our migrations in the complement
+   posture.
+3. **The read's original target — the watcher/transactional core — is
+   clean.** Writer, Readers, and the polling watcher's three-layer
+   failure handling (transient-BUSY-vs-fatal classification, conservative
+   wakes, re-baseline discipline, the stat-identity dead-man's switch)
+   and `WatcherDeathGuard`'s death-closes-subscribers property all
+   verified in source, present in 0.5.0. This fact steers the fork's
+   *scope* (inherit that machinery almost verbatim), not the posture.
+
+## Decision
+
+**The fork trigger fires.** The SQLite engine's substrate becomes owned
+code: fork honker-core at the reference revision
+(`/workspace/honker` @ `f4e53c6`, MIT OR Apache-2.0, provenance
+recorded per AGENTS.md §3) into the alkstore family, ported to the
+family standard (tokio-facing consumers, no comments discipline, panics
+out of library code), re-derived on contract v1 where ADR-010 pinned
+semantics honker's functions don't provide.
+
+Per-scope (the full register with keeps/re-derivations/drops is
+`docs/research/quality-read-honker-core.md` §6):
+
+- **Inherited near-verbatim:** the PRAGMA/WAL open posture,
+  `Writer`, `Readers`, the polling watcher + `SharedUpdateWatcher` +
+  `WatcherDeathGuard` + dead-man's switch (with two port fixes the read
+  named: reconnect backoff, fallible watcher spawn), the
+  `in_savepoint` mutation-discipline machinery, arg-coercion helpers,
+  the notify scalar + notifications table (renamed, with engine-
+  internal hygiene per ADR-010 §6), streams, locks.
+- **Re-derived on contract v1:** enqueue + opt stamping; single-
+  statement claim with per-row visibility from the job's stamps;
+  savepoint-guarded retry/fail/dead-letter; the both-states
+  no-stranded-rows `sweep_expired` with retention deletion; dead-
+  visible `get_job`; scheduler tick with `@every` boundary math.
+- **Dropped:** cron parsing (ADR-009 rejects cron strings), the
+  experimental watcher backends and their optional deps, the rate-limit
+  and result tables (cut-flags), the superseded queue functions.
+- **Table naming:** `_honker_*` → `__alkstore_*` — storage-internal
+  (ADR-008 §4); ADR-010 §8 pre-authorized the fork re-owning names.
+- **Tests:** honker-core's suites inherited as the floor (watcher
+  lifecycle/failure, savepoint, multiprocess pressure) + the contract-
+  property tests (no-stranded-rows, dead-visible `get_job`, stamps).
+
+Packaging follows ADR-001's split: the forked substrate is the
+SQLite engine crate's dependency — vendored as a workspace-family
+crate (provenance + license recorded), not re-published.
+
+## Consequences
+
+**Positive**
+
+- The confirmed defect class (D-1..D-5) is owned, fixed, and testable
+  in-tree; no release cadence gates correctness we already know how to
+  fix.
+- Contract v1's queue depth realizes directly in owned SQL — no
+  two-statement re-stamp bridge, no engine migrations over a
+  dual-owned `_honker_*` table family.
+- The fork inherits ~4,000 lines of upstream hardening tests plus the
+  watcher machinery the POCs measured as the quality win of the ride
+  posture — most of the fork cost is pre-paid.
+
+**Negative**
+
+- We own the SQLite machinery's future: upstream fixes (rare and
+  incremental, but real — the #80/#133 train proves the stream is
+  alive) must be deliberately cherry-picked rather than inherited by
+  `cargo update`.
+- A vendored workspace-family crate breaks "zero vendored code in the
+  tree by default" (ADR-005's positive consequence) — this is the
+  exception the posture always named, not a renegotiation.
+
+## References
+
+- OQ-06 (`docs/architecture/open-questions.md`) — the resolved
+  assessment; `docs/research/quality-read-honker-core.md` — the
+  evidence (published-artifact fact, watcher-core verdict, defect
+  register, fork calculus and scope).
+- [ADR-005](005-dependency-ownership.md) — the posture and trigger this
+  ADR fires; fork-is-normal-work applies.
+- [ADR-003](003-sqlite-driver.md) — driver, seam, and watcher
+  architecture (unchanged in ownership; the fork inherits the measured
+  machinery).
+- [ADR-010](010-queue-semantics-depth.md) — §3a/§5/§1's realization
+  is now owned-code work; §8's naming authorization applies.
+- [ADR-001](001-crate-split.md) — packaging (engine crate's
+  single-driver substrate).
+- [engine-sqlite.md](../engine-sqlite.md) — the living spec, updated
+  to the forked substrate.
@@ -6,20 +6,24 @@ last_updated: 2026-10-05
 # SQLite engine

 The `alkstore-sqlite` engine implements
-[core-contract.md](core-contract.md) on rusqlite + published
-honker-core. This spec records WHAT the engine is internally (its
+[core-contract.md](core-contract.md) on rusqlite over the
+[forked honker-core substrate](decisions/011-sqlite-substrate-fork.md).
+This spec records WHAT the engine is internally (its
 connection architecture, seam, and wake plumbing) — not code-level
 HOW. Decisions live in ADRs; per-contract obligations live in the core
 spec and are not restated here.

 ## Identity and posture

- Single driver: rusqlite (riding
-  [honker-core's pin](decisions/003-sqlite-driver.md)),
-  `bundled-sqlite` for hermetic builds. No `.so` runtime artifacts, no
-  vendored patches
-  ([ADR-003](decisions/003-sqlite-driver.md),
-  [ADR-001](decisions/001-crate-split.md)).
+- Single driver: rusqlite, riding the
+  [forked honker-core substrate](decisions/011-sqlite-substrate-fork.md)
+  (fork of published honker-core 0.5.0's lineage at the reference
+  revision),
+  `bundled-sqlite` for hermetic builds. No `.so` runtime artifacts
+  ([ADR-003](decisions/003-sqlite-driver.md) for the driver decision;
+  ownership resolved by
+  [ADR-011](decisions/011-sqlite-substrate-fork.md) — OQ-06's read
+  fired ADR-005's fork trigger).
 - Sync machinery, async-facing trait: honker-core is sync (std
  threads, blocking iterators); the engine bridges at the trait seam
  per the family-standard posture (alktty REQ-TTY-01 precedent).
@@ -52,9 +56,9 @@ spec and are not restated here.
 |---|---|
 | notify / listen | honker's notify functions inside the caller's tx; `listen()` bridges the watcher's fanout into a tokio receiver (one `spawn_blocking` thread per subscription doing `blocking_send`) |
 | streams | honker's stream machinery; explicit offset saves through the tx seam |
-| queues | honker's queue functions ([ADR-002](decisions/002-feature-scope.md)); semantics depth per [ADR-010](decisions/010-queue-semantics-depth.md) — ride + pin, except two contract properties honker's machinery doesn't provide (the no-stranded-rows `sweep_expired`, dead-row `get_job` visibility — OQ-06's concrete fork candidates) |
+| queues | owned queue machinery (forked substrate re-derived on [ADR-010](decisions/010-queue-semantics-depth.md) — stamps, no-stranded-rows sweep, dead-visible `get_job`); ADR-003's ride posture superseded on ownership by [ADR-011](decisions/011-sqlite-substrate-fork.md) |
 | named locks | honker's lock machinery |
-| scheduler / outbox | collapse shape ([ADR-009](decisions/009-scheduler-collapse.md)): honker's scheduler machinery (`_honker_scheduler_tasks`) carries `@every` specs (its cron boundary machinery unused — cron strings are contract-rejected); honker's leader loop pattern (TTL lock, heartbeat, exit-before-tick-on-loss); the leadership lock is `__alkstore_scheduler`; outbox = helper over queues with the derived backing-queue name ([ADR-008](decisions/008-contract-v1-pinning.md) §4) |
+| scheduler / outbox | collapse shape ([ADR-009](decisions/009-scheduler-collapse.md)): owned scheduler storage (`__alkstore_scheduler_tasks`, forked substrate) carrying `@every` specs (cron machinery not ported); the leader loop pattern (TTL lock, heartbeat, exit-before-tick-on-loss); the leadership lock is `__alkstore_scheduler`; outbox = helper over queues with the derived backing-queue name ([ADR-008](decisions/008-contract-v1-pinning.md) §4) | |
 | begin_tx | acquires the writer slot, opens `BEGIN IMMEDIATE`, returns the caller-held handle ([ADR-007](decisions/007-transactional-seam.md)) |
 | handle ops | each `*_tx` op round-trips `spawn_blocking` to the same connection (thread-affinity note in [ADR-007](decisions/007-transactional-seam.md)) |
 | commit/rollback | releases the writer slot |
@@ -72,24 +76,28 @@ spec and are not restated here.
 - Wake coalescing: bursts inside one poll tick produce one wake;
  correctness is preserved by the re-read contract
  (POC-pinned: missed-wake stress with correct post-burst re-reads).
- **Deployment note**: honker-core 0.5 pins rusqlite ^0.40.1, whose
-  rustc floor is ≥ 1.99; binaries linking this engine carry that
-  requirement ([deployment.md](deployment.md) matrix).
+- **Deployment note**: the substrate's rusqlite generation
+  (^0.40.1) has a rustc floor ≥ 1.99; binaries linking this engine
+  carry that requirement ([deployment.md](deployment.md) matrix).
 - The optimization path, if seam throughput ever demands it: a
  dedicated std-thread bridge (one thread owning the writer conn, ops
  over mpsc — measured ~2× the spawn_blocking shape at p50 in POC #1),
  or a raised watcher cadence for idle CPU. Neither is the default.

-## What rides on the fork question
+## What the fork question resolved

-Nearly all of honker-core's surface is consumed (Writer/Readers/
-SharedUpdateWatcher/attach_*). The [quality read
-(OQ-06)](decisions/005-dependency-ownership.md) is this engine's only
-open dependency gate: if it names a defect or an upstream-unwon't
-change, the fork posture
-([ADR-005](decisions/005-dependency-ownership.md)) fires and this
-engine's substrate becomes owned code. Until then, published-library
-consumption stands.
+The [quality read (OQ-06)](decisions/005-dependency-ownership.md) —
+this engine's dependency gate — resolved 2026-10-05: ADR-005's fork
+trigger **fired** ([ADR-011](decisions/011-sqlite-substrate-fork.md)).
+The substrate is owned code forked from honker-core's lineage; the
+watcher/connection architecture this spec describes is inherited
+verbatim where kept ([ADR-003](decisions/003-sqlite-driver.md)
+unchanged in architecture). The
+[evidence](../research/quality-read-honker-core.md): published
+0.5.0's unreleased-fix-train defect class, plus ADR-010's queue depth
+requiring engine-owned queue SQL in any posture. The forked
+substrate's table family is `__alkstore_*` (ADR-010 §8's naming
+authorization).

 ## Design Decisions

@@ -97,13 +105,14 @@ consumption stands.
 |---|---|---|
 | [001](decisions/001-crate-split.md) | Crate split | single-driver engine crate |
 | [002](decisions/002-feature-scope.md) | Feature scope | which rows this engine serves |
-| [003](decisions/003-sqlite-driver.md) | Driver | rusqlite + honker-core, bridged seam, inherited watcher |
-| [005](decisions/005-dependency-ownership.md) | Ownership | published honker-core; named fork triggers |
+| [003](decisions/003-sqlite-driver.md) | Driver | rusqlite + honker-core lineage, bridged seam, inherited watcher — ownership resolved by 011 |
+| [005](decisions/005-dependency-ownership.md) | Ownership | published honker-core; fork trigger fired by OQ-06 (ADR-011) |
 | [006](decisions/006-wake-and-delivery-contract.md) | Wake contract | data_version watcher, coalescing, death-closes-receivers |
 | [007](decisions/007-transactional-seam.md) | Tx seam | writer-slot lease, `BEGIN IMMEDIATE`, `spawn_blocking` round-trips |
 | [008](decisions/008-contract-v1-pinning.md) | Contract v1 | pinned surface; outbox backing queue derived under the reserved prefix; wake payload transport unused (non-contract) |
-| [009](decisions/009-scheduler-collapse.md) | Scheduler collapse | honker scheduler machinery with `@every` specs; `__alkstore_scheduler` leadership; cron machinery unused |
-| [010](decisions/010-queue-semantics-depth.md) | Queue depth | ride + pin over honker's functions; §5/§3a properties are OQ-06 fork candidates |
+| [009](decisions/009-scheduler-collapse.md) | Scheduler collapse | `@every` specs; `__alkstore_scheduler` leadership; cron rejected |
+| [010](decisions/010-queue-semantics-depth.md) | Queue depth | semantics pinned; §5/§3a realization resolved by ADR-011 (owned code) |
+| [011](decisions/011-sqlite-substrate-fork.md) | Substrate fork | OQ-06's trigger fired; substrate owned, queue ops re-derived on contract v1 |

 ## Open Questions

@@ -111,10 +120,9 @@ Open questions are tracked in
 [open-questions.md](open-questions.md). Key
 questions affecting this document:

- **OQ-06**: honker-core quality read — fork-trigger assessment
-  (open); now carrying two concrete candidates from the queue-depth
-  design (no-stranded-rows sweep, dead-row visibility —
-  complement vs fork is the read's call)
+- **OQ-06**: honker-core quality read — fork-trigger assessment —
+  **resolved** (2026-10-05,
+  [ADR-011](decisions/011-sqlite-substrate-fork.md); trigger fired).

 Resolved: **OQ-09** (scheduler collapse —
 [ADR-009](decisions/009-scheduler-collapse.md)) and **OQ-05** (queue
@@ -12,10 +12,14 @@ so far: **OQ-04 resolved** (2026-10-05,
 everything else hangs off); **OQ-09 + OQ-05 resolved** (2026-10-05,
 [ADR-009](decisions/009-scheduler-collapse.md) and
 [ADR-010](decisions/010-queue-semantics-depth.md) — the queue semantics
-track and the scheduler collapse/guarantee row). Next: OQ-06
-(the SQLite dependency gate — now carrying two concrete fork
-candidates from the queue-depth design), OQ-08 (rides the now-pinned
-trait shape), OQ-10 (versioning discipline for contract extensions).
+track and the scheduler collapse/guarantee row); **OQ-06 resolved**
+(2026-10-05, [ADR-011](decisions/011-sqlite-substrate-fork.md) — the
+fork trigger fired on the published-artifact facts). Next: OQ-08
+(rides the now-pinned trait shape and the ADR-011 substrate fork),
+OQ-10 (versioning discipline for contract extensions; note ADR-011
+changes its substrate-side facts for SQLite — the forked crate is
+versioned in the family workspace, so the engine/core contract pairing
+is what the discipline must track).

 Resolved questions stay listed with their resolution; they are not
 deleted.
@@ -182,24 +186,34 @@ narrowed to the pinning work its own record already scoped.)*

 ## Theme: Engines and dependencies

-### OQ-06: honker-core quality read — does the default posture hold? *(== OQ-ST-06)*
+### OQ-06: honker-core quality read — does the default posture hold? *(== OQ-ST-06)* — **RESOLVED**

 - **Origin**: [ADR-005](decisions/005-dependency-ownership.md),
  [engine-sqlite.md](engine-sqlite.md)
- **Status**: open
+- **Status**: resolved (2026-10-05, Phase 1 —
+  [ADR-011](decisions/011-sqlite-substrate-fork.md))
 - **Priority**: high (fork trigger is a gate on the SQLite engine's
  dependency posture)
- **Resolution**: open. ADR-005 fixed the calculus and the trigger: the
-  Phase 1 quality read of honker-core 0.5's watcher/transactional core
-  (Writer/Readers/SharedUpdateWatcher/attach_*) — looking for defects
-  the POCs wouldn't surface, unsafe assumptions in the watcher
-  failure-handling, and schema-migration brittleness. Outcomes: posture
-  holds (no ADR change), or a fork/patch need is named (fork is normal
-  work per ADR-005).
- **Cross-references**: ADR-003, ADR-005, OQ-05 (the queue-depth read
-  handed it two concrete fork candidates: the expired-
-  processing-row zombie fix and dead-row `get_job` visibility —
-  complement-over-machinery vs fork is exactly its calculus).
+- **Resolution**: **The fork trigger fires.** Evidence:
+  [quality-read-honker-core.md](../research/quality-read-honker-core.md).
+  The read's original target is clean (Writer/Readers, the polling
+  watcher's three-layer failure handling, `WatcherDeathGuard` — all
+  verified in source, present in 0.5.0; schema migrations minor). But
+  the published artifact is materially behind the reference revision:
+  crates.io's honker-core 0.5.0 predates upstream's own fix train for
+  its documented defect class (issue #133's savepoint hardening —
+  silent job loss on mid-flight errors in the dead-letter paths; five
+  `.ok()` error-swallows mapping every SQLite error to "no row"/"lock
+  held"), stranded unreleased with no announced date. And contract v1's
+  queue depth ([ADR-010](decisions/010-queue-semantics-depth.md) §3a/§5)
+  requires engine-owned enqueue/claim/sweep/get_job SQL in any posture
+  — making a post-fix ride a minority-shape, dual-owning the schema.
+  Resolution: fork honker-core at the reference revision into owned
+  code, inherit the clean watcher/transactional core + test suites,
+  re-derive the queue ops on contract v1, drop cron/experimental
+  backends, rename `_honker_*` → `__alkstore_*`. Recorded in
+  [ADR-011](decisions/011-sqlite-substrate-fork.md); ADR-005's posture
+  calculus applied, not renegotiated.

 ## Theme: Deployment and capabilities

@@ -240,6 +254,5 @@ narrowed to the pinning work its own record already scoped.)*
 ## Deferred / Blocked

 None currently. Every open OQ above is actionable Phase 1 architecture
-work (quality read, capability-surface shape, versioning discipline)
-with its evidence base complete — no external arrivals are being
-waited on.
+work (capability-surface shape, versioning discipline) with its
+evidence base complete — no external arrivals are being waited on.
@@ -133,8 +133,8 @@ made under; the ADRs carry the WHY.
  ([ADR-010](decisions/010-queue-semantics-depth.md) §5): a job with
  an `expires` deadline is eventually in exactly one of
  pending/processing/dead, never stuck unreachable. (SQLite-side
-  realization over honker's machinery rides OQ-06 — the zombie hole
-  is that read's concrete fork candidate.)
+  realization resolved with OQ-06 — the fork fires ([ADR-011](decisions/011-sqlite-substrate-fork.md)),
+  the zombie fix lands in owned code.)
 - **No ambient sweeper**: the engine ships no background maintenance,
  no default cadence (the no-ambient-timers posture). Correctness of
  transitions is the engine's; **timeliness is the consumer's**.
@@ -199,8 +199,9 @@ Collapsed into queues: no `Scheduler` handle, no schedule objects.
  proven shape and keeps `queue(name)` a name, not a DDL operation).
 - **SQLite**: honker's `_honker_*` family — storage-internal
  ([ADR-008](decisions/008-contract-v1-pinning.md) §4); no new tables
-  minted by this design; the family's fate rides OQ-06 (a fork
-  re-owns the names; nothing consumer-visible changes).
+  minted by this design; the family's fate resolved with OQ-06 — the
+  fork ([ADR-011](decisions/011-sqlite-substrate-fork.md)) re-owns the
+  names (`__alkstore_*`); nothing consumer-visible changes.
 - Partial indexes pinned identically on both engines: partial indexes
  matching the claim hot path; dead rows outside it; single clock
  source (second-precision timestamps); savepoint-guarded
@@ -208,12 +209,16 @@ Collapsed into queues: no `Scheduler` handle, no schedule objects.

 ## Reference material

- **honker's queue design** — the SQLite-side incumbent
-  (`/workspace/honker`, its honker-core machinery; the engine rides it
-  directly, so the SQLite side's depth is largely "inherit + pin").
+- **honker's queue design** — the SQLite-side incumbent design
+  reference (`/workspace/honker`; ownership resolved by
+  [ADR-011](decisions/011-sqlite-substrate-fork.md) — forked, queue ops
+  re-derived on this design).
  Full read: `docs/research/reference-honker-machinery.md` (schema,
  claim/visibility/retry/dead-letter mechanics with file/line cites;
-  the defect list §8 feeds OQ-06).
+  the defect list §8 fed OQ-06 and is the fork's fix/inheritance
+  register), plus
+  `docs/research/quality-read-honker-core.md` (the dependency-gate
+  read).
 - **pg-boss family** — `/workspace/pgboss-rs` @ 98f7d9e (design
  reference only, [ADR-005](decisions/005-dependency-ownership.md)).
  Full read: `docs/research/reference-pgboss-rs-semantics.md` (states,
@@ -245,9 +250,10 @@ Open questions are tracked in
 [open-questions.md](open-questions.md). Key
 questions affecting this document:

- **OQ-06**: honker-core quality read — the SQLite-side zombie fix and
-  dead-row visibility are concrete fork candidates for it to weigh
-  (open).
+- **OQ-06**: honker-core quality read — **resolved** (2026-10-05,
+  [ADR-011](decisions/011-sqlite-substrate-fork.md)): the zombie fix
+  and dead-row visibility — this document's two named SQLite-side gaps
+  — land in owned code via the fork.

 Resolved on this document's surface: **OQ-05** and **OQ-09**
 (2026-10-05, [ADR-010](decisions/010-queue-semantics-depth.md) /