ADR-018: substrate provenance register + cherry-pick procedure (OQ-11 resolved — Phase 1 question set closed)

docs/architecture/open-questions.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-06 (OQ-10 resolved)
+last_updated: 2026-10-06 (OQ-11 resolved — Phase 1 question set closed)
 ---
 
 # alkstore — Open Questions
@@ -34,9 +34,14 @@ identity + the documented deployment matrix); **OQ-10 resolved**
 (2026-10-06, [ADR-017](decisions/017-contract-versioning.md) — the
 core crate's semver is the contract version; four change classes
 with amend-in-place terminating at first release; the pairing
-tracked by manifest pin + version-stamped contract suite + docs).
-Next: **OQ-11** (fork follow-through items — substrate-side,
-non-consumer-facing).
+tracked by manifest pin + version-stamped contract suite + docs);
+**OQ-11 resolved** (2026-10-06,
+[ADR-018](decisions/018-provenance-register-and-cherry-picks.md) —
+`PROVENANCE.md` in the substrate subtree; per-delta category-tagged
+entries;
+five-step cherry-pick procedure recorded at adoption). **The Phase 1
+question set is closed** — no open OQs remain; Phase 1 moves to
+architecture review and the implementation-phase gates.
 
 Resolved questions stay listed with their resolution; they are not
 deleted.
@@ -241,35 +246,52 @@ narrowed to the pinning work its own record already scoped.)*
   [ADR-011](decisions/011-sqlite-substrate-fork.md); ADR-005's posture
   calculus applied, not renegotiated.
 
-### OQ-11: Forked-substrate follow-through — scaffold, provenance register, and cherry-pick discipline
+### OQ-11: Forked-substrate follow-through — scaffold, provenance register, and cherry-pick discipline — **RESOLVED**
 
 - **Origin**: [ADR-012](decisions/012-forked-substrate-design.md)
   (the fork design; substrate-side residue), [ADR-011](decisions/011-sqlite-substrate-fork.md),
   [ADR-013](decisions/013-fold-substrate-into-sqlite.md)
-- **Status**: open (reshaped 2026-10-05 by
-  [ADR-013](decisions/013-fold-substrate-into-sqlite.md) — item (1)
-  dissolved)
+- **Status**: resolved (2026-10-06, Phase 1 —
+  [ADR-018](decisions/018-provenance-register-and-cherry-picks.md);
+  item (1) dissolved 2026-10-05 by
+  [ADR-013](decisions/013-fold-substrate-into-sqlite.md))
 - **Priority**: medium (nothing consumer-facing rides on it; it
   resolves within the fork-scaffold task, which it does not gate)
-- **Resolution**: open. ADR-012 fixed the *design* (contract-blind
-  boundary, fidelity posture, port deltas, bootstrap machinery,
-  upstream-tracking stance) and also pinned the provenance register's
-  location, timing, and initial contents (§1, as carried in-tree by
-  ADR-013). The residue is: (1) **dissolved** by the fold
-  ([ADR-013](decisions/013-fold-substrate-into-sqlite.md)) — there is
-  no separate substrate crate to wire; the engine crate carries one
-  rusqlite dependency and no `bundled-sqlite` interplay question;
-  (2) the provenance register's *format and delta-list granularity*
-  (per-commit entries vs per-delta-class;
-  whether cherry-pick records append at adoption time — the register
-  lives in-tree beside the substrate subtree per
-  [ADR-013](decisions/013-fold-substrate-into-sqlite.md) §3; its
-  timing and initial contents are ADR-012 §1's, not re-opened here);
-  (3) the cherry-pick *procedure* in practice — how a candidate
-  upstream fix is evaluated, applied, and recorded so ADR-012 §6's
-  deliberate-work posture stays auditable. These resolve *within* the
-  fork-scaffold task (its opening section), not before it and not as a
-  gate on writing it.
+- **Resolution**: Pinned by
+  [ADR-018](decisions/018-provenance-register-and-cherry-picks.md):
+  (1) **dissolved** by the fold
+  ([ADR-013](decisions/013-fold-substrate-into-sqlite.md) §4) — no
+  separate substrate crate, no wiring question. (2) **Register
+  format/granularity**: a single in-tree file,
+  `alkstore-sqlite/src/substrate/PROVENANCE.md` (the ADR-013
+  placement, the file named;
+  timing and initial contents stay ADR-012 §1's as carried in-tree),
+  carrying two sections — upstream identity, and the delta register
+  (cherry-picks ride it as `cherry-pick`-category entries; no
+  separate log). The delta register is
+  **per-delta, category-tagged, not per-commit** (this repo's git
+  history is the
+  per-commit record; a per-commit register would duplicate it), each
+  entry pinning category / what / where / why / lineage (upstream
+  commit hashes for cherry-picks, "ours" for born deltas). The
+  initial entries are fixed by ADR-011's scope register and ADR-012
+  §3–§5 — the register formats them, decides nothing new. (3)
+  **Cherry-pick procedure**: five steps — notice (no ambient sweep;
+  triggered candidate arrival), evaluation against ADR-012 §6's
+  port-cost logic (fixes for re-derived-half classes are *not
+  adoptable* — the correct response there is an owned fix), hand
+  application preserving ADR-012 §3's fidelity posture and verified
+  against the inherited suites + contract suite, record **at
+  adoption** (register entry + one engine-changelog line citing the
+  register — visible but non-versioning per
+  [ADR-017](decisions/017-contract-versioning.md) §2 class 4), and a
+  commit whose message names the upstream hash(es), cross-linking
+  git history and register. A change touching the re-derived half or
+  crossing the contract boundary is *not* a cherry-pick — it is an
+  owned fork change under the engine's own discipline and, if
+  contract-visible, ADR-017's taxonomy; ADR-012 §2's boundary is
+  what splits the two record types. Its content lands as the
+  fork-scaffold task's opening section; gates nothing.
 - **Cross-references**: OQ-08 (the contract surface the engine maps
   the substrate under), OQ-10 (the engine's versioning discipline
   now carries the fold's provenance duties in-tree — and its
@@ -492,6 +514,7 @@ narrowed to the pinning work its own record already scoped.)*
 
 ## Deferred / Blocked
 
-None currently. The one remaining open OQ above (OQ-11) is
-actionable Phase 1 work (fork-scaffold follow-through) with its
-evidence base complete — no external arrivals are being waited on.
+None. **The open question set is empty** — every OQ above is resolved
+(2026-10-04 through 2026-10-06, ADR-001 through ADR-018). Phase 1's
+remaining work is architecture review closure and the implementation
+phase's gates; no external arrivals are being waited on.