release-deployment-matrix: deployment matrix finalized as release text — every row verified as implemented (corrections: consumer-side FULL durability option was false — synchronous hardwired NORMAL at bootstrap, no surface; both-engines -> all-three queue stamps; max_size one-guard understated -> three guards listed; NFS honesty re-cited to ADR-016; unsourced mem sub-millisecond latency -> structural statement + honest no-POC latency bullet), env-boundary grep re-run clean (harness-only) and pinned in Configuration boundary, N-1 growth acceptance folded (positioning pointer removed, D-16 attributed, POC #1/#2/pgdiag/wave-6/alkblobs-path pointers removed), status draft -> stable; task -> completed with Notes + Summary

tasks/release-deployment-matrix.md

@@ -1,7 +1,7 @@
 ---
 id: release-deployment-matrix
 name: Deployment matrix final pass — all three engines, release text
-status: pending
+status: completed
 depends_on: [release-n1-growth-posture]
 scope: moderate
 risk: low
@@ -47,15 +47,15 @@ own docs), so every row must be true as implemented, not as designed.
 
 ## Acceptance Criteria
 
-- [ ] Every deployment.md row verified true as implemented across the
+- [x] Every deployment.md row verified true as implemented across the
       three engines; corrections landed
-- [ ] The env-boundary grep re-run (result recorded) + the boundary
+- [x] The env-boundary grep re-run (result recorded) + the boundary
       sentence pinned in deployment.md
-- [ ] N-1's acceptance folded into the growth/durability text
-- [ ] The mem rows re-read as release text
-- [ ] No internal-task/wave pointers remain in the release-facing text
+- [x] N-1's acceptance folded into the growth/durability text
+- [x] The mem rows re-read as release text
+- [x] No internal-task/wave pointers remain in the release-facing text
       (POC-measured caveats excepted)
-- [ ] Workspace gates green (docs-only expected)
+- [x] Workspace gates green (docs-only expected)
 
 ## References
 
@@ -69,8 +69,87 @@ own docs), so every row must be true as implemented, not as designed.
 
 ## Notes
 
-> To be filled by implementation agent
+- **Row-by-row verification was against code, not just the ADRs.**
+  Code-verified true: WAL + `synchronous = NORMAL` at connection
+  bootstrap (`substrate/schema.rs` DEFAULT_PRAGMAS);
+  `SqliteOpts::poll_interval` (1 ms default, zero rejected →
+  `Error::Database`), `max_readers` (0 clamps to 1);
+  `synchronous_commit` wired as `-c synchronous_commit=…` on every
+  pooled connection, default on; `NoTls` on all three pg connection
+  paths (pool, listener, forwarder reconnect); listener
+  `application_name` `{prefix}-{pid}-{seq}`; `PgOpts::max_size` 0
+  rejected at open; the queue-stamp mis-set behaviors on all three
+  engines (pre-claim `attempts >= max_attempts` arm: sqlite
+  `queue_ops.rs:404`, pg `queue.rs:357`, mem `queue.rs:128`;
+  "max attempts exceeded" reason strings); D-16's
+  `NOTIFY_ATTACH_MAX_ROWS` = 10,000 oldest-first at-attach trim.
+- **Corrections landed (the pass's real findings):**
+  1. *"FULL is available consumer-side for stricter durability" was
+     false as implemented* — the engine hardwires the pragma at
+     bootstrap on every connection with no consumer surface; the row
+     now states the fixed posture and names a `FULL` option as a
+     post-v1 engine-surface addition.
+  2. *"both engines" → all three* — the consumer-obligation queue-stamp
+     paragraph predated mem.
+  3. *"`max_size`: the one knob with an engine-side guard" was
+     understated* — the trusted-as-given paragraph now lists the three
+     guards the code actually carries (`max_size` 0 rejected,
+     `poll_interval` 0 rejected, `max_readers` clamped) and re-pins
+     the queue stamps as the unvalidated surface.
+  4. *The NFS honesty cited ADR-003 but ADR-016 carries it* —
+     citation fixed, phrasing de-internaled ("a `.db` on network
+     storage is not a supportable deployment posture").
+  5. *The mem durability row's "wake latency is sub-millisecond" had
+     no source anywhere in the repo* (no POC measured mem; no spec
+     states the number) — replaced with the structural, verifiable
+     statement (in-process channel send at the commit boundary, no
+     round-trip class to budget), and the latency profile gained a mem
+     bullet stating honestly that no POC measured it (which also
+     removed the "both POCs" three-engine dangling coverage).
+- **Env-boundary re-check (review 003's method re-run):** grep across
+  the workspace — every `env::var` read lives in a test target
+  (10 pg test modules' DSN plumbing; `std::env::temp_dir()` for test
+  temp files only); production paths (core, all three engines, the
+  constructors) are env-free. Result unchanged from prior review. The
+  boundary is pinned in a new `## Configuration boundary` section
+  ("env reads are harness-only; production configuration is the
+  opts-constructor surface") plus the caller-side family pattern for
+  a future env convenience. No engine-spec placement added — the
+  engine specs' opts docs already state the constructor surface, and
+  the one sentence belongs in the matrix.
+- **N-1 fold:** the growth-posture acceptance section stands as the
+  release durability/growth text; the "this record is the input the
+  deployment-matrix final pass folds in" positioning sentence was
+  removed (folded this pass), the bare "(D-16)" references were
+  attributed ("the substrate provenance register's D-16 port delta,
+  ADR-010 §6"), and the mem paragraph (process-lifetime-bounded by
+  design) retained verbatim from the N-1 record.
+- **Internal pointers removed:** "POC #1"/"POC #2" numbered refs
+  (checkpoint cadence → "POC-measured"; through-network posture →
+  "measured" with ADR-004 citation), "POC #2's pgdiag-st-4" sizing
+  parenthetical → generic `pg_stat_activity` accounting note, the
+  alkblobs absolute workspace path in the co-tenancy paragraph, and
+  the "wave-6 acceptance" pointer in the wasm toolchain row.
+- **Frontmatter:** status `draft` → `stable` (release text; matching
+  the engine specs' convention). POC-measured caveats and numbers
+  kept (verified against the POC findings docs — e.g. the SQLite
+  ~0.35 ms p50 matches the shipped spawn_blocking seam's 0.354 ms).
 
 ## Summary
 
-> To be filled on completion
+Every deployment.md row was read against the three implemented
+engines; all rows verified true as implemented except the five
+corrections above (one honesty-critical false claim — the
+consumer-side `FULL` durability option — plus stale two-engine
+wording, an understated guard list, a mis-cited ADR, and an
+unsourced mem latency number). The env-variable boundary grep was
+re-run clean (harness-only) and pinned in a new Configuration
+boundary section; N-1's growth-posture acceptance is folded into the
+release growth text with the task-positioning pointer removed; the
+mem rows hold true as release text; no internal task/wave pointers
+remain in the release-facing text (POC-measured caveats kept). Docs
+only: `deployment.md` + this task file. Workspace gates green
+(`cargo build`, `cargo test` — 15 suites ok, `cargo clippy
+--all-targets -- -D warnings`, `cargo fmt --check`,
+`RUSTDOCFLAGS="-D warnings" cargo doc --no-deps`, fuzz corpus replay
+ok).