# PROVENANCE — the substrate fork's register

The provenance register for the `src/substrate/` module subtree of
`alkstore-sqlite` — per
[ADR-018](../../../docs/architecture/decisions/018-provenance-register-and-cherry-picks.md)
(format and procedure), [ADR-011](../../../docs/architecture/decisions/011-sqlite-substrate-fork.md)
(the fork decision), [ADR-012](../../../docs/architecture/decisions/012-forked-substrate-design.md)
(the fork design), and
[ADR-013](../../../docs/architecture/decisions/013-fold-substrate-into-sqlite.md)
(the fold into the engine crate).

This file records: what lineage this code is, what has been changed
relative to that lineage, and how each change arrived. It is the audit
trail review works from; it is not itself a guard and not a decision
record — the ADRs remain the decisions of record. Entries are
append-only (amendment only to correct the record — a wrong path, a
mis-cited hash — never to change the story; a superseded delta is a
new entry citing the one it supersedes).

## 1. Upstream identity

- **Upstream project**: honker (the SQLite queue / notify library),
  https://github.com/russellromney/honker — substrate package
  `honker-core`.
- **Fork point**: the reference checkout `/workspace/honker` @
  `f4e53c6` (full hash
  `f4e53c6b83ad2d6979c04098d576db024ce7e98d`, dated 2026-10-02;
  `git describe` → package `node-v0.5.1-10-gf4e53c6`). The fork point
  is deliberately *past* the published release: it carries the
  unreleased fix train (issue #133's savepoint hardening of the
  DELETE→INSERT dead-letter paths, the `claimed_at` addition, and
  related hardening) that the published crates.io artifact (0.5.0,
  2026-08-23) does not.
- **Published-release lineage**: honker-core 0.5.0 (2026-08-23) on
  crates.io; the fork continues from the repository lineage, not the
  published tag.
- **License**: MIT OR Apache-2.0 (upstream's dual license, carried
  upstream as `LICENSE-MIT` / `LICENSE-APACHE`; bundled in-tree as
  `src/substrate/LICENSE`, this directory — the preservation
  obligation's carrier). Sublicensing is permitted by both licenses;
  the engine crate's license statement covers the whole crate.
- **Fork-point statement**: the scaffold commits — this subtree's
  landing in alkstore's git history — are the provenance line, the
  alksocks extraction-commit-window shape. Everything in the subtree
  before the first port commit is lineage; every divergence is
  register-addressable below.
- **Inherited lineage facts**: the fork point itself carries upstream
  changes we inherited verbatim and therefore do *not* list as deltas
  — the fix train above (`4881f27`, `3ab43aa`, `claimed_at` et al.)
  is upstream code, recorded here under upstream identity, not in the
  delta register.
- **Reference checkout**: `/workspace/honker` @ `f4e53c6` remains the
  standing reference for cherry-pick candidates and differential
  testing — no dependency, no wiring (ADR-012 §6).

## 2. Delta register

Per [ADR-018] §2: one entry per distinct delta, category-tagged —
never one per commit (git history is the per-commit record; this
register is the semantic index over it). Each entry pins five fields:
**Category** / **What** / **Where** / **Why** / **Lineage**.

Categories: `port delta` (kept-half adaptation), `re-derivation` (new
contract-v1 code), `drop` (not ported), `hygiene`
(family-standard porting), `cherry-pick` (adopted upstream lineage).

The entries below are the initial entries fixed by the retained
records (ADR-011's scope register, ADR-012 §4–§5) as
**pre-declared checklist rows** — they name deltas the port tasks will
make. At the port tasks' landing, entries are updated in place to the
landed state (paths finalized, what/why made precise); entries for
port-surfaced adaptations the plan didn't anticipate are appended
(D-17..D-20, landed with `fork-port-connection-watcher`).

The entries below are the fork-port deltas as landed by
`fork-port-connection-watcher` (paths finalized against the ported
tree). D-12 landed as the re-derivation's `queue_ops.rs` module +
schema extensions with `fork-rederive-queue-ops`. The gate-time
completion pass (`fork-provenance-and-floor`): the lineage diff vs
honker-core @ `f4e53c6` was produced and skimmed end-to-end (local
only, not committed — the wave-2 review's primary input), and every
divergence it surfaced is either a register entry below (D-21..D-26,
appended; D-12 annotated in place) or a fixed omission (the
lineage-less placeholder test in `ops.rs`'s pressure suite, removed).
No unregistered divergence remains. The wave-2 review gate
(`review-wave-2`) re-ran the full-coverage lineage diff (clean —
everything register-addressable) and appended D-27/D-28 for its two
fixes. D-32..D-36 are the wave-3 lint-removal pass
(`sqlite-engine-integration`): with the engine layer wired, the
`#![allow(dead_code)]`/`#![allow(unused_imports)]` posture lifted, and
the genuinely unreachable ported surface cut rather than suppressed.
Cherry-picks: empty at scaffold, append-only forever.

| ID | Category | What | Where | Why | Lineage |
|----|----------|------|-------|-----|---------|
| D-01 | drop | `cron.rs` (cron-string scheduling) not ported | — | ADR-009 rejects cron strings (scheduler collapse; §3) | ours |
| D-02 | drop | experimental watcher backends (`kernel-watcher`, `shm-fast-path`) and their optional deps (`notify`, `memmap2`, `libc`, `file-id`) not ported | — | ADR-011 scope (drop); quality-read §6; cuts optional deps | ours |
| D-03 | drop | rate-limit and result tables (cut-flags) not ported | — | ADR-002 cut-flags; ADR-011 scope (drop) | ours |
| D-04 | drop | superseded queue functions not ported | — | ADR-011 scope (drop); the queue half is re-derived (see R-01) | ours |
| D-05 | port delta | W-1 — bounded reconnect backoff in the watcher reconnect path (`MAX_RECONNECT_TICKS` = 100 poll ticks between attempts; the lineage reconnected on every tick) | watcher machinery (`run_poll_loop` region; `watcher.rs`) | ADR-012 §4; quality-read W-1 | ours |
| D-06 | port delta | W-2 — watcher spawn becomes fallible (`UpdateWatcher::spawn*` / `SharedUpdateWatcher::new*` return `Result`); the engine surfaces the failure at open time | watcher machinery (`spawn_with_config` / `spawn_thread` region; `watcher.rs`) | ADR-012 §4; quality-read W-2 | ours |
| D-07 | port delta | dead-man's switch — the db-file-identity-change panic replaced by a deliberate watcher-fatal death (log the precise diagnostic, exit through the ordinary death path); `WatcherDeathGuard`'s death-closes-subscribers behavior unchanged | `stat_identity` / `WatcherDeathGuard` region; `watcher.rs` (`run_poll_loop`, death guard) | ADR-012 §4 (family no-panics standard; observable semantics unchanged) | ours |
| D-08 | port delta | W-4 — watcher connection opens RW: deliberate inheritance, keep RW | `run_poll_loop` region; `watcher.rs` | ADR-012 §4 (keep-RW recorded; not actionable as a change — recorded where the read put it) | ours |
| D-09 | port delta | W-3 — `data_version` u32 wrap: recorded on `poll_data_version`, no action (a wrap fires one spurious wake; wakes are re-read hints) | watcher machinery (notes on `poll_data_version`; `watcher.rs`) | ADR-012 §4 (not actionable — recorded) | ours |
| D-10 | port delta | table family renamed `_honker_*` → `__alkstore_*` across the ported storage surface; no online rename migration (fresh bootstrap only; leftover `_honker_*` orphans are inert and untouched — pinned by test) | bootstrap / schema + notify/stream/lock SQL (`schema.rs`, `ops.rs`) | ADR-011 (naming); ADR-010 §8 (pre-authorization); ADR-008 §4 (storage-internal); ADR-012 §5 | ours |
| D-11 | port delta | bootstrap race swallow re-keyed — on `ALTER TABLE` duplicate-column failure, verify via `pragma_table_info` (present ⇒ benign race swallowed; absent ⇒ propagate); upstream's error-string matching not inherited | bootstrap / schema machinery (`column_present` / `add_column_if_absent`; `schema.rs`) | ADR-012 §5; quality-read §4 (schema brittleness) | ours |
| D-12 | re-derivation | queue ops re-derived on contract v1 (new code, contract-derived names): enqueue + per-job option stamping (`Stamps` — max_attempts, visibility, backoff base, retention — resolved engine-side, applied per row); single-statement `claim_batch` with per-row visibility from the job's own stamps in the claim UPDATE (`claim_expires_at = unixepoch() + visibility_timeout_s`), ordering `priority DESC, run_at ASC, id ASC`, `attempts += 1` per claim, pre-claim dead-letter sweep for exhausted reclaimables; `ack`/`ack_batch`/`heartbeat`/`retry`/`fail` carry the uniform validity predicate (processing + unexpired claim deadline; refusal = 0/false, not error); all dead-letter moves (retry-at-budget, fail, pre-claim sweep, `sweep_expired`) savepoint-guarded via `in_savepoint` (the #133 defect class); both-states no-stranded-rows `sweep_expired` with `dead_letter_retention_s` deletion; dead-visible `get_job` returning the full stamp field list + `last_error`/`died_at`; `cancel` unconditional; default error strings (`"max attempts exceeded"`, `"expired"`) passed in, never owned here; scheduler register/tick/soonest/unregister over `__alkstore_scheduler_tasks` (pause/resume/list/update not carried — register D-21) with `@every`-only boundary math (`parse_every_interval`, s/m/h/d), 64-cap catch-up per tick with skip-forward (`SCHEDULER_MAX_CATCHUP_FIRES`), fire enqueue + row advance in one caller transaction; stamp columns + `claimed_at` added to live/dead/scheduler-table schemas with append-column migrations | queue-op modules (`queue_ops.rs`) + schema (stamp columns, dead-table extensions, retention index) | ADR-011 scope (re-derive); ADR-010 §3a/§5/§1; quality-read D-1–D-3, D-5–D-7 | ours |
| D-13 | hygiene | the substrate stays sync — family porting is the discipline deltas, not an asyncification port; the bridged seam at the engine layer is the async story | whole subtree | ADR-012 §4; ADR-003 (seam) | ours |
| D-14 | hygiene | no panics in library code (see D-07 for the one substantive instance), no `unwrap()`/`expect()` outside tests | whole subtree | AGENTS.md code conventions; ADR-011 (family standard) | ours |
| D-15 | hygiene | no comments in code (doc comments fine) — ported upstream comments elided | whole subtree | AGENTS.md code conventions; ADR-011 (family standard) | ours |
| D-16 | port delta | notify machinery — `notify()` scalar + `__alkstore_notifications` table kept, upstream's no-pruning posture replaced by an at-attach pruning cap (`NOTIFY_ATTACH_MAX_ROWS` = 10k rows, oldest-first trim, implementing ADR-010 §6's engine-internal hygiene) | notify machinery (`attach_notify`; `schema.rs`) | ADR-011 scope; ADR-010 §6 | ours |
| D-17 | port delta | the lineage module structure (everything in `lib.rs` + `honker_ops.rs`) mapped to the substrate subtree's modules: `schema.rs` (pragmas/open, notify, bootstrap, `Writer`, `Readers`), `watcher.rs` (the polling watcher family), `ops.rs` (savepoint discipline, arg coercion, stream/lock ops, function attachments); upstream names preserved inside each | `schema.rs` / `watcher.rs` / `ops.rs` (subtree layout) | ADR-012 §3's fidelity posture applies to names and kept-body shape; the ADR-013 fold makes the module file the unit, and a ~4k-line flat file does not fit a bounded module subtree (AGENTS.md module-per-file); diff reviewability is preserved register-entry by register-entry against upstream's file+line region | ours |
| D-18 | port delta | `file-id` retained (target-gated `cfg(any(unix, windows))` dep, as upstream) — the register's D-02 drop-list names it among the *experimental backends'* optional deps, but it drives the kept dead-man's switch (`stat_identity`), so it stays | `watcher.rs` (`stat_identity`); engine manifest | the kept-half scope (quality-read §6 keeps the dead-man's switch verbatim modulo deltas) overrides D-02's enumeration for this dep; the experimental backends' true deps (`notify`, `memmap2`, `libc`) are cut | ours |
| D-19 | hygiene | scalar-function attachment sites renamed `attach_honker_functions` → `attach_alkstore_functions`, `honker_bootstrap` → `alkstore_bootstrap` (the surface carries the fork's identity in its function names; the coercion helpers keep upstream names `arg_i64`/`arg_opt_i64` per the fidelity posture) | `ops.rs` (`attach_alkstore_functions`) | ADR-011 (fork re-owning names); D-10's naming delta at the SQL-function layer | ours |
| D-20 | port delta | `WatcherConfig` slims to the polling backend's fields (`poll_interval` only; `WatcherBackend` and its parse/probe machinery dropped with D-02); the default poll interval (1 ms) and the 100 ms identity-check interval are inherited verbatim | `watcher.rs` (`WatcherConfig`) | ADR-012 §4 (polling is the only backend); ADR-012 §3 (kept values stay) | ours |
| D-21 | drop | scheduler pause/resume/list/update — the lineage's scalar registrations (`honker_scheduler_pause/resume/list/update` in the `attach_honker_functions` family) and their backing functions not ported: the contract v1 scheduler surface is register-upsert + tick + soonest + unregister (ADR-009: schedule() upserts by name — update = re-register; pause = unregister + re-register are the honest v1 substitutes; no schedule-object CRUD) | honker_ops.rs:1669–1844 (pause/resume/list/update) — absent here | ADR-009 (scheduler collapse; §Negative: richer scheduler deliberately not consumed; contract pins only the v1 surface), realized in D-12 | ours |
| D-22 | drop | the lineage's `in_savepoint` regression tests driven through the re-derive-side `fail()` call shape (a_self_rolled_back_transaction_returns_the_cause_unchanged; fail_leaves_no_open_transaction_when_release_fails) not ported: the substrate's in_savepoint discipline tests (`ops.rs` optional_error_tests) drive the machinery directly and cover the same property classes | honker_ops.rs:2826–2900 — drivers only; the `in_savepoint`/`undo_savepoint_frame` machinery itself is ported verbatim (ops.rs region, register D-17) | drivers belong to the re-derived `fail` (D-04); the discipline tests re-express the same properties directly against the kept machinery | ours |
| D-23 | drop | two lineage watcher/lib.rs durability tests not ported: writer_killed_mid_workload_leaves_db_consistent (python-child WAL crash recovery, lib.rs:1983–2148) and soak_watcher_durability (lib.rs:2163, `#[ignore]`) | lib.rs (test modules) — absent here | external-process/python-child harness not carried into the engine crate's test floor at this wave (test-floor-scoping decision, recorded here for the wave-2 review's call; the ported-surface concurrency floor is ops.rs's pressure suite) | ours |
| D-24 | hygiene | `real_to_i64` boundary error text re-owned ("honker:" prefix → "alkstore:"; the lineage's better-sqlite3-facing sentence elided per D-15) | ops.rs (`real_to_i64`) | D-19's re-owning pattern at the error-string layer | ours |
| D-25 | hygiene | watcher thread name "honker-update-poll" → "alkstore-update-poll" | watcher.rs (spawn path) | D-19's re-owning pattern at the thread-name layer | ours |
| D-26 | hygiene | `volume_serial_number as u64` → `u64::from(volume_serial_number)` in `VolumeIdentity` (clippy lint conformance, zero behavior change) | watcher.rs (`stat_identity` region) | family clippy `-D warnings` gate | ours |
| D-27 | re-derivation | wave-2 review fix — `scheduler_tick`'s fire enqueue resolved the schedule row's relative `expires_s` into the absolute row `expires_at` (`now + s` at the fire transaction, one clock read) instead of passing the relative value through; regression test pins a fired job's `expires_at = fire-instant + s` and its claimability. The pre-fix pass-through would have produced rows expired in 1970 under any `expires_s` schedule | `queue_ops.rs` (`scheduler_tick`, fire-expiry resolution + test) | ADR-020 §2 (relative `expires` → resolved absolute row value, resolved at enqueue against the single clock) — D-12's landed state carried the lineage's `expires_s` field shape without carrying the lineage's enqueue-side resolution; wave-2 review (task review-wave-2) re-derivation spot-check found it | ours |
| D-28 | hygiene | wave-2 review fix — the cross-mechanism pressure test's lock-churn branch exercised a per-producer lock name (literal `"p{producer}"` had no interpolation, so all producers contended on one name) with its result swallowed via `.unwrap_or(0)`; now interpolates, releases periodically, propagates errors | `ops.rs` (pressure test, lock branch) | test-quality only (no lineage counterpart, no library code touched); `fork-provenance-and-floor`'s ported-surface pressure intent | ours |
| D-29 | port delta | `SQLITE_OPEN_URI` dropped from `open_conn`'s flags (the watcher's own opens never carried it — the inherited posture was internally inconsistent); the path argument is a plain filesystem path, `?name=value` suffixes are literal filenames, no connection-semantics mutation outside the engine constructor's opts; pinned by test (`open_conn_treats_uri_shaped_path_as_plain_filename`) | `schema.rs` (`open_conn`) | ADR-023 §3 (plain-path open — the URI parameter surface is SQLite's, not this engine's; no consumer-inventory row names URI features) | ours |
| D-30 | port delta | `open_conn_bootstrapped` — new function stacking the engine's full per-connection open posture (pragmas, notify, `attach_alkstore_functions`, `bootstrap_schema`), and `Readers::acquire`'s open path switched from bare `open_conn` to it (fresh connections only — the pool never re-bootstraps a reused connection). The lineage's pools opened readers pragmas+notify only, the function set + schema living only on the writer; this engine's reader-slot operations (claim/ack, stream reads, lock ops, scheduler checks, leadership probes) run this substrate's SQL functions on pooled connections, so every pooled connection carries the full surface | `schema.rs` (`open_conn_bootstrapped`, `Readers::acquire` open path) | engine-sqlite.md's connection architecture ("each connection runs the substrate's bootstrap at open — the writer and each pooled reader") — engine-layer obligation of `sqlite-engine-open-opts`; landed with the engine's `open` wiring | ours |
| D-31 | port delta | `ack_batch(ids_json)` drops the `worker_id` filter — the D-12 predicate keeps `state = 'processing' AND claim_expires_at >= unixepoch()` per id, but the batch form loses its lineage-shaped `worker_id = ?2` conjunct: the contract's `Queue::ack_batch(ids)` carries no worker identity (ADR-019 §1's surface — the batch ack is the batch form of *ack*, its outcomes are per-id independent, and a queue-scoped handle does not re-bind a claimant at call time). The single-row `ack(job_id, worker_id)` keeps its worker conjunct unchanged | `queue_ops.rs` (`ack_batch` + its substrate test's call shape) | ADR-019 §1 (the `ack_batch(ids) -> count` surface, worker-less); ADR-010 §1 (batch form of ack, per-id predicate); ADR-012 §4 (delta discipline — D-12's re-derivation adjusted) | ours |
| D-32 | drop | `arg_opt_i64` cut (the optional-argument coercion helper) and the engine-level `now_unix` wiring that consumed it: upstream used `arg_opt_i64` at the enqueue/claim-family scalar registrations (honker_ops.rs:382–1158) whose superseded queue functions this fork did not port (D-04) and whose re-derivation (D-12) resolves opts engine-side before the call — the substrate's re-derived entry points take primitives, so no registered SQL function reads an optional i64 argument. Kept: `arg_i64` (the mandatory-arg form, still consumed by the notify/stream/lock function set). The helper's own probe test re-expresses its property through the shared `real_to_i64` coercion directly | `ops.rs` (`arg_opt_i64`; the `optional_arg_helper_keeps_null_and_converts_whole_reals` probe re-shaped) | ADR-012 §2 (the contract-blind boundary: contract semantics resolve engine-side, so the lineage's optional-arg SQL-entry-point shape has no consumer here); wave-3 lint-removal obligation (task sqlite-engine-integration) — cut, not suppressed | ours |
| D-33 | drop | `now_unix` cut from `ops.rs` (the lineage's shared clock read): upstream's single `lib.rs`/`honker_ops.rs` scope shared one clock helper across every op region; the fold (D-17) split the substrate into modules and each region now carries its own `unixepoch()` read — `queue_ops.rs` has its own (D-12's re-derivation), `resolution.rs` owns the engine layer's single-clock read (ADR-020 §1's one-enqueue-one-clock-read, mapped into the contract taxonomy), and `ops.rs`'s lock/stream ops never read the clock outside tests. `ops.rs`'s lock-renew test now reads `unixepoch()` inline; `queue_ops.rs`'s own copy stays (its callers need the fallible-primitive form) | `ops.rs` (helper body; one test's call shape re-expressed) | ADR-012 §3/§4 (module fold made the per-region clock a D-17 fact; the engine-side read is the single clock the contract pinning names — resolution.rs, not a substrate share); wave-3 lint-removal obligation — cut, not suppressed | ours |
| D-34 | drop | `queue_next_claim_at` cut (the queue's earliest-wake deadline query): upstream exposed it as a `honker_queue_next_claim_at` scalar registration for external poll-loop drivers and its leader loop used it to compute the sleep horizon; this fork's leader loop computes the boundary out of `scheduler_tick` + `scheduler_soonest` inside the tick transaction (the engine's scheduler.rs) and exposes no substrate-side next-wake function — the v1 scheduler surface has no consumer-inventory row for one | `queue_ops.rs` (function + its substrate test `queue_next_claim_at_reports_the_earliest_wake`) | ADR-009 (the v1 scheduler collapse: register/tick/soonest/unregister only — D-21's surface rule; no wake-time query on the v1 surface); ADR-012 §2 (the substrate exposes what the engine calls, and the engine never calls this); wave-3 lint-removal obligation — cut, not suppressed | ours |
| D-35 | drop | `Writer::try_acquire` cut (the non-blocking writer-slot try): upstream's embedding harness used it for try-shaped entry points its surface exposed; this engine's seam always blocks (`acquire`) — the writer-slot lease is a *parks-the-writer* lease by design (ADR-007's honest model), so a try-shaped acquire would contradict the posture rather than extend it. The probe tests driving it re-express their properties through `acquire`/`release`/`close` (the engine-reachable surface); the engine-level lease tests (`tx_tests`' lease/parking suite) pin the observable posture end-to-end | `schema.rs` (`Writer::try_acquire` + the three `writer_reader_tests` call sites) | ADR-007 (the caller-held-lease seam: `begin_tx` parks a concurrent writer — no try-shaped begin exists on the contract surface); ADR-012 §2 (nothing on the engine side reaches a try-acquire); wave-3 lint-removal obligation — cut, not suppressed | ours |
| D-36 | drop | `UpdateWatcher::spawn` and `SharedUpdateWatcher::new` cut (the default-cadence convenience constructors): upstream's embedding harnesses opened watchers without explicit config; this engine's single open path always constructs a `WatcherConfig` — from `SqliteOpts` (ADR-023 §4's `poll_interval` knob, `None` = the 1 ms default) — and passes it through `*_with_config`; a config-less twin would re-create two open postures (the mixed-flag inconsistency D-29 resolved at the URI layer). `WatcherConfig::default()` remains the default's single owner; the tests driving the cut constructors now build the config explicitly, pinning the same behavior | `watcher.rs` (both constructors + five watcher-test call sites) | ADR-023 §4 (the cadence knob rides the engine's opts — one open posture carries config); ADR-012 §2 (one construction path the engine reviews); wave-3 lint-removal obligation — cut, not suppressed | ours |
| D-37 | re-derivation | visibility-only widening on the re-derived `@every` surface: `parse_every_interval` (`pub(crate)` → `pub`) and `skip_forward` (module-private → `pub`) in `queue_ops.rs`, plus this subtree's facade re-export (`mod.rs`: `pub use queue_ops::{parse_every_interval, skip_forward}`), so the engine crate root can `#[doc(hidden)] pub use` both as the wave-7 fuzzing differential target's drive surface (`fuzz-parser-exposure`, target `every_parse`). Zero logic change, zero signature change, zero name change; `mod substrate` stays private, so containment holds — nothing leaves the crate except the doc-hidden root re-exports. A `pub use` re-export mechanically requires item-level `pub` (E0364/E0603), which is why the facade line is in `mod.rs`; the module doc's "nothing re-exported" boundary sentence was amended in the same commit to name this sole exception | `queue_ops.rs` (two visibility keywords); `mod.rs` (facade re-export line + boundary-doc exception sentence) | ADR-012 §3 (fidelity governs the ported honker body — `watcher.rs`/`schema.rs`/`ops.rs` untouched; `queue_ops.rs` is the re-derived half, owned contract-v1 code, so a visibility-only delta is legitimate); docs/research/fuzzing.md §3.2 (option (b): the `#[doc(hidden)]` narrow exposure); ADR-017 §3 (doc-hidden test surface, no stability guarantee — the `Job::from_row` precedent) | ours |
| D-38 | port delta | degenerate/adversarial-triple hardening on `skip_forward` (two legs, both aligning to the pg engine's committed clamp shape where it existed and extending pg itself): (1) the `interval` is clamped (`interval.max(1) as i128`) — pre-fix, `interval == 0` panicked on i128 division-by-zero, reachable only through degenerate/non-grammar callers (the parsers reject `n <= 0`, so every engine-internal call site passes `interval >= 1`); (2) the gap is computed in i128 (`now as i128 - next_fire_at as i128`) — pre-fix, `now - next_fire_at` was an **i64 subtraction** that panics in debug (overflow) / silently wraps in release when `(next_fire_at, now)` straddle the full domain (`now=i64::MIN`-adjacent, `next_fire_at=i64::MAX`-adjacent), feeding a wrapped gap to the 128-bit arithmetic and breaking the saturation guarantee. Found by the `every_parse` differential target (wave 7, tasks/fuzz-target-every-parse) driving the adversarial `(next_fire_at, now, interval)` space; pg needed leg (2) as well. Observable behavior unaffected in the reachable domain (|gap| < i64 range), saturation posture now holds over the whole domain. Zero signature change; lineage body untouched (`skip_forward` is the re-derived scheduler half, D-12's own) | `queue_ops.rs` (`skip_forward`, two lines) | docs/research/fuzzing.md §3.2 (the overflow-posture invariant: reject-or-saturate, never wrap or panic, over the whole domain); wave-6's register-overflow alignment (tasks/review-wave-6); alkstore-postgres/src/scheduler.rs `skip_forward` (the pinned clamp shape) | ours |
| D-39 | port delta | watcher-death state machine (review 004 items 2+3, two legs on the ported watcher): (1) **identity-unknown baseline** — the loop's initial identity `stat` failure seeds an unknown baseline instead of the false `(0, 0)`; the first *successful* stat captures it without driving the death path (pre-fix, a transient startup stat hiccup killed the watcher — and closed every subscriber — when the first later stat succeeded); (2) **dead-watcher fail-closed subscribe** — the loop sets a `dead` sign on the caller (`SharedUpdateWatcher`, an `Arc<AtomicBool>`) before exiting through the watcher-fatal path, and `subscribe` becomes fallible, failing closed on the sign (or a taken watcher slot) checked atomically with the enrollment under the senders lock — new subscriptions after a death fail instead of enrolling onto a feed with no poller alive to park forever (the death-guard's clear of *pre-death* subscribers unchanged, D-07 still holds); the engine maps the failure into `Error::Database` at `listen`/stream `subscribe` (ADR-008 §5's opaque fallback). Lineage behavior for both legs was the (0,0)-seed and the infallible enroll | `watcher.rs` (`run_poll_loop`'s baseline/identity arms, `SharedUpdateWatcher`'s dead sign + fallible `subscribe`); `notify.rs`/`stream.rs` (the engine-side mapping) | engine-sqlite.md's watcher-death posture ("new subscriptions fail closed"; identity unknown until the first successful stat); review 004 items 2–3 (tasks/sqlite-fix-watcher-death-subscribe); ADR-006 (the close/fail-closed posture); ADR-012 §4 (delta discipline; D-07's death path refined) | ours |

### Cherry-picks

Empty at scaffold. Entries land here at adoption time (never swept),
one per adopted upstream change, category `cherry-pick`, following
[ADR-018] §3's five-step procedure; each cites the upstream commit
hash(es) in its Lineage field and lands in the same commit as the
applied change, plus one changelog line in the engine crate.