--- id: release-deployment-matrix name: Deployment matrix final pass — all three engines, release text status: completed depends_on: [release-n1-growth-posture] scope: moderate risk: low impact: component level: implementation tags: [wave-8, docs, deployment] --- ## Description The plan's wave-8 "deployment matrix final pass (across all three engines now)": `docs/architecture/deployment.md` read row-by-row against the three implemented engines and finalized as release text — the document is ADR-016's honesty carrier (with the engine crates' own docs), so every row must be true as implemented, not as designed. 1. **Row-by-row verification**: host semantics, connection budgets (SQLite writer/reader/watcher; pg `max_size` + the non-pooled listener; mem's none), durability knobs, TLS posture (v1), toolchain/platform notes (incl. the mem wasm32 row), consumer- obligation notes on engine options, and the latency profile's "indicative, POC-measured" honesty (POC-measured numbers published as indicative — confirm the caveat text is still accurate or refresh it against the contract suite's existence). 2. **The env-variable boundary pin** (review 003's explicit re-check-at-prepublish item): re-run the no-env-in-production grep across the workspace (review 003 §Env-variable boundary has the method + the prior result), confirm every `env::var` read still lives in a test target, and pin the boundary in one sentence in deployment.md (and the engine specs if the sentence belongs there too): "env reads are harness-only; production configuration is the opts-constructor surface." 3. **Fold N-1's outcome**: the growth-posture acceptance (`release-n1-growth-posture`'s record) lands in the matrix's durability/growth text. 4. **The mem rows' final honesty check**: ADR-024 landed them at adoption; the wave-6 gate read them true — this pass re-reads them as release text (ephemerality, isolation, wasm toolchain note). 5. **Release-text quality**: the document should stand alone for a deployer sizing any of the three engines — no dangling references to waves/tasks/POCs that a consumer wouldn't have context for (POC-measured caveats stay, internal task pointers go). ## Acceptance Criteria - [x] Every deployment.md row verified true as implemented across the three engines; corrections landed - [x] The env-boundary grep re-run (result recorded) + the boundary sentence pinned in deployment.md - [x] N-1's acceptance folded into the growth/durability text - [x] The mem rows re-read as release text - [x] No internal-task/wave pointers remain in the release-facing text (POC-measured caveats excepted) - [x] Workspace gates green (docs-only expected) ## References - docs/architecture/deployment.md (the document) - docs/architecture/decisions/016-deployment-honesty.md (the carrier mandate) - docs/reviews/003-wave-5-general-review.md §Env-variable boundary (the re-check item + method) - tasks/release-n1-growth-posture.md (the input this pass folds) - docs/architecture/engine-mem.md (the mem rows' spec source) ## Notes - **Row-by-row verification was against code, not just the ADRs.** Code-verified true: WAL + `synchronous = NORMAL` at connection bootstrap (`substrate/schema.rs` DEFAULT_PRAGMAS); `SqliteOpts::poll_interval` (1 ms default, zero rejected → `Error::Database`), `max_readers` (0 clamps to 1); `synchronous_commit` wired as `-c synchronous_commit=…` on every pooled connection, default on; `NoTls` on all three pg connection paths (pool, listener, forwarder reconnect); listener `application_name` `{prefix}-{pid}-{seq}`; `PgOpts::max_size` 0 rejected at open; the queue-stamp mis-set behaviors on all three engines (pre-claim `attempts >= max_attempts` arm: sqlite `queue_ops.rs:404`, pg `queue.rs:357`, mem `queue.rs:128`; "max attempts exceeded" reason strings); D-16's `NOTIFY_ATTACH_MAX_ROWS` = 10,000 oldest-first at-attach trim. - **Corrections landed (the pass's real findings):** 1. *"FULL is available consumer-side for stricter durability" was false as implemented* — the engine hardwires the pragma at bootstrap on every connection with no consumer surface; the row now states the fixed posture and names a `FULL` option as a post-v1 engine-surface addition. 2. *"both engines" → all three* — the consumer-obligation queue-stamp paragraph predated mem. 3. *"`max_size`: the one knob with an engine-side guard" was understated* — the trusted-as-given paragraph now lists the three guards the code actually carries (`max_size` 0 rejected, `poll_interval` 0 rejected, `max_readers` clamped) and re-pins the queue stamps as the unvalidated surface. 4. *The NFS honesty cited ADR-003 but ADR-016 carries it* — citation fixed, phrasing de-internaled ("a `.db` on network storage is not a supportable deployment posture"). 5. *The mem durability row's "wake latency is sub-millisecond" had no source anywhere in the repo* (no POC measured mem; no spec states the number) — replaced with the structural, verifiable statement (in-process channel send at the commit boundary, no round-trip class to budget), and the latency profile gained a mem bullet stating honestly that no POC measured it (which also removed the "both POCs" three-engine dangling coverage). - **Env-boundary re-check (review 003's method re-run):** grep across the workspace — every `env::var` read lives in a test target (10 pg test modules' DSN plumbing; `std::env::temp_dir()` for test temp files only); production paths (core, all three engines, the constructors) are env-free. Result unchanged from prior review. The boundary is pinned in a new `## Configuration boundary` section ("env reads are harness-only; production configuration is the opts-constructor surface") plus the caller-side family pattern for a future env convenience. No engine-spec placement added — the engine specs' opts docs already state the constructor surface, and the one sentence belongs in the matrix. - **N-1 fold:** the growth-posture acceptance section stands as the release durability/growth text; the "this record is the input the deployment-matrix final pass folds in" positioning sentence was removed (folded this pass), the bare "(D-16)" references were attributed ("the substrate provenance register's D-16 port delta, ADR-010 §6"), and the mem paragraph (process-lifetime-bounded by design) retained verbatim from the N-1 record. - **Internal pointers removed:** "POC #1"/"POC #2" numbered refs (checkpoint cadence → "POC-measured"; through-network posture → "measured" with ADR-004 citation), "POC #2's pgdiag-st-4" sizing parenthetical → generic `pg_stat_activity` accounting note, the alkblobs absolute workspace path in the co-tenancy paragraph, and the "wave-6 acceptance" pointer in the wasm toolchain row. - **Frontmatter:** status `draft` → `stable` (release text; matching the engine specs' convention). POC-measured caveats and numbers kept (verified against the POC findings docs — e.g. the SQLite ~0.35 ms p50 matches the shipped spawn_blocking seam's 0.354 ms). ## Summary Every deployment.md row was read against the three implemented engines; all rows verified true as implemented except the five corrections above (one honesty-critical false claim — the consumer-side `FULL` durability option — plus stale two-engine wording, an understated guard list, a mis-cited ADR, and an unsourced mem latency number). The env-variable boundary grep was re-run clean (harness-only) and pinned in a new Configuration boundary section; N-1's growth-posture acceptance is folded into the release growth text with the task-positioning pointer removed; the mem rows hold true as release text; no internal task/wave pointers remain in the release-facing text (POC-measured caveats kept). Docs only: `deployment.md` + this task file. Workspace gates green (`cargo build`, `cargo test` — 15 suites ok, `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`, `RUSTDOCFLAGS="-D warnings" cargo doc --no-deps`, fuzz corpus replay ok).