alkstore/alkstore-sqlite/src/substrate/PROVENANCE.md

PROVENANCE — the substrate fork's register

The provenance register for the src/substrate/ module subtree of alkstore-sqlite — per ADR-018 (format and procedure), ADR-011 (the fork decision), ADR-012 (the fork design), and ADR-013 (the fold into the engine crate).

This file records: what lineage this code is, what has been changed relative to that lineage, and how each change arrived. It is the audit trail review works from; it is not itself a guard and not a decision record — the ADRs remain the decisions of record. Entries are append-only (amendment only to correct the record — a wrong path, a mis-cited hash — never to change the story; a superseded delta is a new entry citing the one it supersedes).

1. Upstream identity

• Upstream project: honker (the SQLite queue / notify library), https://github.com/russellromney/honker — substrate package honker-core.
• Fork point: the reference checkout /workspace/honker @ f4e53c6 (full hash f4e53c6b83ad2d6979c04098d576db024ce7e98d, dated 2026-10-02; git describe → package node-v0.5.1-10-gf4e53c6). The fork point is deliberately past the published release: it carries the unreleased fix train (issue #133's savepoint hardening of the DELETE→INSERT dead-letter paths, the claimed_at addition, and related hardening) that the published crates.io artifact (0.5.0, 2026-08-23) does not.
• Published-release lineage: honker-core 0.5.0 (2026-08-23) on crates.io; the fork continues from the repository lineage, not the published tag.
• License: MIT OR Apache-2.0 (upstream's dual license, carried upstream as LICENSE-MIT / LICENSE-APACHE; bundled in-tree as src/substrate/LICENSE, this directory — the preservation obligation's carrier). Sublicensing is permitted by both licenses; the engine crate's license statement covers the whole crate.
• Fork-point statement: the scaffold commits — this subtree's landing in alkstore's git history — are the provenance line, the alksocks extraction-commit-window shape. Everything in the subtree before the first port commit is lineage; every divergence is register-addressable below.
• Inherited lineage facts: the fork point itself carries upstream changes we inherited verbatim and therefore do not list as deltas — the fix train above (4881f27, 3ab43aa, claimed_at et al.) is upstream code, recorded here under upstream identity, not in the delta register.
• Reference checkout: /workspace/honker @ f4e53c6 remains the standing reference for cherry-pick candidates and differential testing — no dependency, no wiring (ADR-012 §6).

2. Delta register

Per [ADR-018] §2: one entry per distinct delta, category-tagged — never one per commit (git history is the per-commit record; this register is the semantic index over it). Each entry pins five fields: Category / What / Where / Why / Lineage.

Categories: port delta (kept-half adaptation), re-derivation (new contract-v1 code), drop (not ported), hygiene (family-standard porting), cherry-pick (adopted upstream lineage).

The entries below are the initial entries fixed by the retained records (ADR-011's scope register, ADR-012 §4–§5) as pre-declared checklist rows — they name deltas the port tasks will make. At the port tasks' landing, entries are updated in place to the landed state (paths finalized, what/why made precise); entries for port-surfaced adaptations the plan didn't anticipate are appended (D-17..D-20, landed with fork-port-connection-watcher).

The entries below are the fork-port deltas as landed by fork-port-connection-watcher (paths finalized against the ported tree). D-12 landed as the re-derivation's queue_ops.rs module + schema extensions with fork-rederive-queue-ops. The gate-time completion pass (fork-provenance-and-floor): the lineage diff vs honker-core @ f4e53c6 was produced and skimmed end-to-end (local only, not committed — the wave-2 review's primary input), and every divergence it surfaced is either a register entry below (D-21..D-26, appended; D-12 annotated in place) or a fixed omission (the lineage-less placeholder test in ops.rs's pressure suite, removed). No unregistered divergence remains. The wave-2 review gate (review-wave-2) re-ran the full-coverage lineage diff (clean — everything register-addressable) and appended D-27/D-28 for its two fixes. D-32..D-36 are the wave-3 lint-removal pass (sqlite-engine-integration): with the engine layer wired, the #![allow(dead_code)]/#![allow(unused_imports)] posture lifted, and the genuinely unreachable ported surface cut rather than suppressed. Cherry-picks: empty at scaffold, append-only forever.

ID	Category	What	Where	Why	Lineage
D-01	drop	cron.rs (cron-string scheduling) not ported	—	ADR-009 rejects cron strings (scheduler collapse; §3)	ours
D-02	drop	experimental watcher backends (kernel-watcher, shm-fast-path) and their optional deps (notify, memmap2, libc, file-id) not ported	—	ADR-011 scope (drop); quality-read §6; cuts optional deps	ours
D-03	drop	rate-limit and result tables (cut-flags) not ported	—	ADR-002 cut-flags; ADR-011 scope (drop)	ours
D-04	drop	superseded queue functions not ported	—	ADR-011 scope (drop); the queue half is re-derived (see R-01)	ours
D-05	port delta	W-1 — bounded reconnect backoff in the watcher reconnect path (MAX_RECONNECT_TICKS = 100 poll ticks between attempts; the lineage reconnected on every tick)	watcher machinery (run_poll_loop region; watcher.rs)	ADR-012 §4; quality-read W-1	ours
D-06	port delta	W-2 — watcher spawn becomes fallible (UpdateWatcher::spawn* / SharedUpdateWatcher::new* return Result); the engine surfaces the failure at open time	watcher machinery (spawn_with_config / spawn_thread region; watcher.rs)	ADR-012 §4; quality-read W-2	ours
D-07	port delta	dead-man's switch — the db-file-identity-change panic replaced by a deliberate watcher-fatal death (log the precise diagnostic, exit through the ordinary death path); WatcherDeathGuard's death-closes-subscribers behavior unchanged	stat_identity / WatcherDeathGuard region; watcher.rs (run_poll_loop, death guard)	ADR-012 §4 (family no-panics standard; observable semantics unchanged)	ours
D-08	port delta	W-4 — watcher connection opens RW: deliberate inheritance, keep RW	run_poll_loop region; watcher.rs	ADR-012 §4 (keep-RW recorded; not actionable as a change — recorded where the read put it)	ours
D-09	port delta	W-3 — data_version u32 wrap: recorded on poll_data_version, no action (a wrap fires one spurious wake; wakes are re-read hints)	watcher machinery (notes on poll_data_version; watcher.rs)	ADR-012 §4 (not actionable — recorded)	ours
D-10	port delta	table family renamed _honker_* → __alkstore_* across the ported storage surface; no online rename migration (fresh bootstrap only; leftover _honker_* orphans are inert and untouched — pinned by test)	bootstrap / schema + notify/stream/lock SQL (schema.rs, ops.rs)	ADR-011 (naming); ADR-010 §8 (pre-authorization); ADR-008 §4 (storage-internal); ADR-012 §5	ours
D-11	port delta	bootstrap race swallow re-keyed — on ALTER TABLE duplicate-column failure, verify via pragma_table_info (present ⇒ benign race swallowed; absent ⇒ propagate); upstream's error-string matching not inherited	bootstrap / schema machinery (column_present / add_column_if_absent; schema.rs)	ADR-012 §5; quality-read §4 (schema brittleness)	ours
D-12	re-derivation	queue ops re-derived on contract v1 (new code, contract-derived names): enqueue + per-job option stamping (Stamps — max_attempts, visibility, backoff base, retention — resolved engine-side, applied per row); single-statement claim_batch with per-row visibility from the job's own stamps in the claim UPDATE (claim_expires_at = unixepoch() + visibility_timeout_s), ordering priority DESC, run_at ASC, id ASC, attempts += 1 per claim, pre-claim dead-letter sweep for exhausted reclaimables; ack/ack_batch/heartbeat/retry/fail carry the uniform validity predicate (processing + unexpired claim deadline; refusal = 0/false, not error); all dead-letter moves (retry-at-budget, fail, pre-claim sweep, sweep_expired) savepoint-guarded via in_savepoint (the #133 defect class); both-states no-stranded-rows sweep_expired with dead_letter_retention_s deletion; dead-visible get_job returning the full stamp field list + last_error/died_at; cancel unconditional; default error strings ("max attempts exceeded", "expired") passed in, never owned here; scheduler register/tick/soonest/unregister over __alkstore_scheduler_tasks (pause/resume/list/update not carried — register D-21) with @every-only boundary math (parse_every_interval, s/m/h/d), 64-cap catch-up per tick with skip-forward (SCHEDULER_MAX_CATCHUP_FIRES), fire enqueue + row advance in one caller transaction; stamp columns + claimed_at added to live/dead/scheduler-table schemas with append-column migrations	queue-op modules (queue_ops.rs) + schema (stamp columns, dead-table extensions, retention index)	ADR-011 scope (re-derive); ADR-010 §3a/§5/§1; quality-read D-1–D-3, D-5–D-7	ours
D-13	hygiene	the substrate stays sync — family porting is the discipline deltas, not an asyncification port; the bridged seam at the engine layer is the async story	whole subtree	ADR-012 §4; ADR-003 (seam)	ours
D-14	hygiene	no panics in library code (see D-07 for the one substantive instance), no unwrap()/expect() outside tests	whole subtree	AGENTS.md code conventions; ADR-011 (family standard)	ours
D-15	hygiene	no comments in code (doc comments fine) — ported upstream comments elided	whole subtree	AGENTS.md code conventions; ADR-011 (family standard)	ours
D-16	port delta	notify machinery — notify() scalar + __alkstore_notifications table kept, upstream's no-pruning posture replaced by an at-attach pruning cap (NOTIFY_ATTACH_MAX_ROWS = 10k rows, oldest-first trim, implementing ADR-010 §6's engine-internal hygiene)	notify machinery (attach_notify; schema.rs)	ADR-011 scope; ADR-010 §6	ours
D-17	port delta	the lineage module structure (everything in lib.rs + honker_ops.rs) mapped to the substrate subtree's modules: schema.rs (pragmas/open, notify, bootstrap, Writer, Readers), watcher.rs (the polling watcher family), ops.rs (savepoint discipline, arg coercion, stream/lock ops, function attachments); upstream names preserved inside each	schema.rs / watcher.rs / ops.rs (subtree layout)	ADR-012 §3's fidelity posture applies to names and kept-body shape; the ADR-013 fold makes the module file the unit, and a ~4k-line flat file does not fit a bounded module subtree (AGENTS.md module-per-file); diff reviewability is preserved register-entry by register-entry against upstream's file+line region	ours
D-18	port delta	file-id retained (target-gated cfg(any(unix, windows)) dep, as upstream) — the register's D-02 drop-list names it among the experimental backends' optional deps, but it drives the kept dead-man's switch (stat_identity), so it stays	watcher.rs (stat_identity); engine manifest	the kept-half scope (quality-read §6 keeps the dead-man's switch verbatim modulo deltas) overrides D-02's enumeration for this dep; the experimental backends' true deps (notify, memmap2, libc) are cut	ours
D-19	hygiene	scalar-function attachment sites renamed attach_honker_functions → attach_alkstore_functions, honker_bootstrap → alkstore_bootstrap (the surface carries the fork's identity in its function names; the coercion helpers keep upstream names arg_i64/arg_opt_i64 per the fidelity posture)	ops.rs (attach_alkstore_functions)	ADR-011 (fork re-owning names); D-10's naming delta at the SQL-function layer	ours
D-20	port delta	WatcherConfig slims to the polling backend's fields (poll_interval only; WatcherBackend and its parse/probe machinery dropped with D-02); the default poll interval (1 ms) and the 100 ms identity-check interval are inherited verbatim	watcher.rs (WatcherConfig)	ADR-012 §4 (polling is the only backend); ADR-012 §3 (kept values stay)	ours
D-21	drop	scheduler pause/resume/list/update — the lineage's scalar registrations (honker_scheduler_pause/resume/list/update in the attach_honker_functions family) and their backing functions not ported: the contract v1 scheduler surface is register-upsert + tick + soonest + unregister (ADR-009: schedule() upserts by name — update = re-register; pause = unregister + re-register are the honest v1 substitutes; no schedule-object CRUD)	honker_ops.rs:1669–1844 (pause/resume/list/update) — absent here	ADR-009 (scheduler collapse; §Negative: richer scheduler deliberately not consumed; contract pins only the v1 surface), realized in D-12	ours
D-22	drop	the lineage's in_savepoint regression tests driven through the re-derive-side fail() call shape (a_self_rolled_back_transaction_returns_the_cause_unchanged; fail_leaves_no_open_transaction_when_release_fails) not ported: the substrate's in_savepoint discipline tests (ops.rs optional_error_tests) drive the machinery directly and cover the same property classes	honker_ops.rs:2826–2900 — drivers only; the in_savepoint/undo_savepoint_frame machinery itself is ported verbatim (ops.rs region, register D-17)	drivers belong to the re-derived fail (D-04); the discipline tests re-express the same properties directly against the kept machinery	ours
D-23	drop	two lineage watcher/lib.rs durability tests not ported: writer_killed_mid_workload_leaves_db_consistent (python-child WAL crash recovery, lib.rs:1983–2148) and soak_watcher_durability (lib.rs:2163, #[ignore])	lib.rs (test modules) — absent here	external-process/python-child harness not carried into the engine crate's test floor at this wave (test-floor-scoping decision, recorded here for the wave-2 review's call; the ported-surface concurrency floor is ops.rs's pressure suite)	ours
D-24	hygiene	real_to_i64 boundary error text re-owned ("honker:" prefix → "alkstore:"; the lineage's better-sqlite3-facing sentence elided per D-15)	ops.rs (real_to_i64)	D-19's re-owning pattern at the error-string layer	ours
D-25	hygiene	watcher thread name "honker-update-poll" → "alkstore-update-poll"	watcher.rs (spawn path)	D-19's re-owning pattern at the thread-name layer	ours
D-26	hygiene	volume_serial_number as u64 → u64::from(volume_serial_number) in VolumeIdentity (clippy lint conformance, zero behavior change)	watcher.rs (stat_identity region)	family clippy -D warnings gate	ours
D-27	re-derivation	wave-2 review fix — scheduler_tick's fire enqueue resolved the schedule row's relative expires_s into the absolute row expires_at (now + s at the fire transaction, one clock read) instead of passing the relative value through; regression test pins a fired job's expires_at = fire-instant + s and its claimability. The pre-fix pass-through would have produced rows expired in 1970 under any expires_s schedule	queue_ops.rs (scheduler_tick, fire-expiry resolution + test)	ADR-020 §2 (relative expires → resolved absolute row value, resolved at enqueue against the single clock) — D-12's landed state carried the lineage's expires_s field shape without carrying the lineage's enqueue-side resolution; wave-2 review (task review-wave-2) re-derivation spot-check found it	ours
D-28	hygiene	wave-2 review fix — the cross-mechanism pressure test's lock-churn branch exercised a per-producer lock name (literal "p{producer}" had no interpolation, so all producers contended on one name) with its result swallowed via .unwrap_or(0); now interpolates, releases periodically, propagates errors	ops.rs (pressure test, lock branch)	test-quality only (no lineage counterpart, no library code touched); fork-provenance-and-floor's ported-surface pressure intent	ours
D-29	port delta	SQLITE_OPEN_URI dropped from open_conn's flags (the watcher's own opens never carried it — the inherited posture was internally inconsistent); the path argument is a plain filesystem path, ?name=value suffixes are literal filenames, no connection-semantics mutation outside the engine constructor's opts; pinned by test (open_conn_treats_uri_shaped_path_as_plain_filename)	schema.rs (open_conn)	ADR-023 §3 (plain-path open — the URI parameter surface is SQLite's, not this engine's; no consumer-inventory row names URI features)	ours
D-30	port delta	open_conn_bootstrapped — new function stacking the engine's full per-connection open posture (pragmas, notify, attach_alkstore_functions, bootstrap_schema), and Readers::acquire's open path switched from bare open_conn to it (fresh connections only — the pool never re-bootstraps a reused connection). The lineage's pools opened readers pragmas+notify only, the function set + schema living only on the writer; this engine's reader-slot operations (claim/ack, stream reads, lock ops, scheduler checks, leadership probes) run this substrate's SQL functions on pooled connections, so every pooled connection carries the full surface	schema.rs (open_conn_bootstrapped, Readers::acquire open path)	engine-sqlite.md's connection architecture ("each connection runs the substrate's bootstrap at open — the writer and each pooled reader") — engine-layer obligation of sqlite-engine-open-opts; landed with the engine's open wiring	ours
D-31	port delta	ack_batch(ids_json) drops the worker_id filter — the D-12 predicate keeps state = 'processing' AND claim_expires_at >= unixepoch() per id, but the batch form loses its lineage-shaped worker_id = ?2 conjunct: the contract's Queue::ack_batch(ids) carries no worker identity (ADR-019 §1's surface — the batch ack is the batch form of ack, its outcomes are per-id independent, and a queue-scoped handle does not re-bind a claimant at call time). The single-row ack(job_id, worker_id) keeps its worker conjunct unchanged	queue_ops.rs (ack_batch + its substrate test's call shape)	ADR-019 §1 (the ack_batch(ids) -> count surface, worker-less); ADR-010 §1 (batch form of ack, per-id predicate); ADR-012 §4 (delta discipline — D-12's re-derivation adjusted)	ours
D-32	drop	arg_opt_i64 cut (the optional-argument coercion helper) and the engine-level now_unix wiring that consumed it: upstream used arg_opt_i64 at the enqueue/claim-family scalar registrations (honker_ops.rs:382–1158) whose superseded queue functions this fork did not port (D-04) and whose re-derivation (D-12) resolves opts engine-side before the call — the substrate's re-derived entry points take primitives, so no registered SQL function reads an optional i64 argument. Kept: arg_i64 (the mandatory-arg form, still consumed by the notify/stream/lock function set). The helper's own probe test re-expresses its property through the shared real_to_i64 coercion directly	ops.rs (arg_opt_i64; the optional_arg_helper_keeps_null_and_converts_whole_reals probe re-shaped)	ADR-012 §2 (the contract-blind boundary: contract semantics resolve engine-side, so the lineage's optional-arg SQL-entry-point shape has no consumer here); wave-3 lint-removal obligation (task sqlite-engine-integration) — cut, not suppressed	ours
D-33	drop	now_unix cut from ops.rs (the lineage's shared clock read): upstream's single lib.rs/honker_ops.rs scope shared one clock helper across every op region; the fold (D-17) split the substrate into modules and each region now carries its own unixepoch() read — queue_ops.rs has its own (D-12's re-derivation), resolution.rs owns the engine layer's single-clock read (ADR-020 §1's one-enqueue-one-clock-read, mapped into the contract taxonomy), and ops.rs's lock/stream ops never read the clock outside tests. ops.rs's lock-renew test now reads unixepoch() inline; queue_ops.rs's own copy stays (its callers need the fallible-primitive form)	ops.rs (helper body; one test's call shape re-expressed)	ADR-012 §3/§4 (module fold made the per-region clock a D-17 fact; the engine-side read is the single clock the contract pinning names — resolution.rs, not a substrate share); wave-3 lint-removal obligation — cut, not suppressed	ours
D-34	drop	queue_next_claim_at cut (the queue's earliest-wake deadline query): upstream exposed it as a honker_queue_next_claim_at scalar registration for external poll-loop drivers and its leader loop used it to compute the sleep horizon; this fork's leader loop computes the boundary out of scheduler_tick + scheduler_soonest inside the tick transaction (the engine's scheduler.rs) and exposes no substrate-side next-wake function — the v1 scheduler surface has no consumer-inventory row for one	queue_ops.rs (function + its substrate test queue_next_claim_at_reports_the_earliest_wake)	ADR-009 (the v1 scheduler collapse: register/tick/soonest/unregister only — D-21's surface rule; no wake-time query on the v1 surface); ADR-012 §2 (the substrate exposes what the engine calls, and the engine never calls this); wave-3 lint-removal obligation — cut, not suppressed	ours
D-35	drop	Writer::try_acquire cut (the non-blocking writer-slot try): upstream's embedding harness used it for try-shaped entry points its surface exposed; this engine's seam always blocks (acquire) — the writer-slot lease is a parks-the-writer lease by design (ADR-007's honest model), so a try-shaped acquire would contradict the posture rather than extend it. The probe tests driving it re-express their properties through acquire/release/close (the engine-reachable surface); the engine-level lease tests (tx_tests' lease/parking suite) pin the observable posture end-to-end	schema.rs (Writer::try_acquire + the three writer_reader_tests call sites)	ADR-007 (the caller-held-lease seam: begin_tx parks a concurrent writer — no try-shaped begin exists on the contract surface); ADR-012 §2 (nothing on the engine side reaches a try-acquire); wave-3 lint-removal obligation — cut, not suppressed	ours
D-36	drop	UpdateWatcher::spawn and SharedUpdateWatcher::new cut (the default-cadence convenience constructors): upstream's embedding harnesses opened watchers without explicit config; this engine's single open path always constructs a WatcherConfig — from SqliteOpts (ADR-023 §4's poll_interval knob, None = the 1 ms default) — and passes it through *_with_config; a config-less twin would re-create two open postures (the mixed-flag inconsistency D-29 resolved at the URI layer). WatcherConfig::default() remains the default's single owner; the tests driving the cut constructors now build the config explicitly, pinning the same behavior	watcher.rs (both constructors + five watcher-test call sites)	ADR-023 §4 (the cadence knob rides the engine's opts — one open posture carries config); ADR-012 §2 (one construction path the engine reviews); wave-3 lint-removal obligation — cut, not suppressed	ours
D-37	re-derivation	visibility-only widening on the re-derived @every surface: parse_every_interval (pub(crate) → pub) and skip_forward (module-private → pub) in queue_ops.rs, plus this subtree's facade re-export (mod.rs: pub use queue_ops::{parse_every_interval, skip_forward}), so the engine crate root can #[doc(hidden)] pub use both as the wave-7 fuzzing differential target's drive surface (fuzz-parser-exposure, target every_parse). Zero logic change, zero signature change, zero name change; mod substrate stays private, so containment holds — nothing leaves the crate except the doc-hidden root re-exports. A pub use re-export mechanically requires item-level pub (E0364/E0603), which is why the facade line is in mod.rs; the module doc's "nothing re-exported" boundary sentence was amended in the same commit to name this sole exception	queue_ops.rs (two visibility keywords); mod.rs (facade re-export line + boundary-doc exception sentence)	ADR-012 §3 (fidelity governs the ported honker body — watcher.rs/schema.rs/ops.rs untouched; queue_ops.rs is the re-derived half, owned contract-v1 code, so a visibility-only delta is legitimate); docs/research/fuzzing.md §3.2 (option (b): the #[doc(hidden)] narrow exposure); ADR-017 §3 (doc-hidden test surface, no stability guarantee — the Job::from_row precedent)	ours
D-38	port delta	degenerate/adversarial-triple hardening on skip_forward (two legs, both aligning to the pg engine's committed clamp shape where it existed and extending pg itself): (1) the interval is clamped (interval.max(1) as i128) — pre-fix, interval == 0 panicked on i128 division-by-zero, reachable only through degenerate/non-grammar callers (the parsers reject n <= 0, so every engine-internal call site passes interval >= 1); (2) the gap is computed in i128 (now as i128 - next_fire_at as i128) — pre-fix, now - next_fire_at was an i64 subtraction that panics in debug (overflow) / silently wraps in release when (next_fire_at, now) straddle the full domain (now=i64::MIN-adjacent, next_fire_at=i64::MAX-adjacent), feeding a wrapped gap to the 128-bit arithmetic and breaking the saturation guarantee. Found by the every_parse differential target (wave 7, tasks/fuzz-target-every-parse) driving the adversarial (next_fire_at, now, interval) space; pg needed leg (2) as well. Observable behavior unaffected in the reachable domain (	gap	< i64 range), saturation posture now holds over the whole domain. Zero signature change; lineage body untouched (skip_forward is the re-derived scheduler half, D-12's own)	queue_ops.rs (skip_forward, two lines)
D-39	port delta	watcher-death state machine (review 004 items 2+3, two legs on the ported watcher): (1) identity-unknown baseline — the loop's initial identity stat failure seeds an unknown baseline instead of the false (0, 0); the first successful stat captures it without driving the death path (pre-fix, a transient startup stat hiccup killed the watcher — and closed every subscriber — when the first later stat succeeded); (2) dead-watcher fail-closed subscribe — the loop sets a dead sign on the caller (SharedUpdateWatcher, an Arc<AtomicBool>) before exiting through the watcher-fatal path, and subscribe becomes fallible, failing closed on the sign (or a taken watcher slot) checked atomically with the enrollment under the senders lock — new subscriptions after a death fail instead of enrolling onto a feed with no poller alive to park forever (the death-guard's clear of pre-death subscribers unchanged, D-07 still holds); the engine maps the failure into Error::Database at listen/stream subscribe (ADR-008 §5's opaque fallback). Lineage behavior for both legs was the (0,0)-seed and the infallible enroll	watcher.rs (run_poll_loop's baseline/identity arms, SharedUpdateWatcher's dead sign + fallible subscribe); notify.rs/stream.rs (the engine-side mapping)	engine-sqlite.md's watcher-death posture ("new subscriptions fail closed"; identity unknown until the first successful stat); review 004 items 2–3 (tasks/sqlite-fix-watcher-death-subscribe); ADR-006 (the close/fail-closed posture); ADR-012 §4 (delta discipline; D-07's death path refined)	ours

Cherry-picks

Empty at scaffold. Entries land here at adoption time (never swept), one per adopted upstream change, category cherry-pick, following [ADR-018] §3's five-step procedure; each cites the upstream commit hash(es) in its Lineage field and lands in the same commit as the applied change, plus one changelog line in the engine crate.