alkstore/tasks/release-deployment-matrix.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
release-deployment-matrix	Deployment matrix final pass — all three engines, release text	completed	release-n1-growth-posture	moderate	low	component	implementation	wave-8 docs deployment

Description

The plan's wave-8 "deployment matrix final pass (across all three engines now)": docs/architecture/deployment.md read row-by-row against the three implemented engines and finalized as release text — the document is ADR-016's honesty carrier (with the engine crates' own docs), so every row must be true as implemented, not as designed.

1. Row-by-row verification: host semantics, connection budgets (SQLite writer/reader/watcher; pg max_size + the non-pooled listener; mem's none), durability knobs, TLS posture (v1), toolchain/platform notes (incl. the mem wasm32 row), consumer- obligation notes on engine options, and the latency profile's "indicative, POC-measured" honesty (POC-measured numbers published as indicative — confirm the caveat text is still accurate or refresh it against the contract suite's existence).
2. The env-variable boundary pin (review 003's explicit re-check-at-prepublish item): re-run the no-env-in-production grep across the workspace (review 003 §Env-variable boundary has the method + the prior result), confirm every env::var read still lives in a test target, and pin the boundary in one sentence in deployment.md (and the engine specs if the sentence belongs there too): "env reads are harness-only; production configuration is the opts-constructor surface."
3. Fold N-1's outcome: the growth-posture acceptance (release-n1-growth-posture's record) lands in the matrix's durability/growth text.
4. The mem rows' final honesty check: ADR-024 landed them at adoption; the wave-6 gate read them true — this pass re-reads them as release text (ephemerality, isolation, wasm toolchain note).
5. Release-text quality: the document should stand alone for a deployer sizing any of the three engines — no dangling references to waves/tasks/POCs that a consumer wouldn't have context for (POC-measured caveats stay, internal task pointers go).

Acceptance Criteria

• Every deployment.md row verified true as implemented across the three engines; corrections landed
• The env-boundary grep re-run (result recorded) + the boundary sentence pinned in deployment.md
• N-1's acceptance folded into the growth/durability text
• The mem rows re-read as release text
• No internal-task/wave pointers remain in the release-facing text (POC-measured caveats excepted)
• Workspace gates green (docs-only expected)

References

• docs/architecture/deployment.md (the document)
• docs/architecture/decisions/016-deployment-honesty.md (the carrier mandate)
• docs/reviews/003-wave-5-general-review.md §Env-variable boundary (the re-check item + method)
• tasks/release-n1-growth-posture.md (the input this pass folds)
• docs/architecture/engine-mem.md (the mem rows' spec source)

Notes

• Row-by-row verification was against code, not just the ADRs. Code-verified true: WAL + synchronous = NORMAL at connection bootstrap (substrate/schema.rs DEFAULT_PRAGMAS); SqliteOpts::poll_interval (1 ms default, zero rejected → Error::Database), max_readers (0 clamps to 1); synchronous_commit wired as -c synchronous_commit=… on every pooled connection, default on; NoTls on all three pg connection paths (pool, listener, forwarder reconnect); listener application_name {prefix}-{pid}-{seq}; PgOpts::max_size 0 rejected at open; the queue-stamp mis-set behaviors on all three engines (pre-claim attempts >= max_attempts arm: sqlite queue_ops.rs:404, pg queue.rs:357, mem queue.rs:128; "max attempts exceeded" reason strings); D-16's NOTIFY_ATTACH_MAX_ROWS = 10,000 oldest-first at-attach trim.
• Corrections landed (the pass's real findings):
  1. "FULL is available consumer-side for stricter durability" was false as implemented — the engine hardwires the pragma at bootstrap on every connection with no consumer surface; the row now states the fixed posture and names a FULL option as a post-v1 engine-surface addition.
  2. "both engines" → all three — the consumer-obligation queue-stamp paragraph predated mem.
  3. "max_size: the one knob with an engine-side guard" was understated — the trusted-as-given paragraph now lists the three guards the code actually carries (max_size 0 rejected, poll_interval 0 rejected, max_readers clamped) and re-pins the queue stamps as the unvalidated surface.
  4. The NFS honesty cited ADR-003 but ADR-016 carries it — citation fixed, phrasing de-internaled ("a .db on network storage is not a supportable deployment posture").
  5. The mem durability row's "wake latency is sub-millisecond" had no source anywhere in the repo (no POC measured mem; no spec states the number) — replaced with the structural, verifiable statement (in-process channel send at the commit boundary, no round-trip class to budget), and the latency profile gained a mem bullet stating honestly that no POC measured it (which also removed the "both POCs" three-engine dangling coverage).
• Env-boundary re-check (review 003's method re-run): grep across the workspace — every env::var read lives in a test target (10 pg test modules' DSN plumbing; std::env::temp_dir() for test temp files only); production paths (core, all three engines, the constructors) are env-free. Result unchanged from prior review. The boundary is pinned in a new ## Configuration boundary section ("env reads are harness-only; production configuration is the opts-constructor surface") plus the caller-side family pattern for a future env convenience. No engine-spec placement added — the engine specs' opts docs already state the constructor surface, and the one sentence belongs in the matrix.
• N-1 fold: the growth-posture acceptance section stands as the release durability/growth text; the "this record is the input the deployment-matrix final pass folds in" positioning sentence was removed (folded this pass), the bare "(D-16)" references were attributed ("the substrate provenance register's D-16 port delta, ADR-010 §6"), and the mem paragraph (process-lifetime-bounded by design) retained verbatim from the N-1 record.
• Internal pointers removed: "POC #1"/"POC #2" numbered refs (checkpoint cadence → "POC-measured"; through-network posture → "measured" with ADR-004 citation), "POC #2's pgdiag-st-4" sizing parenthetical → generic pg_stat_activity accounting note, the alkblobs absolute workspace path in the co-tenancy paragraph, and the "wave-6 acceptance" pointer in the wasm toolchain row.
• Frontmatter: status draft → stable (release text; matching the engine specs' convention). POC-measured caveats and numbers kept (verified against the POC findings docs — e.g. the SQLite ~0.35 ms p50 matches the shipped spawn_blocking seam's 0.354 ms).

Summary

Every deployment.md row was read against the three implemented engines; all rows verified true as implemented except the five corrections above (one honesty-critical false claim — the consumer-side FULL durability option — plus stale two-engine wording, an understated guard list, a mis-cited ADR, and an unsourced mem latency number). The env-variable boundary grep was re-run clean (harness-only) and pinned in a new Configuration boundary section; N-1's growth-posture acceptance is folded into the release growth text with the task-positioning pointer removed; the mem rows hold true as release text; no internal task/wave pointers remain in the release-facing text (POC-measured caveats kept). Docs only: deployment.md + this task file. Workspace gates green (cargo build, cargo test — 15 suites ok, cargo clippy --all-targets -- -D warnings, cargo fmt --check, RUSTDOCFLAGS="-D warnings" cargo doc --no-deps, fuzz corpus replay ok).