alkstore/tasks/release-deployment-matrix.md

---
id: release-deployment-matrix
name: Deployment matrix final pass — all three engines, release text
status: completed
depends_on: [release-n1-growth-posture]
scope: moderate
risk: low
impact: component
level: implementation
tags: [wave-8, docs, deployment]
---

## Description

The plan's wave-8 "deployment matrix final pass (across all three
engines now)": `docs/architecture/deployment.md` read row-by-row
against the three implemented engines and finalized as release text —
the document is ADR-016's honesty carrier (with the engine crates'
own docs), so every row must be true as implemented, not as designed.

1. **Row-by-row verification**: host semantics, connection budgets
   (SQLite writer/reader/watcher; pg `max_size` + the non-pooled
   listener; mem's none), durability knobs, TLS posture (v1),
   toolchain/platform notes (incl. the mem wasm32 row), consumer-
   obligation notes on engine options, and the latency profile's
   "indicative, POC-measured" honesty (POC-measured numbers published
   as indicative — confirm the caveat text is still accurate or
   refresh it against the contract suite's existence).
2. **The env-variable boundary pin** (review 003's explicit
   re-check-at-prepublish item): re-run the no-env-in-production grep
   across the workspace (review 003 §Env-variable boundary has the
   method + the prior result), confirm every `env::var` read still
   lives in a test target, and pin the boundary in one sentence in
   deployment.md (and the engine specs if the sentence belongs there
   too): "env reads are harness-only; production configuration is the
   opts-constructor surface."
3. **Fold N-1's outcome**: the growth-posture acceptance
   (`release-n1-growth-posture`'s record) lands in the matrix's
   durability/growth text.
4. **The mem rows' final honesty check**: ADR-024 landed them at
   adoption; the wave-6 gate read them true — this pass re-reads them
   as release text (ephemerality, isolation, wasm toolchain note).
5. **Release-text quality**: the document should stand alone for a
   deployer sizing any of the three engines — no dangling references
   to waves/tasks/POCs that a consumer wouldn't have context for
   (POC-measured caveats stay, internal task pointers go).

## Acceptance Criteria

- [x] Every deployment.md row verified true as implemented across the
      three engines; corrections landed
- [x] The env-boundary grep re-run (result recorded) + the boundary
      sentence pinned in deployment.md
- [x] N-1's acceptance folded into the growth/durability text
- [x] The mem rows re-read as release text
- [x] No internal-task/wave pointers remain in the release-facing text
      (POC-measured caveats excepted)
- [x] Workspace gates green (docs-only expected)

## References

- docs/architecture/deployment.md (the document)
- docs/architecture/decisions/016-deployment-honesty.md (the carrier
  mandate)
- docs/reviews/003-wave-5-general-review.md §Env-variable boundary
  (the re-check item + method)
- tasks/release-n1-growth-posture.md (the input this pass folds)
- docs/architecture/engine-mem.md (the mem rows' spec source)

## Notes

- **Row-by-row verification was against code, not just the ADRs.**
  Code-verified true: WAL + `synchronous = NORMAL` at connection
  bootstrap (`substrate/schema.rs` DEFAULT_PRAGMAS);
  `SqliteOpts::poll_interval` (1 ms default, zero rejected →
  `Error::Database`), `max_readers` (0 clamps to 1);
  `synchronous_commit` wired as `-c synchronous_commit=…` on every
  pooled connection, default on; `NoTls` on all three pg connection
  paths (pool, listener, forwarder reconnect); listener
  `application_name` `{prefix}-{pid}-{seq}`; `PgOpts::max_size` 0
  rejected at open; the queue-stamp mis-set behaviors on all three
  engines (pre-claim `attempts >= max_attempts` arm: sqlite
  `queue_ops.rs:404`, pg `queue.rs:357`, mem `queue.rs:128`;
  "max attempts exceeded" reason strings); D-16's
  `NOTIFY_ATTACH_MAX_ROWS` = 10,000 oldest-first at-attach trim.
- **Corrections landed (the pass's real findings):**
  1. *"FULL is available consumer-side for stricter durability" was
     false as implemented* — the engine hardwires the pragma at
     bootstrap on every connection with no consumer surface; the row
     now states the fixed posture and names a `FULL` option as a
     post-v1 engine-surface addition.
  2. *"both engines" → all three* — the consumer-obligation queue-stamp
     paragraph predated mem.
  3. *"`max_size`: the one knob with an engine-side guard" was
     understated* — the trusted-as-given paragraph now lists the three
     guards the code actually carries (`max_size` 0 rejected,
     `poll_interval` 0 rejected, `max_readers` clamped) and re-pins
     the queue stamps as the unvalidated surface.
  4. *The NFS honesty cited ADR-003 but ADR-016 carries it* —
     citation fixed, phrasing de-internaled ("a `.db` on network
     storage is not a supportable deployment posture").
  5. *The mem durability row's "wake latency is sub-millisecond" had
     no source anywhere in the repo* (no POC measured mem; no spec
     states the number) — replaced with the structural, verifiable
     statement (in-process channel send at the commit boundary, no
     round-trip class to budget), and the latency profile gained a mem
     bullet stating honestly that no POC measured it (which also
     removed the "both POCs" three-engine dangling coverage).
- **Env-boundary re-check (review 003's method re-run):** grep across
  the workspace — every `env::var` read lives in a test target
  (10 pg test modules' DSN plumbing; `std::env::temp_dir()` for test
  temp files only); production paths (core, all three engines, the
  constructors) are env-free. Result unchanged from prior review. The
  boundary is pinned in a new `## Configuration boundary` section
  ("env reads are harness-only; production configuration is the
  opts-constructor surface") plus the caller-side family pattern for
  a future env convenience. No engine-spec placement added — the
  engine specs' opts docs already state the constructor surface, and
  the one sentence belongs in the matrix.
- **N-1 fold:** the growth-posture acceptance section stands as the
  release durability/growth text; the "this record is the input the
  deployment-matrix final pass folds in" positioning sentence was
  removed (folded this pass), the bare "(D-16)" references were
  attributed ("the substrate provenance register's D-16 port delta,
  ADR-010 §6"), and the mem paragraph (process-lifetime-bounded by
  design) retained verbatim from the N-1 record.
- **Internal pointers removed:** "POC #1"/"POC #2" numbered refs
  (checkpoint cadence → "POC-measured"; through-network posture →
  "measured" with ADR-004 citation), "POC #2's pgdiag-st-4" sizing
  parenthetical → generic `pg_stat_activity` accounting note, the
  alkblobs absolute workspace path in the co-tenancy paragraph, and
  the "wave-6 acceptance" pointer in the wasm toolchain row.
- **Frontmatter:** status `draft` → `stable` (release text; matching
  the engine specs' convention). POC-measured caveats and numbers
  kept (verified against the POC findings docs — e.g. the SQLite
  ~0.35 ms p50 matches the shipped spawn_blocking seam's 0.354 ms).

## Summary

Every deployment.md row was read against the three implemented
engines; all rows verified true as implemented except the five
corrections above (one honesty-critical false claim — the
consumer-side `FULL` durability option — plus stale two-engine
wording, an understated guard list, a mis-cited ADR, and an
unsourced mem latency number). The env-variable boundary grep was
re-run clean (harness-only) and pinned in a new Configuration
boundary section; N-1's growth-posture acceptance is folded into the
release growth text with the task-positioning pointer removed; the
mem rows hold true as release text; no internal task/wave pointers
remain in the release-facing text (POC-measured caveats kept). Docs
only: `deployment.md` + this task file. Workspace gates green
(`cargo build`, `cargo test` — 15 suites ok, `cargo clippy
--all-targets -- -D warnings`, `cargo fmt --check`,
`RUSTDOCFLAGS="-D warnings" cargo doc --no-deps`, fuzz corpus replay
ok).