docs: consolidate server runtime and deployment RFCs

docs/rfcs/0034-durable-recovery-authority.md

@@ -2,20 +2,26 @@
 rfc: "0034"
 title: "Durable recovery authority and outcomes"
 track: maintainer
-status: draft
+status: superseded
 implementation: not-started
 authors:
   - OmniGraph maintainers
 created: 2026-08-13
-updated: 2026-08-23
+updated: 2026-09-29
 discussion: null
 supersedes: []
-superseded_by: []
+superseded_by:
+  - "2026-09-29-server-runtime-and-online-deployment"
 blocked_on: []
 ---
 
 # RFC 0034: Durable recovery authority and outcomes
 
+> **Superseded on 2026-09-29** by [Server runtime and online deployment](2026-09-29-server-runtime-and-online-deployment.md).
+> The replacement remains a draft and is not implemented. This document is
+> retained as historical rationale; its obsolete mechanisms and dependencies
+> are not current implementation requirements.
+
 - **Depends on:** RFC 0022 unified graph-write protocol; RFC 0023 exact effect
   fencing; internal manifest schema v6 and recovery-v9; Lance 10.0.0.
 - **Consumed by:** RFC 0036 atomic runtime activation and availability

docs/rfcs/0035-served-operation-ownership.md

@@ -2,21 +2,26 @@
 rfc: "0035"
 title: "Served operation ownership"
 track: maintainer
-status: draft
+status: superseded
 implementation: not-started
 authors:
   - OmniGraph maintainers
 created: 2026-08-13
-updated: 2026-09-26
+updated: 2026-09-29
 discussion: null
 supersedes: []
-superseded_by: []
-blocked_on:
-  - "Server lifecycle and online deployment RFC (2026-09-10): minimum T10 ownership gate (increment B)"
+superseded_by:
+  - "2026-09-29-server-runtime-and-online-deployment"
+blocked_on: []
 ---
 
 # RFC 0035: Served operation ownership
 
+> **Superseded on 2026-09-29** by [Server runtime and online deployment](2026-09-29-server-runtime-and-online-deployment.md).
+> The replacement remains a draft and is not implemented. This document is
+> retained as historical rationale; its obsolete mechanisms and dependencies
+> are not current implementation requirements.
+
 **Depends on:** existing engine write and recovery contracts; no runtime-activation or recovery-supervision design; historical admission (§7.3) and the shipping gate in §10 are owned by [Server lifecycle and online deployment](2026-09-10-server-lifecycle-and-online-deployment.md), the server lifecycle RFC.
 **Replaces:** [PR #490](https://github.com/ModernRelay/omnigraph/pull/490), retaining its cancellation evidence rather than its stacked implementation.
 **Audience:** server, engine, API, operations, and test maintainers.

docs/rfcs/0036-atomic-runtime-activation.md

@@ -2,23 +2,26 @@
 rfc: "0036"
 title: "Atomic runtime activation and graph availability supervision"
 track: maintainer
-status: draft
+status: superseded
 implementation: not-started
 authors:
   - OmniGraph maintainers
 created: 2026-08-13
-updated: 2026-09-26
+updated: 2026-09-29
 discussion: null
 supersedes: []
-superseded_by: []
-blocked_on:
-  - RFC 0034 acceptance and implementation
-  - RFC 0035 acceptance and implementation
-  - "Server lifecycle and online deployment RFC (2026-09-10): historical-read capture, retention and reconstruction interface (§5.1)"
+superseded_by:
+  - "2026-09-29-server-runtime-and-online-deployment"
+blocked_on: []
 ---
 
 # RFC 0036: Atomic runtime activation and graph availability supervision
 
+> **Superseded on 2026-09-29** by [Server runtime and online deployment](2026-09-29-server-runtime-and-online-deployment.md).
+> The replacement remains a draft and is not implemented. This document is
+> retained as historical rationale; its obsolete mechanisms and dependencies
+> are not current implementation requirements.
+
 - **Depends on:** RFC 0034 durable recovery authority; RFC 0035 served-operation
   admission and lifetime; RFC 0038 typed storage-failure classification;
   internal manifest schema and Lance as pinned by the workspace `Cargo.toml`

docs/rfcs/0038-typed-storage-failures.md

@@ -7,7 +7,7 @@ implementation: complete
 authors:
   - Ragnor Comerford (@ragnorc)
 created: 2026-08-16
-updated: 2026-08-23
+updated: 2026-09-29
 discussion: "https://github.com/ModernRelay/omnigraph/pull/491"
 supersedes: []
 superseded_by: []
@@ -279,10 +279,10 @@ Existing operation-local boundaries retain their narrower meanings:
 - optimize keeps its local raw-Lance retry classifier; and
 - no other Lance conflict becomes a replay signal.
 
-RFC 0034 recovery disposition and RFC 0036 supervision remain separate
-contracts. A future supervisor may consider `Transient` after its recovery and
-effect-state rules authorize another attempt, but this RFC supplies neither
-that authorization nor scheduling policy.
+The proposed [server authority and completion contract](2026-09-29-server-runtime-and-online-deployment.md#authority-and-completion)
+remains separate from failure classification. A future supervisor may consider
+`Transient` only after its completion and effect-state rules authorize another
+attempt; this RFC supplies neither that authorization nor scheduling policy.
 
 ### Compatibility
 
@@ -392,3 +392,10 @@ available as historical context but is not merged or rebased.
 No unresolved OmniGraph design questions. New public upstream evidence may
 justify finer classification in a later RFC, but provider message parsing is
 not an acceptable substitute.
+
+## Decision log
+
+- 2026-09-29: The server authority and completion proposal replaces the paragraph
+  assigning recovery disposition and supervision to RFCs 0034 and 0036. Typed
+  storage classification still supplies no replay authorization or scheduling
+  policy; the accepted error contract is unchanged.

docs/rfcs/0040-system-column-namespace.md

@@ -7,7 +7,7 @@ implementation: in-progress
 authors:
   - azimafroozeh
 created: 2026-08-23
-updated: 2026-09-13
+updated: 2026-09-29
 discussion: https://github.com/ModernRelay/omnigraph/issues/529
 supersedes: []
 superseded_by: []
@@ -372,6 +372,20 @@ Per-name reservation lists must never come back.
 
 ### The upgrade
 
+**Current implementation.** [Detached table commits](0067-detached-table-commits.md)
+and [detached-only tables](2026-09-21-detached-only-tables.md) replaced the
+recovery-intent protocol below. The upgrade now stages detached renames, publishes
+once, and installs the schema contract using its publishing commit evidence;
+published table pins need no promotion and both column vintages use format v11.
+See [schema completion](../dev/recovery.md) and the supported
+[offline, standalone upgrade procedure](../user/operations/upgrade.md#system-column-upgrade-legacy-spellings).
+Cluster-managed system-column upgrades remain refused.
+
+**Historical protocol.** The following invocation, preflight, recovery-intent,
+stamp-advance, and fault-point description records the pre-detached proposal,
+including its then-proposed cluster surface. It is not the current upgrade
+procedure. The namespace and field-ID-preserving rename decisions remain valid.
+
 The upgrade is invoked explicitly through one engine operation exposed on
 two surfaces: a CLI command in single-graph mode, and a per-graph field in
 the cluster configuration, durable declarative state applied through the
@@ -980,3 +994,9 @@ None.
   tests per-image comparison; step 3 owns query planning across the upgrade.
   Entity lookup uses logical meta-field names. Constraint lists refuse `@id`
   because identity is already the row key; endpoint meta-fields remain valid.
+- 2026-09-29: The upgrade section now identifies its recovery-intent,
+  stamp-advance, `RollForwardOnly`, and cluster-apply procedure as historical.
+  RFC 0067 and detached-only tables supply the current detached publication and
+  schema completion; current operator instructions own the standalone-only
+  support boundary. This supersedes that section's claims of current recovery
+  behavior, not the accepted system-column namespace decision.

docs/rfcs/0049-control-plane-seams.md

@@ -7,7 +7,7 @@ implementation: partial
 authors:
   - OmniGraph maintainers
 created: 2026-09-03
-updated: 2026-09-06
+updated: 2026-09-29
 discussion: null
 supersedes: []
 superseded_by: []
@@ -37,11 +37,11 @@ crate already does, and without bypassing it:
    process non-zero instead of waiting forever.
 
 Nothing here changes a storage format, the ledger's schema, the lock, the
-recovery protocol, or any existing route's success shape. The wider designs of
-RFC 0034 (recovery authority) and RFC 0035 (served-operation ownership) stay
-independent; this RFC takes none of their decisions and its seams remain valid
-under them. Restoring a ledger is deliberately not here: its real use arrives
-with coherent restore points, where the ledger and the graphs come back
+recovery protocol, or any existing route's success shape. The wider
+[Server runtime and online deployment](2026-09-29-server-runtime-and-online-deployment.md)
+proposal stays independent; this RFC takes none of its proposed decisions and
+its seams remain valid under it. Restoring a ledger is deliberately not here:
+its real use arrives with coherent restore points, where the ledger and the graphs come back
 together, and it will be designed once, against those.
 
 ## Motivation
@@ -67,10 +67,9 @@ one. On the way down, axum's graceful shutdown has no bound, so a stalled
 connection keeps a replica alive past any orchestration grace period, and the
 orchestrator's kill is indistinguishable from a crash.
 
-Both gaps are small and local. Neither needs RFC 0034's recovery modes or RFC
-0035's admission cells to close; both of those remain the right larger
-designs for the engine and the server, and this RFC is careful not to
-preempt them.
+Both gaps are small and local. Neither requires the wider server proposal's
+operation ownership or completion supervision to close; this RFC does not
+preempt those contracts.
 
 ## User and operational behavior
 
@@ -179,11 +178,12 @@ renders the same difference as `quarantined`.
 as flag, then environment, then default. `serve` spawns the signal listener
 first; on the signal it sets `draining`, starts a `std::thread` that sleeps
 for the grace and calls `std::process::exit(2)`, and releases the graceful
-shutdown. The clean path is unchanged. This is the deadline half of RFC 0035
-§8 without its participants: one absolute deadline created at signal receipt,
-no participant-local timeouts, a hard non-zero exit that never claims
-success and never depends on the runtime. RFC 0035 may later replace the
-thread with its coordinator; the flag and the readiness change stay.
+shutdown. The clean path is unchanged. This supplies the proposed server
+[operation-ownership contract's](2026-09-29-server-runtime-and-online-deployment.md#operation-ownership)
+deadline boundary without its participants: one absolute deadline created at
+signal receipt, no participant-local timeouts, a hard non-zero exit that never
+claims success and never depends on the runtime. The server runtime proposal may
+replace the thread with its coordinator; the flag and the readiness change stay.
 
 ## Invariants
 
@@ -222,10 +222,10 @@ fields.
 - **Use `state.lock: false` for observation.** It is a bundle setting that
   changes every command and warns on each, and it cannot label a result as
   observed. Rejected.
-- **Implement RFC 0034's `ReadOnlyProbe` first.** The engine's read-only open
-  already skips recovery; what an observer lacks is the cluster crate not
-  taking its lock and not writing. RFC 0034 remains the right design for
-  recovery authority and is not needed for this.
+- **Implement RFC 0034's `ReadOnlyProbe` first.** This was an alternative when
+  this RFC was drafted; RFC 0034 is now superseded. The engine's read-only open
+  already skipped recovery; what observation needed was the cluster crate not
+  taking its lock and not writing. The wider completion design was not required.
 - **Restore a ledger from a file.** Drafted, then deferred: its real use is a
   coherent restore point where the ledger and the graphs come back together,
   and until those exist, `import` and `observe` rebuild a lost ledger with
@@ -236,8 +236,9 @@ fields.
 - **Report the boot digest on `/healthz`.** Liveness and readiness have
   different consumers and different failure semantics; a draining replica is
   alive and not ready. Rejected.
-- **Wait for RFC 0035's shutdown coordinator.** Its deadline half is
-  separable and needed now; its admission cells are not.
+- **Wait for RFC 0035's shutdown coordinator.** This was an alternative when
+  this RFC was drafted; RFC 0035 is now superseded. The deadline boundary was
+  independently shippable without the full admission design.
 - **A Tokio task as the watchdog.** A task cannot fire while the executor is
   blocked or the runtime is tearing down, which are exactly the cases a
   deadline exists for. A thread can.
@@ -268,8 +269,8 @@ fields.
 
 ## Unresolved questions
 
-None that block acceptance. The default grace of 25 seconds matches RFC
-0035 §8; it is a default, not a contract.
+None that block acceptance. The default grace of 25 seconds matched the earlier
+RFC 0035 proposal; it is a default, not a contract.
 
 ## Decision log
 
@@ -284,3 +285,7 @@ None that block acceptance. The default grace of 25 seconds matches RFC
   bounded shutdown); `implementation` advances with each.
 - 2026-09-06: accepted the zero-graph readiness amendment from RFC 0005;
   implementation and process HTTP evidence follow without a wire-format change.
+- 2026-09-29: The server runtime proposal replaces the active references to
+  RFCs 0034 and 0035 in Summary, Motivation, and Shutdown. Alternatives retain
+  those identifiers as historical context. Observe, readiness, and bounded
+  shutdown remain this RFC's accepted decisions.

docs/rfcs/0065-isolated-branch-merge-publication.md

@@ -2,25 +2,26 @@
 rfc: "0065"
 title: "Isolated branch merge publication"
 track: maintainer
-status: draft
+status: superseded
 implementation: not-started
 authors:
   - azimafroozeh
 created: 2026-09-09
-updated: 2026-09-10
+updated: 2026-09-29
 discussion: null
 supersedes: []
-superseded_by: []
-blocked_on:
-  - "Storage: qualify bounded owner ancestry and metadata, shared files, indexes and Blob retention on pinned Lance 11."
-  - "Engine: prove adopted-owner writes, maintenance and change-feed lifetime witnesses on main and named branches."
-  - "Recovery: prove publication-versus-abandonment ordering and crash-safe admission independent of terminal GC backlog."
-  - "Compatibility: specify the format fence and lossless supported upgrade path before enabling publication."
+superseded_by:
+  - "0067"
+blocked_on: []
 ---
 
 # RFC 0065: Isolated branch merge publication
 
-> Number provisional: recheck the registry and open reservations before publication.
+> **Superseded on 2026-09-29** by [RFC 0067: Detached table commits](0067-detached-table-commits.md),
+> whose accepted decision subsumes this private-branch merge design. See also
+> [Detached-only tables](2026-09-21-detached-only-tables.md) for final pins and
+> current retention. The body below preserves historical rationale; its private
+> refs, sidecars and detached-publication deferral are not current requirements.
 
 ## Summary
 

docs/rfcs/0067-detached-table-commits.md

@@ -7,9 +7,10 @@ implementation: complete
 authors:
   - ragnorc
 created: 2026-09-14
-updated: 2026-09-25
+updated: 2026-09-29
 discussion: null
-supersedes: []
+supersedes:
+  - "0065"
 superseded_by: []
 blocked_on:
   - "Engine: the promotion reconciler with idempotent, order-preserving, uuid-checked replay and its crash and two-process evidence."
@@ -1483,3 +1484,6 @@ claims).
   unknown outcome. The v11 root descriptions now include selected merge bases
   and exact graph/table tagged snapshots, not only the live retention policy.
   The historical v10 mechanism is unchanged.
+- 2026-09-29: Recorded reciprocal supersession of RFC 0065, making the
+  existing Alternatives disposition of private native branches as subsumed
+  explicit in metadata. No storage decision or implementation status changes.

docs/rfcs/2026-09-10-server-lifecycle-and-online-deployment.md

@@ -2,25 +2,26 @@
 rfc: "2026-09-10-server-lifecycle-and-online-deployment"
 title: "Server lifecycle and online deployment"
 track: maintainer
-status: draft
+status: superseded
 implementation: not-started
 authors:
   - OmniGraph maintainers
 created: 2026-09-10
-updated: 2026-09-26
+updated: 2026-09-29
 discussion: https://github.com/ModernRelay/omnigraph/pull/697
 supersedes: []
-superseded_by: []
-blocked_on:
-  - Crash and restart proof for deployment publication, finalization and activation
-  - Durable deployment-evidence encoding, publication ordering and downgrade refusal
-  - Effect-free candidate construction or qualified engine reuse for each supported change class
-  - Versioned active-witness and current-state compatibility contract, including the ledger fields the server binds as deployment identity
-  - Qualified resource budgets for replacement overlap and completion capacity
+superseded_by:
+  - "2026-09-29-server-runtime-and-online-deployment"
+blocked_on: []
 ---
 
 # RFC: Server lifecycle and online deployment
 
+> **Superseded on 2026-09-29** by [Server runtime and online deployment](2026-09-29-server-runtime-and-online-deployment.md).
+> The replacement remains a draft and is not implemented. This document is
+> retained as historical rationale; its obsolete mechanisms and dependencies
+> are not current implementation requirements.
+
 ## Summary
 
 Schema and serving-configuration changes must become active without