RPF-WP-0018 T01-T06: publish S3 posture, placement policy, quotas, ADR surface

T01 docs/tenancy-posture.md - vector set per service rather than one repo
vector, with the provider-versus-consumer finding routed to net-kingdom.
T02/T03/T06 docs/placement-policy.md - accepts placement ownership scoped
to rule-here/number-there, records a placement owner per workload, reports
the latency-critical + batch co-residency on platform-pg, marks the
connection-ceiling trigger unmonitored pending railiance-telemetry, and
answers the retention floor/ceiling question.
T04 s3-consumer-interfaces 1.1.0 - quota disclosure per SS10.2. Surfaces
that apps-pg has no backup, no resource limits and no tuned parameters.
T05 docs/adr/ created with a mandatory-frontmatter convention and the
first three ADRs. This repo previously held none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/adr/ADR-0002-placement-policy-ownership.md

@@ -0,0 +1,81 @@
+---
+title: "ADR-0002 — S3 owns the placement rule; the package repo owns the number"
+status: proposed
+revision: "1.0"
+owner: railiance-platform
+date: "2026-08-17"
+last_reviewed: "2026-08-17"
+review_interval: 6m
+---
+
+# ADR-0002 — S3 owns the placement rule; the package repo owns the number
+
+## Context
+
+`net-kingdom/canon/standards/tenancy-posture_v0.1.md` §8.2 proposes that
+database placement policy — dedicated versus shared, and when that changes —
+be owned by `railiance-platform`, co-signed by `adaptive-pricing`.
+`tenant-engine` raised the same gap independently on 2026-08-16: both patterns
+are live on railiance01, neither is written down, and each new service copies
+whichever neighbour it looked at.
+
+The complication is that this repo no longer holds the specs. `RAILIANCE-WP-0012`
+and `RAILIANCE-WP-0015` moved the deployable surface to the `rapp-*` repos.
+`platform-pg`'s `instances`, `max_connections`, memory limit and retention are
+`rapp-postgres`'s cluster CR. Tenancy Posture §19.8 nonetheless asks *this repo*
+for `platform-pg`'s declared maximum size — a question one hop from where its
+answer lives.
+
+Accepting ownership without stating this would produce either an answer we
+cannot substantiate or a quiet non-answer.
+
+## Decision
+
+**Accept placement ownership, split along rule and number.**
+
+*This repo owns the rule:* the default placement level, what overrides it, who
+is accountable for each workload's placement, that a shared cluster must publish
+a ceiling and an overflow target before its third consumer, that retention has a
+floor and a ceiling, and that a consumer's erasure horizon on shared substrate
+is disclosed rather than inherited silently.
+
+*The package repo owns the number:* what the ceiling actually is, which resource
+binds first, what the retention values are, and the validator that enforces them
+where the CR lives.
+
+**Placement ownership per workload sits with the consuming repo; this repo
+co-signs.** The consumer knows its latency requirement, erasure horizon and
+compliance position; S3 knows the substrate. A placement change needs both.
+Putting the decision solely here would recreate the problem §8.2 exists to
+avoid — an operations-shaped repo holding a commercial decision alone.
+
+`adaptive-pricing` co-signature is requested, not assumed.
+
+## Consequences
+
+- `docs/placement-policy.md` is the operative document; this ADR is the
+  decision behind it.
+- §19.8 is answered by obligation rather than by number: Rule P-4.1 requires
+  `platform-pg` and `apps-pg` to declare a ceiling before their third consumer.
+  Both are at two consumers.
+- This repo owes `apps-pg`'s ceiling under its own rule. A policy whose author
+  is exempt is not a policy.
+- §8.1 requires triggers to be *monitored*. This repo has no monitoring plane,
+  so the connection-and-memory-ceiling trigger is recorded `unmonitored`
+  pending `railiance-telemetry`. Declaring a ceiling is a partial substitute —
+  a written threshold is checkable by a human at provisioning, which beats a
+  limit discovered by an OOM kill.
+- If `adaptive-pricing` declines, this ADR is revised to record single
+  ownership explicitly rather than leaving an unsigned co-signature line.
+
+## Alternatives considered
+
+**Decline ownership; route it to `rapp-postgres`.** They hold the specs and the
+operational knowledge. Rejected: placement is a cross-cluster question and
+`rapp-postgres` owns one package. A policy owned by one substrate's operator
+cannot govern movement between substrates.
+
+**Accept whole, including the numbers.** Rejected: it would either re-import
+the deployable surface this repo deliberately gave up, or produce numbers
+restated here that drift from the CR — a second source of truth for exactly the
+values a consumer must be able to trust.