Initial v1 code layout

The destination of the wayfinder map: directory and module structure, the
domain model as real schema files, permission boundaries expressed as code,
and typed seams where the undecided parts land.

Satisfies the four structural requirements earlier resolutions handed to a
layout that did not exist:

  - a single database entry point (#11) — the pool is not exported
  - a scheduler entry point with actor context and no request (#13)
  - an entitlement assertion helper (#20, #34) — its call sites are the
    paid-feature list
  - an enumerated list of privileged RLS bypasses (#33) — three of them

Seams carry real types and throw with the ticket that owns them, so the
skeleton wires up and fails only where a decision is genuinely missing.

Verified: tsc --noEmit clean; drizzle-kit generate produces RLS on 18 tables
and 6 policies calling the release-level functions.

Resolves #35

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/migrations.md

@@ -0,0 +1,48 @@
+# Migrations
+
+**Generated SQL is never hand-edited.** Hand-editing poisons Drizzle's diff
+baseline, and the baseline is what tells you the database still matches the
+schema that the types are inferred from.
+
+The split follows what Drizzle can actually diff:
+
+| Owned by Drizzle | Owned by hand |
+|---|---|
+| Tables, columns, indexes | SQL functions |
+| RLS policies, via `pgPolicy` beside the table | Data seeds |
+| Enums | The release matrix and its versions |
+
+```
+yarn generate            # schema diff -> migrations/
+yarn generate:custom     # empty file -> migrations/, for functions and data
+yarn migrate
+```
+
+## Why policies sit beside their tables
+
+A new table shipping with no policy is the failure mode that matters, and RLS
+default-deny only helps if it was enabled on that table. Declaring the policy in
+the same file as the table makes the omission visible at review time.
+
+## Why the matrix is a data migration
+
+The release matrix is **versioned, never updated** — a past release has to be
+reconstructable when an award is protested. A rule change is an INSERT at a new
+version. That is exactly what `--custom` is for.
+
+## Ordering: why the functions are migration 0000, and why they are plpgsql
+
+Drizzle emits an RLS policy in the **same migration as the table it guards**, so
+the functions those policies call must already exist. But the functions read
+`solicitation`, `participation` and `release_matrix` — which that same later
+migration creates. A straightforward cycle.
+
+`LANGUAGE sql` validates a function body at `CREATE` time and would fail. plpgsql
+defers validation to first call, which breaks the cycle. For the same reason the
+signatures use `text` rather than the `release_level` enum: the enum does not
+exist yet either.
+
+The cost is real and worth knowing: **a typo inside a function body is not caught
+at migration time.** It surfaces the first time a policy runs — which, because
+policy failures present as empty results, is the failure mode #11 already flagged
+as hard to diagnose. Database-level tests over these functions are not optional.

docs/seams.md

@@ -0,0 +1,34 @@
+# Seams
+
+A seam is a place the map has not decided yet. Every one has **real types** —
+the signature is the handoff, so a ticket lands by replacing a body rather than
+by designing an interface.
+
+```
+yarn seams          # this list, from the code
+```
+
+| Seam | Ticket | What is undecided |
+|---|---|---|
+| `src/audit/` | #21 | Retention and query design. Every *input* is already fixed by #14, #15 and #16. |
+| `src/integration/` | #18 | Formats and transport. Export can never exceed read — fixed by #14. |
+| `src/helmdocs/` | #19 | The API/MCP boundary. |
+| `src/kickoff/` | #17 | Everything. Starts where release reaches `awarded`. |
+| `src/claiming/` | #24 | Verification, and how "Acme Foods Inc" and "Acme Foods" resolve to one org. |
+| `src/pricing/` | #29 | The closed set of rate structure types. No model fallback exists, by #15. |
+| `src/extraction/` | #30 | Cannot be built or measured before the corpus exists. |
+| `src/extraction/completeness.ts` | #30 | Same, and needs *labelled known-misses* to have measurable recall. |
+| `src/scheduler/jobs/expiry.ts` | #27 | Per-type expiry rules — the catalogue defines them. |
+| `src/auth/entitlement.ts` | #35 | Resolution wiring only. The principle and the tier table are decided. |
+
+## What is deliberately *not* a seam
+
+These are decided, and implemented as real code. Changing them means reopening
+a closed ticket, not filling in a blank.
+
+- **`src/db/index.ts`** — the single database entry point. The pool is not
+  exported; `withActor` is the only way in.
+- **`src/db/privileged.ts`** — the enumerated privileged paths. Three of them.
+  Adding a fourth should feel like a decision.
+- **`src/release/matrix.ts`** — the release matrix. One rule set, versioned.
+- **`src/scoring/routing.ts`** — what a model may decide. Two lanes of six.