docs(deps): defer sqlx 0.9 — version-coupled public API plus a 1.94 rustc floor over the 1.81 MSRV

[rodmen07]

Summary

Dependency-currency assessment for sqlx 0.9.0 (the follow-up filed by the tower-http/validator pass, PR #18): verdict DEFER at 0.8, recorded in ROADMAP.md's dependency watch (dated 2026-08-08) and CHANGELOG.md [Unreleased], mirroring the validator 0.21 deferral. Docs only — no code, no Cargo.toml change, no new dependency.

The assessment, each fact measured rather than inherited

• Coupling determination (the item explicitly distrusted recorded coupling claims, so it was read from the source): sqlx::Error IS version-coupled into the public API for sqlx-feature users via #[cfg(feature = "sqlx")] impl From<sqlx::Error> for ApiError at src/error.rs:318-338. That is the crate's ONLY sqlx-gated surface: grep -rn 'feature = "sqlx"' src/ tests/ returns src/error.rs:318 plus four #[cfg]-gated unit tests in the same file, and the src/lib.rs hits are doc prose; the pub use list at src/lib.rs:119-133 re-exports no sqlx type. A hard 0.8 -> 0.9 bump therefore changes which sqlx::Error the impl accepts and is a semver major for feature users — the exact route that made 2.0.0 a major.
• The widen instrument (tower-http's escape) is blocked by MSRV, not API: crates.io API (required User-Agent) reports sqlx 0.9.0 rust_version: "1.94.0" (0.9.0-alpha.1 was already 1.86.0), and sqlx's own 0.9.0 changelog names 1.94.0 as the release cycle's supported floor. That is thirteen minors above this crate's declared rust-version = "1.81". A widened >=0.8, <0.10 range would hand any fresh-resolving 1.81-1.93 consumer a resolver match on 0.9.0 followed by a compile failure — precisely the false-declared-MSRV failure class (2.0.0 declared 1.75 over an effective 1.81 floor) that the v2.1.0 cut corrected at the registry.
• Usage-level compatibility deliberately NOT fully assessed because it is moot below the MSRV blocker; noted for the record that 0.9.0's changelog names no breaking change to the Error variants the impl matches (the error-adjacent entry, Feature: Add exclusion violation error kind transact-rs/sqlx#3918, is an additive exclusion-violation kind).
• The handed facts re-derived (L-040): the item's quoted Adding sqlx v0.8.6 (available: v0.9.0) reproduced verbatim by this run's own cargo generate-lockfile; registry newest_version = max_stable_version = 0.9.0 (created 2026-05-21). The item's matchit absence claim re-verified: not in [dependencies], axum's transitive — nothing to assess.
• Escapes recorded: a sqlx 0.9 adoption is a candidate 3.0 driver, or rides a future MSRV raise to >=1.94 (minor under this crate's Semver policy, needing its own justification). Re-assess only when either is otherwise warranted.

No guard added, deliberately: this is a dated assessment record (the PR #18 validator-deferral shape), not a live claim two artifacts can drift on. The Semver compatibility job is cited per the item's close condition only in its trivial form — no change was attempted, and the job runs green on this PR against published 2.1.0.

Verification (tier 2, ci.yml-pinned recipes — L-010, lines 33/36/39/42 plus the audit job)

• cargo fmt --check exit 0
• cargo clippy --all-targets --all-features -- -D warnings clean
• cargo test 83 passed, 0 failed (byte-equal to the origin/main baseline; the 6 roadmap-truth guards pass on the edited ROADMAP/CHANGELOG — the - Unreleased on main bullet still exists exactly while [Unreleased] has entries)
• cargo test --all-features 231 passed, 0 failed (byte-equal to baseline)
• cargo audit --deny warnings exit 0 over 135 crate dependencies (fresh resolution; count unchanged — no dependency was added or moved)
• Diff shape (L-051 spirit, no regenerator involved): 2 files changed, 10 insertions(+), zero deletions — one ROADMAP bullet, one CHANGELOG entry.

Lessons applied: L-040 (handed facts re-derived: sqlx 0.9.0 rust_version: "1.94.0" read from the crates.io API and the availability line reproduced by this run's own cargo generate-lockfile), L-026 (coupling read from source, absence claims exhaustively searched: grep -rn 'feature = "sqlx"' src/ tests/ -> src/error.rs only; no pub use sqlx at src/lib.rs:119-133; no matchit in [dependencies]), L-010 (gates from .github/workflows/ci.yml lines 33/36/39/42 plus the audit job's cargo audit --deny warnings), L-018 (original branch main recorded; branched autodev/akk-sqlx-0-9-assessment from origin/main at d282e5d), L-024 (explicit cd d:/Projects/cargo_crates/axum-api-kit && with git rev-parse --show-toplevel printed on every git/gh command).

🤖 Generated with Claude Code