From 64139157ef8abe4bd0da3febdf4b5c9d2ae374ba Mon Sep 17 00:00:00 2001
From: Mario Fetka <mario.fetka@gmail.com>
Date: Tue, 28 Jul 2026 16:57:23 +0200
Subject: [PATCH] Document historical Bongo database boundaries

---
 docs/release-testing-0.7.md |  1 +
 docs/storage.md             | 36 +++++++++++++++++++++++++++---------
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/docs/release-testing-0.7.md b/docs/release-testing-0.7.md
index 8a4d543..496e24a 100644
--- a/docs/release-testing-0.7.md
+++ b/docs/release-testing-0.7.md
@@ -118,6 +118,7 @@ inputs and outputs is absent from the ZIP.
 | STQ-10 | Queue/SMTP and external collection map Store 5220 to quota-exceeded delivery without data loss | [PASS](test-evidence/0.7-r1.md#stq-10) |  |  |
 | STQ-11 | Lowered/unlimited limits, large sizes, upgrade migration, backup and restore preserve quota state | [PASS](test-evidence/0.7-r1.md#stq-11) |  |  |
 | STQ-12 | Bounded 128-KiB collector flood reaches a small test quota without exceeding it, duplicating mail, or deleting the first message that was not durably imported | [PASS](test-evidence/0.7-r1.md#stq-12) |  |  |
+| STQ-13 | 0.7 scheduler, Sieve, external-account and TLSRPT state is owned by `bongostore` through NMAP, while historical authentication, cookie, alarm and per-user Store databases remain compatible |  |  |  |
 
 ## SMTP receive, submission, and delivery
 
diff --git a/docs/storage.md b/docs/storage.md
index 20b91bd..119a022 100644
--- a/docs/storage.md
+++ b/docs/storage.md
@@ -22,20 +22,38 @@ They count logical mail-message sizes across all mailboxes, but not calendar,
 contact, configuration, or authentication data. See
 [Mail storage quotas](quotas.md) for administration and protocol behaviour.
 
-The system Store below `/var/lib/bongo/system` contains server configuration
-documents and other system-owned objects. The Queue spool below
-`/var/lib/bongo/spool` contains messages which have been accepted but not yet
-fully delivered.
+The NMAP system account is `/var/lib/bongo/users/_system/store.db`. It contains
+server configuration documents and new server-wide tables such as TLSRPT
+events and deliveries. The historical `/var/lib/bongo/system` directory is a
+different facility and still contains the original alarm database. The Queue
+spool below `/var/lib/bongo/spool` contains messages which have been accepted
+but not yet fully delivered.
 
-Other SQLite databases serve separate purposes:
+Not every separate SQLite database is accidental. The following layouts
+predate the 0.7 work and remain supported:
 
 - `/var/lib/bongo/dbf/userdb.sqlite` stores local authentication records,
   Argon2id password hashes, encrypted TOTP secrets, recovery codes, app
   passwords, login aliases, and LDAP cache metadata.
-- `/var/lib/bongo/dbf/sieve.sqlite` stores ManageSieve scripts and vacation
-  state.
-- `/var/lib/bongo/dbf/external-accounts.sqlite` stores external account
-  schedules, identities, encrypted credentials, and import state.
+- `/var/lib/bongo/dbf/cookies.db` stores the original Store authentication
+  cookies.
+- `/var/lib/bongo/system/alarms.db` stores the original calendar alarm state.
+
+These databases are not migration targets merely because they are separate.
+The per-user Store, authentication, cookie, alarm, and historical MsgAPI SQL
+designs were present in the archived Bongo history.
+
+By contrast, standalone databases first added by the 0.7 development work
+must be moved behind `bongostore` and its NMAP interface:
+
+- `/var/lib/bongo/dbf/sieve.sqlite`;
+- `/var/lib/bongo/dbf/external-accounts.sqlite`;
+- `/var/lib/bongo/worker/jobs.sqlite`.
+
+TLSRPT originally joined that list during development, but it has already
+been moved into the `_system` Store and no longer owns a separate database.
+The remaining three paths are transitional until their Store protocol
+migrations and one-time data import have landed.
 
 Web tasks, sender identities, and signatures are ordinary user Store
 documents below `/preferences`. Login sessions exist only in `bongoweb`