general review 004 (pre-release, whole workspace): one HIGH slot-poisoning fix, two contract-observable divergence fixes, robustness + doc corrections — all gates re-run green

- sqlite scheduler tick: a failed COMMIT (or ROLLBACK) left the connection
  released with a stuck-open transaction, wedging the writer slot forever —
  the one commit site missing the drop-+-reopen-replenish arm; tick now
  takes the conn by value with a poisoned disposition (drop + replenish),
  the commit-fault seam reaches the tick, and
  failed_tick_commit_replenishes_the_writer_slot pins the arm
- pg save_offset_tx stored GREATEST($3,0) where the wave-8 gate's
  negative-seed fix (raw seed, ADR-023 §2 2026-10-11 annotation) covered
  only the auto-commit form; mem's merged in-tx read clamped a staged
  negative seed against a phantom zero; both fixed and the tx-form
  totality pinned by a new stamped suite leg (in_tx_reads_see_own_writes)
  green on all three columns vs the live harness server
- pg: a failed forwarder register leaked the channel refcount forever
  (no receiver to drop it) — listen/spawn_bridge now unregister on the
  register error, mirroring the subscribe-failure arm; register doc
  corrected to put the failure disposition at the call site
- pg forwarder: nine poisoned-mutex expect() panics converted to the
  mem crate's into_inner recovery idiom (no-expect-outside-tests rule)
- core encode_payload: a deeply-nested Value aborted the process in
  serde_json's unguarded serializer recursion and the fuzz pin blessed
  storing bytes no decoder could read back; encode now rejects nesting
  past 127 containers (the empirically-verified decode limit) with typed
  Codec — decode-aligned boundary pins added to the fuzz invariant and
  value_type_tests, applied pre-publish within the open class-1 window
- scheduler sleep deadlines: Instant + Duration overflow caps (MAX_SLEEP_S,
  tick-and-resleep) on all three engines for far-future boundaries;
  sqlite tick claim stamp now saturating_add
- docs read true again: Error::Closed scope (stream try_recv arm),
  validation whitespace wording, sqlite lib.rs phantom durability knobs,
  pg lock.rs honest autocommit wording, mem tx/stream merge + wake-
  granularity wording; wakes.rs stale allow(dead_code) removed
- tests: value_type_tests exercised its own map_err instead of the
  function under test (fixed); unwrap_or_default reference encodes
  panic with cause
- docs/reviews/004-pre-release-general-review.md records nine fixed +
  sixteen parked findings (sqlite seam panic-safety armor, watcher
  post-death-subscribe hang + initial-stat self-kill, pg forwarder
  TOCTOU/hang/diagnosability, pg BIGINT server-side stamp overflow, mem
  growth/outbox notes, pg identifier-truncation doc note, smaller) and
  two false positives caught on verification; implementation.md
  review-rounds entry + core-contract backlog rows updated
- gates: build, workspace tests (sqlite 194, core 27, suite legs new),
  full live pg column 127+25+9, clippy -D warnings, fmt, fuzz replay
  6/6, wasm32 check, doc gate -D warnings — all green

alkstore-contract-suite/src/properties.rs

@@ -897,9 +897,16 @@ pub async fn drop_rollback_leaves_no_ghosts(factory: &dyn StoreFactory) {
 /// pin in the drop-rollback and commit-visibility rows; this row pins
 /// the visibility itself.)
 ///
+/// The negative-seed leg (2026-10-11): a staged save seeding an
+/// absent checkpoint stores raw — the boundary/offset totality of
+/// ADR-023 §2 rides the tx seam too, in-tx read-back included (a
+/// negative seed reads raw, never clamped against the absent-consumer
+/// phantom zero, and survives the commit as the stored checkpoint).
+///
 /// Contract stamp: ADR-021 §1 (tx-side read methods,
 /// read-your-own-writes); ADR-007 (the commit-atomic seam the reads
-/// ride).
+/// ride); ADR-023 §2 boundary/offset annotation (annotated
+/// 2026-10-11 — a negative is stored as the checkpoint).
 pub async fn in_tx_reads_see_own_writes(factory: &dyn StoreFactory) {
     let store = factory.open().await.expect("factory opens a store");
 
@@ -934,8 +941,43 @@ pub async fn in_tx_reads_see_own_writes(factory: &dyn StoreFactory) {
     );
     let checkpoint = tx.get_offset_tx("events", "c").await.unwrap();
     assert_eq!(checkpoint, offset, "the tx sees its own save");
+
+    // The tx form's seed arm (ADR-023 §2, annotated 2026-10-11): a
+    // staged save on a consumer with no committed checkpoint seeds
+    // raw — the in-tx read-back is the raw seed, not the absent-consumer
+    // phantom zero clamped over it, and the commit stores it verbatim.
+    tx.save_offset_tx("events", "c2", -5).await.unwrap();
+    let seeded = tx.get_offset_tx("events", "c2").await.unwrap();
+    assert_eq!(
+        seeded, -5,
+        "a staged negative seed reads raw in-tx (no phantom-zero clamp)"
+    );
     tx.commit().await.unwrap();
 
+    let committed_seed = store
+        .stream("events")
+        .await
+        .unwrap()
+        .get_offset("c2")
+        .await
+        .unwrap();
+    assert_eq!(
+        committed_seed, -5,
+        "a negative seed is stored as the checkpoint through the tx seam"
+    );
+    let resumed = store
+        .stream("events")
+        .await
+        .unwrap()
+        .read_from_consumer("c2", 10)
+        .await
+        .unwrap();
+    assert_eq!(
+        resumed.iter().map(|e| e.offset).collect::<Vec<_>>(),
+        vec![offset],
+        "reads anchored at the negative checkpoint resume forward: the log from the start"
+    );
+
     factory.teardown().await.expect("factory teardown");
 }