general review 004 (pre-release, whole workspace): one HIGH slot-poisoning fix, two contract-observable divergence fixes, robustness + doc corrections — all gates re-run green

- sqlite scheduler tick: a failed COMMIT (or ROLLBACK) left the connection
  released with a stuck-open transaction, wedging the writer slot forever —
  the one commit site missing the drop-+-reopen-replenish arm; tick now
  takes the conn by value with a poisoned disposition (drop + replenish),
  the commit-fault seam reaches the tick, and
  failed_tick_commit_replenishes_the_writer_slot pins the arm
- pg save_offset_tx stored GREATEST($3,0) where the wave-8 gate's
  negative-seed fix (raw seed, ADR-023 §2 2026-10-11 annotation) covered
  only the auto-commit form; mem's merged in-tx read clamped a staged
  negative seed against a phantom zero; both fixed and the tx-form
  totality pinned by a new stamped suite leg (in_tx_reads_see_own_writes)
  green on all three columns vs the live harness server
- pg: a failed forwarder register leaked the channel refcount forever
  (no receiver to drop it) — listen/spawn_bridge now unregister on the
  register error, mirroring the subscribe-failure arm; register doc
  corrected to put the failure disposition at the call site
- pg forwarder: nine poisoned-mutex expect() panics converted to the
  mem crate's into_inner recovery idiom (no-expect-outside-tests rule)
- core encode_payload: a deeply-nested Value aborted the process in
  serde_json's unguarded serializer recursion and the fuzz pin blessed
  storing bytes no decoder could read back; encode now rejects nesting
  past 127 containers (the empirically-verified decode limit) with typed
  Codec — decode-aligned boundary pins added to the fuzz invariant and
  value_type_tests, applied pre-publish within the open class-1 window
- scheduler sleep deadlines: Instant + Duration overflow caps (MAX_SLEEP_S,
  tick-and-resleep) on all three engines for far-future boundaries;
  sqlite tick claim stamp now saturating_add
- docs read true again: Error::Closed scope (stream try_recv arm),
  validation whitespace wording, sqlite lib.rs phantom durability knobs,
  pg lock.rs honest autocommit wording, mem tx/stream merge + wake-
  granularity wording; wakes.rs stale allow(dead_code) removed
- tests: value_type_tests exercised its own map_err instead of the
  function under test (fixed); unwrap_or_default reference encodes
  panic with cause
- docs/reviews/004-pre-release-general-review.md records nine fixed +
  sixteen parked findings (sqlite seam panic-safety armor, watcher
  post-death-subscribe hang + initial-stat self-kill, pg forwarder
  TOCTOU/hang/diagnosability, pg BIGINT server-side stamp overflow, mem
  growth/outbox notes, pg identifier-truncation doc note, smaller) and
  two false positives caught on verification; implementation.md
  review-rounds entry + core-contract backlog rows updated
- gates: build, workspace tests (sqlite 194, core 27, suite legs new),
  full live pg column 127+25+9, clippy -D warnings, fmt, fuzz replay
  6/6, wasm32 check, doc gate -D warnings — all green

docs/architecture/core-contract.md

@@ -792,21 +792,33 @@ before the engine specs are called `stable`:
   with `limit <= 0` read nothing, never the whole queue/stream), so
   the SQLite `LIMIT -1` dialect artifact is dead on both engines;
    durations reject (`try_lock`/`renew` with `ttl <= 0` are opaque
-   `Err`s on both engines); boundaries are total (a negative
-   `trim_to` horizon deletes nothing, idempotently; the same
-   totality over non-positive values covers `heartbeat(extend)`'s
-   relative-deadline argument and `save_offset`'s offset — both
-   classified 2026-10-11 by the close-out pass, the ADR-023 §2
-   annotation; their suite legs landed at the wave-8 gate in
-   `job_handle_validity_predicate` and
-   `receiver_close_and_save_arms`, uniformly green on all three
-   engines).
+    `Err`s on both engines); boundaries are total (a negative
+    `trim_to` horizon deletes nothing, idempotently; the same
+    totality over non-positive values covers `heartbeat(extend)`'s
+    relative-deadline argument and `save_offset`'s offset — both
+    classified 2026-10-11 by the close-out pass, the ADR-023 §2
+    annotation; their suite legs landed at the wave-8 gate in
+    `job_handle_validity_predicate` and
+    `receiver_close_and_save_arms`, uniformly green on all three
+    engines; the 2026-10-11 general review added the tx-seam form of
+    the `save_offset` totality — a staged negative seed reads raw
+    in-tx and stores raw at commit, pinned in
+    `in_tx_reads_see_own_writes`, again uniformly green on all three
+    engines).
 - **`encode_payload` typed failure**
   ([ADR-023](decisions/023-fourth-review-round.md) §1) — the helper
   returns `Result<Vec<u8>, Error::Codec>`; enqueue/publish store and
   decode the exact serialization of the input `Value` (byte-identical
   rows cross-engine, the §4 round-trip unchanged), and the failure
   arm is typed at the helper — no silent empty-byte fallback exists.
+  The failure set grew once (the 2026-10-11 general review, applied
+  pre-publish): a `Value` nested
+  deeper than the encode-side depth limit (127 containers — a
+  128th nested open fails to decode, empirically aligned with
+  serde_json's recursion limit) is a typed `Codec` rejection, not a
+  serializable-but-undecodable store and not a serializer stack
+  overflow; the fuzz corpus-replay invariant pins the boundary
+  (`fuzz/shared/src/payload_codec.rs`).
 - **Plain-path SQLite open** ([ADR-023](decisions/023-fourth-review-round.md)
   §3) — the SQLite engine's `open` path argument is a plain
   filesystem path: a string carrying a `?name=value` suffix is