general review 004 (pre-release, whole workspace): one HIGH slot-poisoning fix, two contract-observable divergence fixes, robustness + doc corrections — all gates re-run green

- sqlite scheduler tick: a failed COMMIT (or ROLLBACK) left the connection
  released with a stuck-open transaction, wedging the writer slot forever —
  the one commit site missing the drop-+-reopen-replenish arm; tick now
  takes the conn by value with a poisoned disposition (drop + replenish),
  the commit-fault seam reaches the tick, and
  failed_tick_commit_replenishes_the_writer_slot pins the arm
- pg save_offset_tx stored GREATEST($3,0) where the wave-8 gate's
  negative-seed fix (raw seed, ADR-023 §2 2026-10-11 annotation) covered
  only the auto-commit form; mem's merged in-tx read clamped a staged
  negative seed against a phantom zero; both fixed and the tx-form
  totality pinned by a new stamped suite leg (in_tx_reads_see_own_writes)
  green on all three columns vs the live harness server
- pg: a failed forwarder register leaked the channel refcount forever
  (no receiver to drop it) — listen/spawn_bridge now unregister on the
  register error, mirroring the subscribe-failure arm; register doc
  corrected to put the failure disposition at the call site
- pg forwarder: nine poisoned-mutex expect() panics converted to the
  mem crate's into_inner recovery idiom (no-expect-outside-tests rule)
- core encode_payload: a deeply-nested Value aborted the process in
  serde_json's unguarded serializer recursion and the fuzz pin blessed
  storing bytes no decoder could read back; encode now rejects nesting
  past 127 containers (the empirically-verified decode limit) with typed
  Codec — decode-aligned boundary pins added to the fuzz invariant and
  value_type_tests, applied pre-publish within the open class-1 window
- scheduler sleep deadlines: Instant + Duration overflow caps (MAX_SLEEP_S,
  tick-and-resleep) on all three engines for far-future boundaries;
  sqlite tick claim stamp now saturating_add
- docs read true again: Error::Closed scope (stream try_recv arm),
  validation whitespace wording, sqlite lib.rs phantom durability knobs,
  pg lock.rs honest autocommit wording, mem tx/stream merge + wake-
  granularity wording; wakes.rs stale allow(dead_code) removed
- tests: value_type_tests exercised its own map_err instead of the
  function under test (fixed); unwrap_or_default reference encodes
  panic with cause
- docs/reviews/004-pre-release-general-review.md records nine fixed +
  sixteen parked findings (sqlite seam panic-safety armor, watcher
  post-death-subscribe hang + initial-stat self-kill, pg forwarder
  TOCTOU/hang/diagnosability, pg BIGINT server-side stamp overflow, mem
  growth/outbox notes, pg identifier-truncation doc note, smaller) and
  two false positives caught on verification; implementation.md
  review-rounds entry + core-contract backlog rows updated
- gates: build, workspace tests (sqlite 194, core 27, suite legs new),
  full live pg column 127+25+9, clippy -D warnings, fmt, fuzz replay
  6/6, wasm32 check, doc gate -D warnings — all green

docs/plans/implementation.md

@@ -1,8 +1,9 @@
 ---
 status: draft
 last_updated: "2026-10-11 (wave 8 implemented + reviewed — the release
-gate passed: the class-1 window's dispositions complete, the suite's
-registered boundary-legs follow-up landed, all gates re-run green;
+gate passed and the pre-release general review (004) followed it,
+fixing one high-severity slot-poisoning defect, two contract-observable
+divergences, and their suite/test/doc pins; all gates re-run green;
 implementation complete pending the user's manual `cargo publish`.)"
 ---
 
@@ -782,8 +783,43 @@ decomposes. Specific gates:
   session (fresh package listing + exclusion re-run, no leakage); the
   frontmatter sweep + renumber spot-checks re-run green; all gates
   re-run green including the fuzz replay, wasm32, and the doc gate;
-  the release-facing spec set (core-contract.md, overview.md,
-  queues.md, deployment.md, the architecture README) flipped
-  `stable`. Implementation complete pending the user's manual
-  `cargo publish` (the checklist of record is in
-  `tasks/release-publish-prep.md`).
+   the release-facing spec set (core-contract.md, overview.md,
+   queues.md, deployment.md, the architecture README) flipped
+   `stable`. Implementation complete pending the user's manual
+   `cargo publish` (the checklist of record is in
+   `tasks/release-publish-prep.md`).
+- **General review, pre-release / wave 8** (2026-10-11,
+  `docs/reviews/004-pre-release-general-review.md` — the record is
+  004 in the directory's sequence; a whole-workspace pass with four
+  parallel per-crate deep reads plus a cross-cutting sweep, distinct
+  from the gate) — nine findings fixed inline, sixteen recorded as
+  follow-up material, two false positives caught on verification:
+  the scheduler tick's failed `COMMIT`/`ROLLBACK` leaving the SQLite
+  writer slot wedged with a stuck-open transaction (HIGH — the one
+  commit site missing the drop-+-replenish arm; fixed with the
+  commit-fault seam reaching the tick and a replenish test); the wave-8
+  gate's pg negative-seed fix having missed the **tx seam**
+  (`save_offset_tx` still clamped, mem's in-tx merged read clamping
+  against a phantom zero — fixed, and the tx-form totality pinned by a
+  new stamped suite leg green on all three columns vs the live
+  server); the pg `register`-failure refcount leak (both subscription
+  call sites now unregister on error); pg's fanout/registry
+  poisoned-mutex `expect`s converted to the mem poison-recovery idiom;
+  `encode_payload`'s deep-nesting process abort replaced by a typed
+  `Codec` rejection at a decode-aligned depth limit (127 containers —
+  the fuzz invariant's old "encodes but can never be read back" pin
+  corrected, boundary legs added, applied pre-publish within the open
+  class-1 window); sleep-deadline `Instant + Duration` overflow caps
+  and a `saturating_add` in the sqlite tick's claim stamping; six
+  doc-vs-code corrections (core `Error::Closed` scope, validation
+  wording, the sqlite lib doc's phantom "durability knobs", pg
+  `lock.rs`'s atomicity claim, mem's merge/wake-granularity wording);
+  test hygiene in `value_type_tests.rs`; the stale
+  `#![allow(dead_code)]` on mem's wakes module. Parked follow-up
+  inventory (no release blocker): sqlite seam panic-safety armor, the
+  watcher post-death-subscribe hang + initial-stat self-kill, the pg
+  forwarder TOCTOU/hang/diagnosability arms, the pg BIGINT
+  server-side stamp overflow, the mem growth/outbox notes, the pg
+  identifier-truncation doc note, and smaller records. All gates
+  re-run green after the fixes (build, workspace tests, live pg
+  column, clippy, fmt, fuzz replay 6/6, wasm32, doc gate).