release-flake-investigation: the fired lock-row trigger investigated and resolved — harness-model, fixed test-side

Instrumentation first: the tee-before-filter capture procedure of
record (demonstrated to preserve failing messages, immediately
vindicating itself — two natural repros captured verbatim), then the
arithmetic read against lock.rs/resolution.rs (delay-only argument
confirmed for the lapse legs, corrected for the contention leg:
second-precision now_unix stamps let a ttl=1 holder's exclusion
window collapse below a second), the conditions matrix (48+ rounds:
threads, concurrency with the SQLite column, cold/warm, CPU-load
stress), mechanism probes (1.2 s delay fails deterministically on the
exact assert; 200 ms lapses 2/10, frac-dependent), and the natural
repro (2/30 loaded solo runs, exact message at properties.rs:563).

Disposition: reproduced, root cause harness-model — the engine acted
per ADR-008 §7 throughout; the pre-fix row's contention leg asserted
a live-TTL state across an unbounded wall-clock gap. Trivially
test-side, so the fix landed in-session under the AC's exception:
lock_ttl_expiry_and_reacquisition is now two-legged (300 s exclusion
leg released; the 1 s lapse leg's post-sleep asserts stay
delay-only-safe); every pinned semantic survives.

Verified: 30/30 loaded runs of the fixed row green under the exact
repro condition; sqlite + mem columns green; workspace gates green
(build, live-pg workspace tests, clippy -D warnings, fmt); taskgraph
validate green.

Watch ledger: the lock row's flag retires; the trim row stays
watch-flagged (no repro, 10 focused + 7 loaded rounds); a new single
occurrence of row_stream_ordering_equivalence under synthetic load
(message captured — the row's drain window raced the pg bridge's
incomplete channel fill) is watch-flagged for review-wave-8's flake
outcome; no ride-along fix (instrumentation-first discipline).
Tasks: release-flake-investigation -> completed with Notes + Summary;
review-wave-5 ledger dated update.

tasks/review-wave-5.md

@@ -235,6 +235,33 @@ carriage (the release-readiness watch — wave 8 since the fuzzing
 wave's renumber) before any postulate-and-fix. Recorded here for the ledger's
 honesty; not blocking the fire-wake task.
 
+*Ledger update (2026-10-11, from the `release-flake-investigation`
+session):* the lock row's trigger has been **investigated and
+resolved** — `tasks/release-flake-investigation.md` carries the full
+record (the capture procedure of record, the conditions matrix, the
+read-back of the delay-only argument, the mechanism probes, the
+natural repro). The disposition: **harness-model, not the engine** —
+the pre-fix row's contention leg asserted a live-TTL state over a
+`ttl = 1` hold whose guaranteed window second-precision stamps
+(`now_unix`, `as_secs`) collapse below one second, so any ≳1 s
+scheduling stall between the holder's and the contender's
+acquisitions lapses the holder with the engine acting entirely per
+ADR-008 §7. Natural repro captured (2/30 loaded solo runs, the exact
+message at the exact assert site); fixed test-side that session (the
+row's two-leg shape: long-TTL exclusion leg, short-TTL lapse leg);
+30/30 loaded verification runs green under the exact repro condition.
+The lock row's watch flag **retires**. Two observations carry to the
+`review-wave-8` gate's flake outcome: the trim row stays
+watch-flagged (no repro in 10 focused + 7 loaded full-suite rounds
+this session), and a **new** single occurrence of
+`row_stream_ordering_equivalence` under 8-CPU-burner load is
+watch-flagged (message captured: `left: [1]` vs the six stored
+offsets at the attach-drain compare, `properties.rs:3052` — the row's
+recv-once-then-try_recv drain window raced the pg bridge's
+not-yet-complete channel fill; no ordering violation, no delivery
+failure — scheduling-lottery class, same as the lock row's contention
+leg); no ride-along fix (instrumentation-first discipline).
+
 **7. Findings.** No code, suite-row, or stamp defects requiring change
 were found at gate time; all changes this gate made are doc-side
 (engine specs `draft` → `stable` with dated gate annotations;