decompose wave 5 — contract suite: audit-first split of the verification backlog (engines' columns already discharge most rows; map in review-wave-5's appendix), seven mechanism-grouped suite-row tasks (queue depth, scheduler, tx commit-atomicity, streams, locks, wakes, opts/backoff equivalence), two engine-side hardening tasks (sqlite commit-error arm, pg F-1 defense-in-depth), and the review-wave-5 gate that flips the engine specs to stable

tasks/suite-stream-rows.md

@@ -0,0 +1,80 @@
+---
+id: suite-stream-rows
+name: Contract-suite rows — cross-engine stream ordering equivalence + trim_to semantics
+status: pending
+depends_on: []
+scope: moderate
+risk: low
+impact: phase
+level: implementation
+tags: [wave-5, contract-suite, streams]
+---
+
+## Description
+
+Add the streams contract rows to
+`alkstore-contract-suite/src/properties.rs` and wire them into both
+engines' suite targets, discharging two backlog rows
+(core-contract.md §Verification backlog): "Cross-engine stream
+equivalence" (ADR-015 §3/§4) and "`trim_to` semantics on both
+engines" (ADR-015 §5 — the legs the existing `extent_clamp_semantics`
+row does not carry).
+
+Rows to add:
+
+- **`stream_ordering_equivalence`** — the ordering guarantee row:
+  a publish sequence with keyed/unkeyed interleavings yields `offset
+  ASC` global FIFO per stream — same publish order → same read order
+  on `read_since`, `read_from_consumer`, and a subscriber's attach
+  drain alike; offsets are strictly increasing per stream (per-stream
+  relative order — absolute offset values are explicitly *not*
+  cross-pinned: pg bigserial vs SQLite AUTOINCREMENT); `key`
+  round-trips exactly (`None` stays `None`, `Some` stays `Some`, on
+  every read form); `stream` carries the stream name and `created_at`
+  is unix-seconds-at-publish (informational — tolerance-bounded
+  proximity to now, never an ordering assertion). The single-event
+  key/payload round-trip already pins in
+  `payload_round_trip_stores_exact_encoding` — this row owns the
+  *sequence/ordering* property.
+- **`trim_to_semantics`** — the full ADR-015 §5 row: exact-boundary
+  trim (`offset <= horizon` — the horizon's own row deletes,
+  horizon+1 survives), surviving rows keep their offsets (gaps legal,
+  never renumbered — the negative-horizon/immutability legs already
+  pin in `extent_clamp_semantics`; this row owns the exact-boundary
+  and resume legs), a read from a trimmed-away region resumes at the
+  trim horizon's first remaining row, a saved offset below the horizon
+  stays a valid position marker (`get_offset` returns it;
+  `read_from_consumer` resumes at the horizon), trim emits no
+  dedicated wake and no notify (a pre-attached listener idles across
+  the trim — tolerance-bounded absence), and a subscriber with a
+  saved checkpoint never loses its place across a trim (its next read
+  continues from the horizon, not from a renumbered past).
+
+## Acceptance Criteria
+
+- [ ] Two rows exist, version-stamped (ADR-015 §3/§4/§5, ADR-019 §6
+      as applicable)
+- [ ] Rows wired into both engines' `contract_suite.rs` targets
+- [ ] SQLite column green server-less; pg column green against the
+      harness server
+- [ ] No duplication with the existing rows' legs (cross-reference in
+      each row's doc comment which row owns which leg)
+- [ ] `cargo test -p alkstore-sqlite -p alkstore-postgres` green
+      (pg rows skip cleanly server-less); clippy `-D warnings`; fmt clean
+
+## References
+
+- docs/architecture/core-contract.md §Verification backlog (cross-engine
+  stream equivalence; trim_to semantics)
+- docs/architecture/decisions/015-streams-depth.md §3/§4/§5
+- docs/architecture/decisions/019-mechanism-handle-surfaces.md §6
+- alkstore-contract-suite/src/properties.rs (the existing rows whose
+  legs this task complements)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion