Contract-suite tx commit-atomicity rows (task suite-tx-commit-atomicity-rows): the N-5 panic-probe admission in properties.rs's module doc (spawned with_tx task joined via JoinError::is_panic — catch_unwind around an async closure cannot see the panic point across an await; post-panic assertions read-only until convergence, single-task drive, no race window; ADR-017 §2 class 4) and three version-stamped rows: outbox_enqueue_tx_commit_atomicity (rollback drops the backing-queue job with the business write — get_job_tx-gone + run_once claims nothing; commit makes the job claimable exactly when the business write commits, real delivery through the RecordingDelivery closure with job-id identity, derived __alkstore_outbox:mail queue, exact payload, 60/5/5 stamps, consumed-after-ack; ADR-014 §1, ADR-010 §3a, ADR-021 §4, ADR-007), publish_with_key_tx_commit_atomicity (rollback drops the keyed event with the business write, key round-tripping inside the tx; commit surfaces it to read_since and a post-commit subscriber attach with the key round-tripping; ADR-015 §2/§4, ADR-021 §4, ADR-007), and with_tx_panicking_closure_rolls_back (N-5's probe against real engines: the panicking closure writes all four kinds then panics mid-flight; panic surfaces via the join; no-ghost reads converge with begin_tx granting every iteration; pre-panic listener silence on the notified channel; ghost never claimable; fresh with_tx commits through the same seam — both engines green; ADR-007, ADR-021 §4) — wired into both engines' suite targets (SQLite tokio tests, pg harness_row!s). Dispositions recorded in Notes: the 60/5/5 stamp inspection rides the delivery handle's job() because get_job cannot target the reserved derived backing queue through the contract surface (exemplar row pins the rejection; engine-side raw-row probes stayed put), the panic row's notify leg is a windowed silence (SQLite's wake overtriggers on any commit — the fully cross-engine notify-ghost pin rides the engines' rollback-ghosts twins, the suite's drop-rollback row made the same call), the closure tail routes through a #[cold] mid_flight_panic -> Error helper (a bare Err(panic!()) tail trips unreachable_code under -D warnings), and the post-panic convergence loop is the suite-side bounded wait (state outcomes only, begin_tx doubling as the seam-still-grants probe). Verified: sqlite suite 19/19, pg suite 19/19 vs harness twice (postgres/poc@:15432) + solo re-runs of each new row per engine (determinism), workspace build/test green, clippy -D warnings, fmt clean

alkstore-postgres/tests/contract_suite.rs

@@ -166,10 +166,11 @@ mod rows {
         drop_rollback_leaves_no_ghosts, duration_refusal_on_non_positive_ttl,
         enqueue_opts_resolution, extent_clamp_semantics, in_tx_reads_see_own_writes,
         job_handle_validity_predicate, name_validation_rejects_empty_and_reserved,
-        payload_round_trip_stores_exact_encoding, payload_too_large_produced_on_pg,
+        outbox_enqueue_tx_commit_atomicity, payload_round_trip_stores_exact_encoding,
+        payload_too_large_produced_on_pg, publish_with_key_tx_commit_atomicity,
         queue_depth_reclaim_and_dead_letter, receiver_close_and_save_arms,
         scheduler_boundary_fires, scheduler_bounded_catchup, scheduler_leadership_discipline,
-        sweep_no_stranded_rows,
+        sweep_no_stranded_rows, with_tx_panicking_closure_rolls_back,
     };
 
     use super::PgFactory;
@@ -265,6 +266,21 @@ mod rows {
         scheduler_leadership_discipline,
         "row-scheduler-leadership"
     );
+    harness_row!(
+        row_outbox_enqueue_tx_commit_atomicity,
+        outbox_enqueue_tx_commit_atomicity,
+        "row-outbox-tx-atomicity"
+    );
+    harness_row!(
+        row_publish_with_key_tx_commit_atomicity,
+        publish_with_key_tx_commit_atomicity,
+        "row-keyed-tx-atomicity"
+    );
+    harness_row!(
+        row_with_tx_panicking_closure_rolls_back,
+        with_tx_panicking_closure_rolls_back,
+        "row-panic-rollback"
+    );
 }
 
 mod factory_shape {