review-wave-8 — the pre-release gate passes: one contract-observable divergence found and fixed (pg's negative-seed GREATEST clamp + offsets CHECK contradicted ADR-023 §2's stored-checkpoint annotation; raw seed now, window open until first publish); the close-out's registered suite-duty follow-up discharged (negative heartbeat(extend) leg in job_handle_validity_predicate, negative save_offset seed leg in receiver_close_and_save_arms — stamped, uniform, green on all three columns vs the live harness server); the class-1 termination of record landed in ADR-017 §2 (no undisposed candidate remains; the window closes permanently at the first cargo publish); release-facing spec set flipped stable with dated gate annotations (core-contract, overview, queues, deployment current, the architecture README — Current State through wave 8, engine-mem's table row corrected); implementation.md records updated; N-1/Findings 2–3/flake/publish-prep audits recorded; all gates re-run green incl. fuzz replay, wasm32, doc gate

alkstore-contract-suite/src/properties.rs

@@ -1324,7 +1324,10 @@ pub async fn backoff_curve_equivalence(factory: &dyn StoreFactory) {
 /// Contract stamp: ADR-021 §5 (receiver error/close arms —
 /// `Database`-only `Err`, terminal `None` close, SQLite closes on
 /// watcher death); ADR-019 §6 (save composition — monotone, forms
-/// interleave); ADR-008 §8 (explicit saves only).
+/// interleave); ADR-008 §8 (explicit saves only); ADR-023 §2
+/// (annotated 2026-10-11 — the boundary/offset row's totality covers
+/// `save_offset`: a negative seed is stored as the checkpoint, this
+/// row's negative-leg pins).
 pub async fn receiver_close_and_save_arms(factory: &dyn StoreFactory) {
     let store = factory.open().await.expect("factory opens a store");
 
@@ -1416,6 +1419,38 @@ pub async fn receiver_close_and_save_arms(factory: &dyn StoreFactory) {
         "the receiver form never regresses the direct form's save"
     );
 
+    // Boundary-total save (ADR-023 §2, annotated 2026-10-11): a
+    // negative offset is stored as the checkpoint — the argument is
+    // total, no clamping, no rejection — and reads anchored there
+    // resume forward identically (every event offset lies above the
+    // negative anchor, so the anchored read yields the log from the
+    // start). Fresh consumer, so this leg also pins the *seed* case —
+    // the only arm where a clamping realization would diverge.
+    stream.save_offset("c2", -5).await.unwrap();
+    assert_eq!(
+        store
+            .stream("events")
+            .await
+            .unwrap()
+            .get_offset("c2")
+            .await
+            .unwrap(),
+        -5,
+        "a negative seed is stored as the checkpoint (totality, no clamp)"
+    );
+    let resumed = store
+        .stream("events")
+        .await
+        .unwrap()
+        .read_from_consumer("c2", 10)
+        .await
+        .unwrap();
+    assert_eq!(
+        resumed.iter().map(|e| e.offset).collect::<Vec<_>>(),
+        vec![o1, o2],
+        "reads anchored at the negative checkpoint resume forward: the log from the start"
+    );
+
     // Terminal close on disposal (this engine's documented close
     // cause: the watcher's death guard clears the feed — ADR-021 §5's
     // SQLite arm; the store handle dropping is the disposal).
@@ -1770,7 +1805,10 @@ async fn past_stamp_sleep(millis: u64) {
 /// (delete-on-ack; `ack_batch`'s per-id predicate, partial success
 /// ordinary); ADR-010 §4 (the engine-default strings); ADR-019 §3
 /// (the claim handle's op surface — one-shot consumables, repeatable
-/// heartbeat); ADR-008 §5 (refusals are `false`, never errors).
+/// heartbeat); ADR-008 §5 (refusals are `false`, never errors);
+/// ADR-023 §2 (annotated 2026-10-11 — the boundary/offset row's
+/// totality covers `heartbeat(extend)`: a negative extension is the
+/// relative-instant void this row's negative-extend leg pins).
 pub async fn job_handle_validity_predicate(factory: &dyn StoreFactory) {
     let store = factory.open().await.expect("factory opens a store");
 
@@ -1818,6 +1856,50 @@ pub async fn job_handle_validity_predicate(factory: &dyn StoreFactory) {
         "delete-on-ack completed work leaves no row"
     );
 
+    // Boundary-total heartbeat (ADR-023 §2, annotated 2026-10-11): a
+    // negative extension is a relative instant — the renewed deadline
+    // `now + extend` sits in the past, voiding the claim through the
+    // validity predicate on the *next* op, never an error. The
+    // heartbeat itself reports the successful renewal (`true`) while
+    // the row was processing and unexpired at call time; the voided
+    // claim then refuses all handle ops (ack here) and the row
+    // survives as processing. Six-hundred-second margin: fully past,
+    // deterministic without a sleep. Own queue: the voided row is
+    // expired-processing (re-claimable), and this row's later legs
+    // assert claim FIFO on their queues.
+    let voidq = store
+        .queue("voided", alkstore::QueueOpts::default())
+        .await
+        .unwrap();
+    let voided_id = voidq
+        .enqueue(json!({"leg": "negative-extend"}), EnqueueOpts::default())
+        .await
+        .unwrap();
+    let voided = voidq
+        .claim_one("w1")
+        .await
+        .unwrap()
+        .expect("the ready row claims");
+    assert_eq!(voided.job().id, voided_id);
+    assert!(
+        voided.heartbeat(-600).await.unwrap(),
+        "a negative extension lands while the claim is unexpired (totality)"
+    );
+    assert!(
+        !voided.ack().await.unwrap(),
+        "the negative extension voided the claim: ack refuses through the validity predicate"
+    );
+    assert_eq!(
+        voidq
+            .get_job(voided_id)
+            .await
+            .unwrap()
+            .expect("the voided row was not deleted or dead-lettered")
+            .state,
+        JobState::Processing,
+        "the voided claim's row survives as processing (re-claimable by the queue)"
+    );
+
     // Lapse legs: one claim per refusal op, all stamped with the 1 s
     // visibility, one tolerance sleep past every deadline at once.
     let ack_refused = fast