review-wave-8 — the pre-release gate passes: one contract-observable divergence found and fixed (pg's negative-seed GREATEST clamp + offsets CHECK contradicted ADR-023 §2's stored-checkpoint annotation; raw seed now, window open until first publish); the close-out's registered suite-duty follow-up discharged (negative heartbeat(extend) leg in job_handle_validity_predicate, negative save_offset seed leg in receiver_close_and_save_arms — stamped, uniform, green on all three columns vs the live harness server); the class-1 termination of record landed in ADR-017 §2 (no undisposed candidate remains; the window closes permanently at the first cargo publish); release-facing spec set flipped stable with dated gate annotations (core-contract, overview, queues, deployment current, the architecture README — Current State through wave 8, engine-mem's table row corrected); implementation.md records updated; N-1/Findings 2–3/flake/publish-prep audits recorded; all gates re-run green incl. fuzz replay, wasm32, doc gate

alkstore-postgres/src/schema.rs

@@ -298,12 +298,13 @@ CREATE INDEX IF NOT EXISTS {events_read_idx} ON {events} (stream, id);
 
 -- Offsets table: (stream, consumer) → offset, the monotone
 -- checkpoint upsert target (the streams task's SQL owns the
--- monotonicity rule, GREATEST-guarded upsert, one owner). The
--- non-negative CHECK bounds the domain (cursors start at 0).
+-- monotonicity rule, WHERE-guarded upsert, one owner). The boundary
+-- argument is total (ADR-023 §2): no domain CHECK — a negative seed
+-- is stored raw, reads anchor at it and resume forward identically.
 CREATE TABLE IF NOT EXISTS {offsets} (
   stream TEXT NOT NULL,
   consumer TEXT NOT NULL,
-  \"offset\" BIGINT NOT NULL DEFAULT 0 CHECK (\"offset\" >= 0),
+  \"offset\" BIGINT NOT NULL DEFAULT 0,
   PRIMARY KEY (stream, consumer)
 );
 

alkstore-postgres/src/stream.rs

@@ -28,9 +28,13 @@
 //!   stored checkpoint (absent consumer = 0, ADR-019 §1).
 //! - `save_offset` / `get_offset` — the monotone upsert (a save below
 //!   the stored checkpoint is a silent no-op — one owner of the
-//!   monotonicity rule, the `GREATEST`-clamped + `WHERE`-guarded
-//!   upsert `save_offset_tx` also rides) and the checkpoint read.
-//!   Both save forms' `Err` arm carries `Database` only (ADR-021 §5).
+//!   monotonicity rule, the `WHERE`-guarded upsert `save_offset_tx`
+//!   also rides) and the checkpoint read. The boundary argument is
+//!   total per ADR-023 §2's 2026-10-11 annotation: any `i64` is
+//!   well-defined, a negative seed is stored raw as the checkpoint
+//!   (no clamping — the offsets column's `DEFAULT 0` is not a domain
+//!   bound; reads anchored there resume forward identically), and
+//!   both save forms' `Err` arm carries `Database` only (ADR-021 §5).
 //! - `trim_to(horizon)` — `DELETE … WHERE id <= horizon` on a pool
 //!   connection (wakes nothing — ADR-015 §5's posture; the boundary
 //!   argument is total per ADR-023 §2: a negative horizon deletes
@@ -371,13 +375,14 @@ async fn stream_get_offset(pool: &Pool, schema: &str, stream: &str, consumer: &s
 }
 
 /// The monotone checkpoint save (one owner of the monotonicity rule —
-/// the same GREATEST-clamped, WHERE-guarded upsert `save_offset_tx`
-/// rides; a save at-or-below the stored checkpoint updates nothing,
-/// ADR-019 §6). First save seeds the checkpoint, clamped at 0 (the
-/// offsets table's non-negative domain CHECK would abort a negative
-/// seed; the clamp preserves both the domain and the monotone rule —
-/// a negative save at-or-below the stored checkpoint is the same
-/// silent no-op a 0-save is).
+/// the same `WHERE`-guarded upsert `save_offset_tx` rides; a save
+/// at-or-below the stored checkpoint updates nothing, ADR-019 §6).
+/// The boundary argument is total per ADR-023 §2's 2026-10-11
+/// annotation: any `i64` is well-defined — a negative first save
+/// seeds the checkpoint raw (the monotone guard `EXCLUDED > o`
+/// treats every pre-existing row as the below-checkpoint no-op arm;
+/// reads anchored at a negative checkpoint resume forward
+/// identically).
 async fn stream_save_offset(
     pool: &Pool,
     schema: &str,
@@ -390,7 +395,7 @@ async fn stream_save_offset(
     conn.execute(
         &format!(
             "INSERT INTO {offsets} AS o (stream, consumer, \"offset\")
-             VALUES ($1, $2, GREATEST($3::bigint, 0))
+             VALUES ($1, $2, $3::bigint)
              ON CONFLICT (stream, consumer) DO UPDATE
                SET \"offset\" = EXCLUDED.\"offset\"
              WHERE EXCLUDED.\"offset\" > o.\"offset\""