review-004-fixes gate passed — all sixteen dispositions verified by code-read against the review's failure mechanisms (armor/state-machine/hardening/decision changes structurally match their tasks' Notes of record; every injected-panic/death/interleave test drives the real mechanism); no regressions among the review-004 inline fixes' pinned postures (tick drop-+-replenish, raw tx-form seed + mem has_offset_row, MAX_SLEEP_S caps, saturating claim stamp, register-failure unregisters, poison-recovery idiom, encode depth 127); records landed — review 004's recorded-findings items annotated with dispositions/task pointers (record reads closed), implementation.md gains the fix-batch review-rounds entry, task-file audit done with three minor hygiene defects fixed inline (stale placeholder lines incl. pre-existing ones in review-wave-3/release-readme, completed-AC checkboxes left unticked on five batch tasks, the gate description's fifteen→sixteen task count); gates green this session: build, server-less workspace tests, full live pg column vs harness pglo-poc (135+26+9), clippy -D warnings, fmt --check, fuzz corpus replay 6/6, wasm32 mem check, doc gate zero warnings, taskgraph validate (96); task -> completed

docs/plans/implementation.md

@@ -821,5 +821,33 @@ decomposes. Specific gates:
   forwarder TOCTOU/hang/diagnosability arms, the pg BIGINT
   server-side stamp overflow, the mem growth/outbox notes, the pg
   identifier-truncation doc note, and smaller records. All gates
-  re-run green after the fixes (build, workspace tests, live pg
-  column, clippy, fmt, fuzz replay 6/6, wasm32, doc gate).
+   re-run green after the fixes (build, workspace tests, live pg
+   column, clippy, fmt, fuzz replay 6/6, wasm32, doc gate).
+- **Review-004 fix batch** (2026-10-11) — the sixteen recorded findings
+  decomposed into sixteen tasks (items 2+3 and 4+6 bundled; item 5
+  split into the decision + its implementation; the pg
+  scheduler-classification twin added mid-batch at the sqlite task's
+  implementation): the sqlite auto-commit seams' panic-safety armor
+  (RAII leases, drop-not-release, replenish/abandon dispositions);
+  the dead-watcher subscribe fail-closed + the identity-unknown
+  baseline; the listen bridge aligned to the stream bridge's
+  std-thread shape; the run_schedules loss-vs-failure classification
+  landed on both engines (dated ADR-009 §1 annotation, engine-neutral)
+  with the `LeadershipLost`-at-a-dead-store misdirection gone; the
+  substrate's ten UDF `// SAFETY` comments riding delta D-40; the pg
+  forwarder TOCTOU closed (decide-and-queue under the registry guard)
+  and both hang arms bounded (`bounded_wait`, the black-hole proxy
+  harness test); the pg BIGINT stamp sums saturated server-side (the
+  signed decision, `saturating_stamp_expr` at six sites, ADR-023 §2
+  annotation); `tracing` adopted engine-only (ADR-025, user sign-off;
+  all 19 `eprintln!` sites migrated, D-41) with both forwarder
+  diagnosability arms surfaced; core's pre-yield `offset()` verified
+  equal across engines and pinned (contract text + trait doc + suite
+  row); `Display` made control-char-safe (incl. `Error::Codec`); the
+  mem growth/outbox and pg identifier-truncation doc pins; the tokio
+  dev-dep features normalized. The batch's review gate (`review-004-fixes`)
+  verified every disposition by code-read against the review's failure
+  mechanism, re-spot-checked the inline fixes' pinned postures, and
+  annotated review 004's recorded-findings items with their
+  dispositions; residual task-file hygiene cleaned (stale placeholder
+  lines, AC checkboxes).