mem engine queues — the wave-6 mechanism task lands: coverage reconciliation against the seam task's foundation, with the six unpinned engine-side pins (mem-engine-queues)

The queue mechanism (ADR-010 state machine over the in-memory job
table, mem's third-owner equal-jitter curve + opts resolution)
already landed implemented with the seam task's whole-engine scope
(mem-engine-seam-tx Note 1); this task's work, per the disposition the
notify/listen twin recorded, was reconciling the description's pin
list against the existing suite and adding the missing engine-side
unit pins — no production code changed, the realization verified
correct as-found.

Already pinned by the seam task (reconciled, recorded in Notes):
lifecycle + stamps + resolved get_job values, claim ordering, extent
clamps at entry, worker-id validation, the uniform validity predicate,
late-heartbeat refusal + absolute-reset renewal, reclaim-eats-attempt
+ loser-ack-refuses, the pinned dead-letter default strings, dead-row
get_job visibility, both-states sweep + retention + scoping, the tx
stamp shapes, and the resolution legs + base-5 curve range/cap/spread.

Added (6): the in-process claim-race atomicity pin (8 concurrent
workers over 4 rows — every row handed exactly once through the
guarded section, the description's claim-vs-claim bullet); the
claim-vs-expiry boundary determinism pin (at now == deadline: the d <
now reclaim predicate and the d >= now holder-op predicate are
coherent — no reclaim, heartbeat/ack still valid; one second past:
reclaimable with its attempt consumed; lapsed ids silently uncounted
by ack_batch); the engine-side mirror of the suite's
backoff_curve_equivalence row — base 2 s at [1,2]/[2,4]/[4,8] driven
end-to-end through claim -> retry(None) -> get_job's run_at with the
Some(5)-verbatim and Some(0)-ready-now override legs, exact under the
frozen clock — both through the handle and pinned at backoff_delay_s
itself (the cap leg stays in resolution.rs's base-5 pins per
suite-opts-backoff-rows' recorded disposition); the D-12 pre-claim
sweep pin (a lapsed row with its budget spent claims nothing and
dead-letters with the exhaust string at the next claim, never
strands); and unconditional cancel across both states (the holder's
post-cancel ack refusing — the not-an-interrupt honesty). One
test-authoring note recorded: heartbeat's absolute reset moves the
deadline, so boundary legs stage on fresh rows to keep each
observation exact.

Task file: status completed, Notes (the seam-carried disposition +
reconciliation inventory + the six adds + the heartbeat-observation
note) + Summary filled. Verified: cargo test -p alkstore-mem 97/97
(91 + 6 new; new tests green solo x3), workspace cargo test green
(core 25, suite-harness 3, mem 97, pg 124+25+9, SQLite 191+25),
clippy --all-targets -D warnings clean, cargo fmt --check clean,
cargo check --target wasm32-unknown-unknown -p alkstore-mem clean

tasks/mem-engine-queues.md

@@ -1,7 +1,7 @@
 ---
 id: mem-engine-queues
 name: Mem engine — queues (in-memory job table, ADR-010 state machine, engine-owned backoff curve)
-status: pending
+status: completed
 depends_on: [mem-engine-seam-tx, mem-engine-notify-listen]
 scope: moderate
 risk: medium
@@ -57,15 +57,15 @@ machine realized over an in-memory job table — all driver-free.
 
 ## Acceptance Criteria
 
-- [ ] Full `Queue`/`JobHandle` surfaces over the in-memory job table
-- [ ] The ADR-010 state machine properties unit-pinned: visibility
+- [x] Full `Queue`/`JobHandle` surfaces over the in-memory job table
+- [x] The ADR-010 state machine properties unit-pinned: visibility
       reclaim consumes an attempt, dead-letter moves, no-stranded-rows
       sweep, handle-op validity predicate, late-heartbeat boundary
-- [ ] Equal-jitter curve + opts resolution pinned to the identical
+- [x] Equal-jitter curve + opts resolution pinned to the identical
       numeric behavior the suite's equivalence rows assert (per the
       engine-side pin posture used for the cap legs)
-- [ ] Numeric-domain guards (extents) at entry — pinned
-- [ ] `cargo check --target wasm32-unknown-unknown -p alkstore-mem`
+- [x] Numeric-domain guards (extents) at entry — pinned
+- [x] `cargo check --target wasm32-unknown-unknown -p alkstore-mem`
       clean; workspace gates green
 
 ## References
@@ -79,8 +79,100 @@ machine realized over an in-memory job table — all driver-free.
 
 ## Notes
 
-> To be filled by implementation agent
+> Filled by implementation agent, 2026-10-10.
+
+1. **The implementation already landed in the seam task** —
+   `mem-engine-seam-tx` Note 1 records that the mem engine's full
+   `Store` surface (including the `MemQueueHandle`/`MemJobHandle`
+   mechanism in `alkstore-mem/src/queue.rs` and mem's third-owner
+   `resolution.rs` arithmetic) is all-or-nothing per trait impl, so
+   this task found its mechanism *implemented*. Its work was the
+   coverage reconciliation against the description's pin list plus the
+   missing engine-side unit pins — the same disposition the
+   notify/listen twin task recorded (`mem-engine-notify-listen`
+   Notes 1–3).
+2. **Coverage reconciliation**: already pinned by the seam task's
+   suite in `queue.rs`/`resolution.rs`/`tx.rs` — the full lifecycle +
+   stamp resolutions (300/3/5/none + per-job override, resolved
+   values shown by `get_job`), claim ordering (priority DESC →
+   ready-time ASC → id ASC), extent clamps (`n = 0`/`n < 0` → empty
+   at the entry, before any effect), empty-`worker_id` rejection, the
+   uniform validity predicate (lapse refuses all ops, refusals leave
+   the row intact), late-heartbeat refusal + absolute-reset renewal
+   (with `claimed_at`/`attempts` untouched), reclaim-consumes-an-
+   attempt + the loser's ack refusing (the dual-execution honesty),
+   retry/fail default strings (`"max attempts exceeded"` / `"failed"`)
+   + caller strings via the exhaust path, dead-row `get_job`
+   visibility with `last_error`/`died_at`, the both-states
+   no-stranded-rows sweep + retention (incl. forever-`None`) + queue
+   scoping, the tx/no-handle stamp shapes (plain 300/3/5/none,
+   outbox 60/5/5 in `tx.rs`), and the resolution legs (delay-wins-
+   over-`run_at`, `run_at` literal, neither→now, negative-delay total,
+   relative-`expires`) + the base-5 curve range/cap/spread pins in
+   `resolution.rs`.
+3. **What this task added** — the six unpinned shapes: (a)
+   `concurrent_claims_hand_out_work_exactly_once` (8 racing workers
+   over 4 rows via spawned `claim_batch` handles: every row exactly
+   once — the guarded-section claim-vs-claim atomicity pin the
+   description's "claim race is in-process" bullet asks for); (b)
+   `claim_vs_expiry_is_deterministic_at_the_row_boundary` (at
+   `now == claim_expires_at`: no reclaim (`d < now` false), the
+   holder's heartbeat/ack still valid (`d >= now`) — the two
+   predicates' boundary coherence; one second past: reclaimable with
+   its attempt consumed; the lapsed id silently uncounted by
+   `ack_batch`); (c) `the_equal_jitter_curve_mirrors_the_suite_rows_
+   numeric_bounds` (base 2, `max_attempts` 7 — the suite row's own
+   shape: three claim→`retry(None)` cycles asserting [1,2]/[2,4]/[4,8]
+   read back through `get_job`'s `run_at`, exact under the frozen
+   clock; plus the override legs `Some(5)` verbatim and `Some(0)`
+   ready-now per the boundary-total rule) — the engine-side pin of
+   AC3's "identical numeric behavior"; the cap leg stays pinned in
+   `resolution.rs`'s base-5 tests per `suite-opts-backoff-rows`'s
+   recorded disposition; (d) `backoff_base_two_lands_in_the_suite_
+   rows_exact_bounds` in `resolution.rs` — the same base-2 bounds at
+   the arithmetic function itself; (e) `the_pre_claim_sweep_dead_
+   letters_exhausted_reclaimables` (the D-12 shape: a lapsed row with
+   its budget spent claims nothing and dead-letters with the exhaust
+   string at the *next* claim — never strands claimable); (f)
+   `cancel_is_unconditional_across_states` (pending + processing
+   deleted, row-less `Ok(false)`, the holder's post-cancel ack
+   refusing — the not-an-interrupt honesty).
+4. **No production code changed** — the seam task's realization was
+   verified correct as-found; this task is tests only (+5 in
+   `queue.rs`, +1 in `resolution.rs`, 97 mem tests total). One
+   test-authoring note: `heartbeat`'s absolute reset moves the
+   deadline (`now + extend`), so a boundary-reclaim leg staged after a
+   heartbeat on the *same* row reads the shifted deadline — the
+   boundary test stages its legs on fresh rows to keep each
+   observation exact.
 
 ## Summary
 
-> To be filled on completion
+> Filled on completion, 2026-10-10.
+
+Completed the mem engine's queues task against the seam task's
+foundation: reconciled the description's pin list against
+`alkstore-mem/src/queue.rs` + `resolution.rs` + `tx.rs`'s existing
+suite (13 pre-existing queue mechanism tests + the resolution and tx
+stamp pins), found the full `Queue`/`JobHandle` surfaces and nearly
+all ADR-010 properties already pinned, and added the six gaps: the
+in-process claim-race atomicity pin (8 concurrent workers, exact-once
+handout over the guarded section), the claim-vs-expiry boundary
+determinism pin (the `d < now` / `d >= now` predicates' edge-second
+coherence + the lapsed `ack_batch` non-count), the engine-side mirror
+of the suite's `backoff_curve_equivalence` row (base 2 → [1,2]/[2,4]/
+[4,8] end-to-end through claim→`retry(None)`→`get_job.run_at` with
+the `Some(5)`/`Some(0)` override legs, and the same bounds pinned at
+`backoff_delay_s` itself; the 1-hour cap stays in `resolution.rs`'s
+base-5 pins per the recorded suite disposition), the D-12 pre-claim
+exhausted-reclaimable dead-letter sweep, and the both-states
+unconditional `cancel`. Acceptance criteria: full surfaces ✓ (seam
+task, lifecycle test), ADR-010 properties ✓ (seam tests + the new
+boundary/reclaim/sweep pins), curve + opts resolution numeric
+equivalence ✓ (new base-2 pins), extent guards ✓ (seam clamp test),
+gates ✓. Verified: `cargo test -p alkstore-mem` 97/97 (91 + 6 new,
+new tests green solo ×3), workspace `cargo test` green (core 25,
+suite-harness 3, mem 97, pg 124+25+9, SQLite 191+25),
+`cargo clippy --all-targets -- -D warnings` clean, `cargo fmt --check`
+clean, `cargo check --target wasm32-unknown-unknown -p alkstore-mem`
+clean — the wave-6 wasm gate stays green.