core: verify and pin the receiver's pre-yield offset() value (review 004 item 12, core-pin-offset-initial-value) — the three engines verified equal live, so the doc-pin branch applies: offset() reads 0 before any yield on every receiver — fresh consumer, stored positive checkpoint, stored negative seed (ADR-023 §2's totality arm, the one a checkpoint-seeded realization would surface on) — the no-yield sentinel, never the stored checkpoint: the checkpoint gates the feed's attach-read start while the receiver's offset tracks the last-yielded event only, composing with the pinned pre-yield save_offset() no-op; the attach read's prefetches sit unobserved and the first recv/try_recv observation is the first move (then the post-yield value, receiver_close_and_save_arms' pin). Verified by code read first (all three offset() bodies are self.position, all three constructors seed position: 0 unconditionally — mem stream.rs:353, sqlite :399, pg :620) then live: new suite row receiver_offset_pre_yield_is_zero (alkstore-contract-suite, stamped ADR-008 §8 + the core-contract.md pin, four arms incl. the first-observation composition leg) green on all three columns, pg against the harness server (parked pglo-poc :15432); pinned in three places: core-contract.md streams/subscribe row (dated 2026-10-11 annotation) + a verification-backlog bullet recording the verified pin, the core trait doc on offset() (core's doc comments are contract text), and the suite row itself — ADR-008 §8's shape comment deliberately left untouched (doc-only verification takes no ADR amendment, noted in the task); no engine code changed, no divergence to raise; gates green: workspace build/tests server-less, full pg column vs harness (135+26+9), clippy -D warnings, fmt --check, doc gate zero warnings, fuzz corpus replay 6/6, wasm32 mem check, taskgraph validate (96); task -> completed

docs/architecture/core-contract.md

@@ -5,7 +5,8 @@ publish→wake ordering tolerance recorded; ADR-023 §2's
 `heartbeat(extend)`/`save_offset` classifications;
 `EventReceiver::try_recv`'s closed shape; `get_job`'s id-global prose —
 then wave-8 gate: flipped stable with the close-out pass's suite legs
-landed; the contract text freezes at the gate, ADR-017 §2)"
+landed; the receiver `offset()` pre-yield pin, review-004 item 12;
+the contract text freezes at the gate, ADR-017 §2)"
 ---
 
 # Core contract
@@ -364,7 +365,15 @@ business-tx shape). Depth pinned by
   receiver's engine-side trigger is engine-internal, but events
   never require polling to become visible (the queues row's pg
   re-poll safety net is an admission of LISTEN loss, not the
-  posture).
+  posture). The receiver's `offset()` reads 0 before any event
+  yields *(annotated 2026-10-11, review-004 item 12's named gap)*:
+  the pre-yield value is the no-yield sentinel, not the consumer's
+  stored checkpoint — the saved checkpoint gates the feed's
+  attach-read start, while the receiver's offset tracks the
+  last-yielded event only, so the pre-yield `save_offset()` no-op
+  (stored checkpoint untouched) and the 0 sentinel compose. Events
+  the attach read prefetches sit in the receiver's feed unobserved;
+  the first `recv`/`try_recv` observation is the first move.
 
 ### queues
 
@@ -838,6 +847,16 @@ before the engine specs are called `stable`:
   cadence (config-surface accounting — wall-clock cadence
   measurements stay out of the contract suite's deterministic
   posture).
+- **Receiver `offset()` pre-yield initial value on all three
+  engines** (the 2026-10-11 general review's item 12, the named
+  gap) — `offset()` reads 0 before any yield for a fresh consumer, a
+  consumer with a stored checkpoint, and a consumer with a
+  negative-seed checkpoint (the ADR-023 §2 totality arm) — the
+  no-yield sentinel, never the stored checkpoint; the first
+  `recv`/`try_recv` observation is the first move. Pinned in the
+  streams row above and verified in
+  `receiver_offset_pre_yield_is_zero`, green on all three columns
+  (2026-10-11).
 
 ## Design Decisions