Dispose the wave-6 class-1-window observations (release-contract-window-close)

The pre-release pass's last contract-text dispositions, each dated
in-place citing the 2026-10-11 close-out pass (ADR-017 §2's terminal
window):

- Publish→wake ordering tolerance: documented tolerance (decided with
  the user) — core-contract.md streams paragraph + delivery-obligations
  bullet, ADR-015 §4 companion annotation; the wake = offset-order
  ADR amendment declined (commit-ordered pg visibility; hint-shaped
  wake posture).
- ADR-023 §2: heartbeat(extend) and save_offset(offset) join the
  boundary/offset row (total — negatives well-defined), with the
  home rationale annotated; core-contract's domain paragraph
  mirrors; the backlog numeric-domain row registers the suite-duty
  follow-up.
- ADR-021 §5: EventReceiver::try_recv's closed shape pinned
  (Err(Closed), mirroring ADR-008 §3); core-contract subscribe arms
  sentence extended.
- get_job prose: core-contract queues section + queues.md's reads
  sentence now say the uniform id-global / get_job_tx-filtered split.
- Mem-arithmetic observation: no-action disposition recorded in the
  task Notes (byte-level transplants; equivalence suite-pinned
  three-way).

Suite stamps checked — no accumulation required (no cited § text
changed meaning). Docs-only; gates green: build, workspace tests,
clippy -D warnings, fmt, fuzz replay, rustdoc -D warnings,
taskgraph validate (79 tasks).

docs/architecture/decisions/023-fourth-review-round.md

@@ -117,7 +117,7 @@ classified by argument **kind**, not call site:
 |---|---|---|
 | **Extent** ("at most this many") | `claim_batch(n)`, `read_since(limit)`, `read_from_consumer(limit)` | `n <= 0` → **empty value result** (claims nothing / reads nothing), not an error |
 | **Duration** (seconds of lease/TTL semantics) | `try_lock(ttl)`, `renew(ttl)` | `ttl <= 0` → **`Err`, opaque** (engine detail in the source chain, `Database`) — the substrate's existing guard (`ttl_s <= 0`), now pinned contract-side |
-| **Boundary / offset** (`<=` predicates, absolute or relative instants) | `trim_to(horizon)`, enqueue `delay`/`run_at`/`expires` | total — any `i64` is well-defined (negative horizon deletes nothing; negative delay → ready in the past → ready now); no clamping, no rejection |
+| **Boundary / offset** (`<=` predicates, absolute or relative instants) | `trim_to(horizon)`, enqueue `delay`/`run_at`/`expires`; `heartbeat(extend)`, `save_offset(offset)` *(annotated 2026-10-11)* | total — any `i64` is well-defined (negative horizon deletes nothing; negative delay → ready in the past → ready now; negative extension → the renewed deadline `now + extend` is in the past, voiding the claim through the validity predicate, never an error; negative offset → stored, reads resume forward); no clamping, no rejection |
 
 The rule the table pins: **extents clamp to empty (no-work is a
 value, the pinned claims vocabulary), durations error, boundaries and
@@ -149,6 +149,28 @@ offsets are total.** Each disposition answers to a decided principle:
 - **Boundaries/offsets.** The remaining numerics are total by
   accident of their SQL today; the table makes it rule, not accident
   — an implementer reading the table has nothing to improvise.
+  *(Annotation, 2026-10-11 — the pre-release class-1 close-out pass
+  ([ADR-017](017-contract-versioning.md) §2), disposing the wave-6
+  review gate's recorded under-classifications. Two arguments join
+  the boundary/offset row, and deliberately not the duration row:
+  `heartbeat(extend)`'s seconds-shaped argument is not lease/TTL —
+  `extend` is the new full deadline in seconds from now, so a
+  non-positive value is not a handed-back lease the caller believes
+  it holds (the duration rule's rejection rationale never applies);
+  it is a relative instant like `delay`, and the three engines'
+  uniform arithmetic (`saturating_add` / plain SQL integer add —
+  code of record, mem `queue.rs`, substrate `queue_ops.rs`, pg
+  `queue.rs`) is total over non-positive values: a negative extension
+  shortens the deadline, a past one is voided by the uniform
+  validity predicate on the *next* op, and the heartbeat itself
+  reports the successful renewal (`true`) exactly when the row was
+  processing and unexpired at call time. And `save_offset`'s offset
+  is literally an offset: a negative is stored as the checkpoint,
+  reads resume forward past it, and saves at-or-below the stored
+  checkpoint are the [ADR-019](019-mechanism-handle-surfaces.md) §6
+  monotone no-ops — rejections were never the behavior, so pinning
+  the duration row's shape here would have contradicted all three
+  engines.)*
 
 This is a **core-contract amendment** (doc text on `claim_batch`,
 both `read` forms, `try_lock`/`renew`, and a shared domain-rule