SQLite engine integration: lint removal, contract-suite adoption, backlog column (task sqlite-engine-integration)

- Remove the wave-2 lint suppressions from substrate/mod.rs; the
  six genuinely dead surfaces the removal exposed are cut, not
  suppressed, and registered D-32..D-36 in PROVENANCE.md
  (arg_opt_i64, ops::now_unix, queue_next_claim_at,
  Writer::try_acquire, UpdateWatcher::spawn,
  SharedUpdateWatcher::new); test-observation items
  (subscriber_count, the poll-interval default re-export) are
  honestly #[cfg(test)]-gated
- Contract suite: eight new version-stamped backlog rows
  (extent-clamp + boundary totality, duration-refusal,
  encode_payload round-trip, PayloadTooLarge-never-produced SQLite
  arm, drop=rollback no-ghosts, in-tx read-your-own-writes,
  enqueue-opts resolution, receiver close/save arms)
- Fix the exemplar row's real-engine sequencing defect: the held tx
  handle across the with_tx leg deadlocked any single-writer factory
  (mock-invisible; ADR-007's parking is the pinned behavior)
- SQLite factory: SqliteFactory in the new tests/contract_suite.rs
  target; all nine rows green against it; the factory contract
  (isolation + idempotent teardown) pinned
- Engine lib docs: the single-host and writer-parking posture
  statements surfaced under # Posture
- Gates: build/test/clippy -D warnings/fmt green; coverage 93.6%
  lines, misses confined to error arms

alkstore-sqlite/src/substrate/PROVENANCE.md

@@ -85,7 +85,11 @@ lineage-less placeholder test in `ops.rs`'s pressure suite, removed).
 No unregistered divergence remains. The wave-2 review gate
 (`review-wave-2`) re-ran the full-coverage lineage diff (clean —
 everything register-addressable) and appended D-27/D-28 for its two
-fixes. Cherry-picks: empty at scaffold, append-only forever.
+fixes. D-32..D-36 are the wave-3 lint-removal pass
+(`sqlite-engine-integration`): with the engine layer wired, the
+`#![allow(dead_code)]`/`#![allow(unused_imports)]` posture lifted, and
+the genuinely unreachable ported surface cut rather than suppressed.
+Cherry-picks: empty at scaffold, append-only forever.
 
 | ID | Category | What | Where | Why | Lineage |
 |----|----------|------|-------|-----|---------|
@@ -120,6 +124,11 @@ fixes. Cherry-picks: empty at scaffold, append-only forever.
 | D-29 | port delta | `SQLITE_OPEN_URI` dropped from `open_conn`'s flags (the watcher's own opens never carried it — the inherited posture was internally inconsistent); the path argument is a plain filesystem path, `?name=value` suffixes are literal filenames, no connection-semantics mutation outside the engine constructor's opts; pinned by test (`open_conn_treats_uri_shaped_path_as_plain_filename`) | `schema.rs` (`open_conn`) | ADR-023 §3 (plain-path open — the URI parameter surface is SQLite's, not this engine's; no consumer-inventory row names URI features) | ours |
 | D-30 | port delta | `open_conn_bootstrapped` — new function stacking the engine's full per-connection open posture (pragmas, notify, `attach_alkstore_functions`, `bootstrap_schema`), and `Readers::acquire`'s open path switched from bare `open_conn` to it (fresh connections only — the pool never re-bootstraps a reused connection). The lineage's pools opened readers pragmas+notify only, the function set + schema living only on the writer; this engine's reader-slot operations (claim/ack, stream reads, lock ops, scheduler checks, leadership probes) run this substrate's SQL functions on pooled connections, so every pooled connection carries the full surface | `schema.rs` (`open_conn_bootstrapped`, `Readers::acquire` open path) | engine-sqlite.md's connection architecture ("each connection runs the substrate's bootstrap at open — the writer and each pooled reader") — engine-layer obligation of `sqlite-engine-open-opts`; landed with the engine's `open` wiring | ours |
 | D-31 | port delta | `ack_batch(ids_json)` drops the `worker_id` filter — the D-12 predicate keeps `state = 'processing' AND claim_expires_at >= unixepoch()` per id, but the batch form loses its lineage-shaped `worker_id = ?2` conjunct: the contract's `Queue::ack_batch(ids)` carries no worker identity (ADR-019 §1's surface — the batch ack is the batch form of *ack*, its outcomes are per-id independent, and a queue-scoped handle does not re-bind a claimant at call time). The single-row `ack(job_id, worker_id)` keeps its worker conjunct unchanged | `queue_ops.rs` (`ack_batch` + its substrate test's call shape) | ADR-019 §1 (the `ack_batch(ids) -> count` surface, worker-less); ADR-010 §1 (batch form of ack, per-id predicate); ADR-012 §4 (delta discipline — D-12's re-derivation adjusted) | ours |
+| D-32 | drop | `arg_opt_i64` cut (the optional-argument coercion helper) and the engine-level `now_unix` wiring that consumed it: upstream used `arg_opt_i64` at the enqueue/claim-family scalar registrations (honker_ops.rs:382–1158) whose superseded queue functions this fork did not port (D-04) and whose re-derivation (D-12) resolves opts engine-side before the call — the substrate's re-derived entry points take primitives, so no registered SQL function reads an optional i64 argument. Kept: `arg_i64` (the mandatory-arg form, still consumed by the notify/stream/lock function set). The helper's own probe test re-expresses its property through the shared `real_to_i64` coercion directly | `ops.rs` (`arg_opt_i64`; the `optional_arg_helper_keeps_null_and_converts_whole_reals` probe re-shaped) | ADR-012 §2 (the contract-blind boundary: contract semantics resolve engine-side, so the lineage's optional-arg SQL-entry-point shape has no consumer here); wave-3 lint-removal obligation (task sqlite-engine-integration) — cut, not suppressed | ours |
+| D-33 | drop | `now_unix` cut from `ops.rs` (the lineage's shared clock read): upstream's single `lib.rs`/`honker_ops.rs` scope shared one clock helper across every op region; the fold (D-17) split the substrate into modules and each region now carries its own `unixepoch()` read — `queue_ops.rs` has its own (D-12's re-derivation), `resolution.rs` owns the engine layer's single-clock read (ADR-020 §1's one-enqueue-one-clock-read, mapped into the contract taxonomy), and `ops.rs`'s lock/stream ops never read the clock outside tests. `ops.rs`'s lock-renew test now reads `unixepoch()` inline; `queue_ops.rs`'s own copy stays (its callers need the fallible-primitive form) | `ops.rs` (helper body; one test's call shape re-expressed) | ADR-012 §3/§4 (module fold made the per-region clock a D-17 fact; the engine-side read is the single clock the contract pinning names — resolution.rs, not a substrate share); wave-3 lint-removal obligation — cut, not suppressed | ours |
+| D-34 | drop | `queue_next_claim_at` cut (the queue's earliest-wake deadline query): upstream exposed it as a `honker_queue_next_claim_at` scalar registration for external poll-loop drivers and its leader loop used it to compute the sleep horizon; this fork's leader loop computes the boundary out of `scheduler_tick` + `scheduler_soonest` inside the tick transaction (the engine's scheduler.rs) and exposes no substrate-side next-wake function — the v1 scheduler surface has no consumer-inventory row for one | `queue_ops.rs` (function + its substrate test `queue_next_claim_at_reports_the_earliest_wake`) | ADR-009 (the v1 scheduler collapse: register/tick/soonest/unregister only — D-21's surface rule; no wake-time query on the v1 surface); ADR-012 §2 (the substrate exposes what the engine calls, and the engine never calls this); wave-3 lint-removal obligation — cut, not suppressed | ours |
+| D-35 | drop | `Writer::try_acquire` cut (the non-blocking writer-slot try): upstream's embedding harness used it for try-shaped entry points its surface exposed; this engine's seam always blocks (`acquire`) — the writer-slot lease is a *parks-the-writer* lease by design (ADR-007's honest model), so a try-shaped acquire would contradict the posture rather than extend it. The probe tests driving it re-express their properties through `acquire`/`release`/`close` (the engine-reachable surface); the engine-level lease tests (`tx_tests`' lease/parking suite) pin the observable posture end-to-end | `schema.rs` (`Writer::try_acquire` + the three `writer_reader_tests` call sites) | ADR-007 (the caller-held-lease seam: `begin_tx` parks a concurrent writer — no try-shaped begin exists on the contract surface); ADR-012 §2 (nothing on the engine side reaches a try-acquire); wave-3 lint-removal obligation — cut, not suppressed | ours |
+| D-36 | drop | `UpdateWatcher::spawn` and `SharedUpdateWatcher::new` cut (the default-cadence convenience constructors): upstream's embedding harnesses opened watchers without explicit config; this engine's single open path always constructs a `WatcherConfig` — from `SqliteOpts` (ADR-023 §4's `poll_interval` knob, `None` = the 1 ms default) — and passes it through `*_with_config`; a config-less twin would re-create two open postures (the mixed-flag inconsistency D-29 resolved at the URI layer). `WatcherConfig::default()` remains the default's single owner; the tests driving the cut constructors now build the config explicitly, pinning the same behavior | `watcher.rs` (both constructors + five watcher-test call sites) | ADR-023 §4 (the cadence knob rides the engine's opts — one open posture carries config); ADR-012 §2 (one construction path the engine reviews); wave-3 lint-removal obligation — cut, not suppressed | ours |
 
 ### Cherry-picks