decompose the pg scheduler-classification twin (review 004 item 9 — recorded at the sqlite task's implementation: scheduler.rs:682 carries the identical renew flattening; the ADR-009 §1 arm set is already landed engine-neutral, pg implements to match) + gate wiring; taskgraph validate green (96)

tasks/pg-fix-scheduler-error-classification.md

@@ -0,0 +1,84 @@
+---
+id: pg-fix-scheduler-error-classification
+name: Classify run_schedules' renew-failure arms on pg (the sqlite twin, review 004 item 9)
+status: pending
+depends_on: []
+scope: narrow
+risk: low
+impact: component
+level: implementation
+tags: [review-004-fixes, postgres-engine, scheduler]
+---
+
+## Description
+
+The pg twin of `sqlite-fix-scheduler-error-classification` (completed),
+recorded in that task's Notes as an unresolved follow-up:
+`alkstore-postgres/src/scheduler.rs:682` carries the identical
+`.unwrap_or(false)` flattening the sqlite task fixed — a mid-run
+`lease.renew(LEADER_TTL_S)` failure (including the closed-store
+`Database` error) is mapped to `false` and misreported as
+`Error::LeadershipLost`, misdirecting the documented respawn recipe at
+a dead store.
+
+The classification decision of record is already landed and
+engine-neutral — the sqlite task's dated (2026-10-11) ADR-009 §1 /
+core-contract.md §Errors annotation pins the arm set for the family —
+so this task implements pg to match it, not re-decides:
+
+- `renew` → `Ok(false)` — the genuine loss arm (expired and
+  re-acquired elsewhere; exclusion lapses silently at TTL expiry,
+  ADR-008 §7) — returns `Err(LeadershipLost)`, unchanged,
+  return-before-tick. The respawn recipe matches on this arm only.
+- `renew` → `Err(e)` — the machinery never reached the lock
+  semantics; not a loss, never `LeadershipLost`. The `Err` propagates
+  unchanged: the closed-store arm arrives pre-classified (pg's
+  post-close `renew` fails closed with `Database`, pinned by pg
+  lock_tests), and any other storage failure carries the driver's
+  source chain.
+
+No new variant minted — ADR-008 §5's act-differently rule holds
+(`Closed` stays the wake-receiver variant; closed store is `Database`
+engine-wide, the pg posture already).
+
+**Tests need the harness server** (the reason the sqlite task recorded
+rather than landed this): model the two pins on the sqlite task's —
+a mid-run close exits with the closed `Database` classification, never
+`LeadershipLost`; a mid-run lease loss still returns `LeadershipLost`
+(the respawn arm unchanged).
+
+## Acceptance Criteria
+
+- [ ] The pg renew arm implements the landed arm set: `Ok(false)` →
+      `LeadershipLost` unchanged; `Err(e)` propagates unchanged (no
+      flattening) — no re-deciding; any discrepancy with the sqlite
+      task's decisions of record recorded, not deviated around
+- [ ] Both arms pinned by tests against the harness server (the
+      closed-store arm and the genuine-loss arm, modeled on the
+      sqlite task's two pins)
+- [ ] The ADR-009 §1 / core-contract annotations verified to read
+      engine-neutral (they were landed as family-wide; cite them —
+      only pg-specific doc text needs touching, e.g.
+      engine-postgres.md's scheduler row if it describes the arm)
+- [ ] `cargo test -p alkstore-postgres` (harness server), clippy
+      `-D warnings`, fmt clean; workspace gates green server-less
+
+## References
+
+- tasks/sqlite-fix-scheduler-error-classification.md (the twin — the
+  arm set's decisions of record, the two pin shapes, the recorded
+  follow-up this task discharges)
+- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
+  not fixed" item 9 (the original finding — recorded the sqlite site
+  only; the pg twin surfaced at implementation)
+- docs/architecture/decisions/009-*.md §1 (the dated classification
+  annotation of record), core-contract.md §Errors
+- alkstore-postgres/src/scheduler.rs:675-690 (the flattening site)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion

tasks/review-004-fixes.md

@@ -2,7 +2,7 @@
 id: review-004-fixes
 name: Review gate — review-004 fix batch (recorded-findings dispositions)
 status: pending
-depends_on: [sqlite-fix-seam-panic-safety, sqlite-fix-watcher-death-subscribe, sqlite-fix-listener-bridge-alignment, sqlite-fix-scheduler-error-classification, sqlite-substrate-safety-comments, pg-fix-forwarder-hardening, pg-fix-forwarder-diagnosability, decide-log-facade-adoption, pg-decide-stamp-arithmetic-side, pg-fix-bigint-stamp-overflow, mem-doc-growth-outbox-notes, core-pin-offset-initial-value, core-fix-display-log-forging, docs-pg-identifier-truncation-note, normalize-tokio-dev-deps]
+depends_on: [sqlite-fix-seam-panic-safety, sqlite-fix-watcher-death-subscribe, sqlite-fix-listener-bridge-alignment, sqlite-fix-scheduler-error-classification, sqlite-substrate-safety-comments, pg-fix-forwarder-hardening, pg-fix-forwarder-diagnosability, decide-log-facade-adoption, pg-decide-stamp-arithmetic-side, pg-fix-bigint-stamp-overflow, pg-fix-scheduler-error-classification, mem-doc-growth-outbox-notes, core-pin-offset-initial-value, core-fix-display-log-forging, docs-pg-identifier-truncation-note, normalize-tokio-dev-deps]
 scope: broad
 risk: low
 impact: phase
@@ -31,7 +31,10 @@ numbering):
 3. **Bridge alignment**: the listen bridge is std-thread shaped; the
    two bridges' residual difference (if any) named and justified.
 4. **Scheduler classification**: the closed-store arm no longer
-   reports `LeadershipLost`; the window-state/annotation record is
+   reports `LeadershipLost` on *either* engine — the sqlite fix and
+   the pg twin (`pg-fix-scheduler-error-classification`, surfaced at
+   the sqlite task's implementation) both verified against the landed
+   ADR-009 §1 arm set; the window-state/annotation record is
    present.
 5. **Substrate SAFETY comments**: every flagged block carries a
    concrete invariant; the PROVENANCE delta entry registered (the