docs(tasks): decompose wave 6 — the fleet GC mechanism, the architecture's most intricate state machine under concurrency

- store-fleet-construction: the fleet: true declaration slotting into
  the fleet-capable constructors (the recorded non-event), the
  composite fleet-validity predicate enforced at the constructor
  (kv=postgres AND pg-lo-same-instance OR local-on-declared-shared-
  media OR kv-only re-routing), the TTL/owner-id fleet state, the
  same-instance probe design point
- engine-pg-lo-joint: the pg-lo joint contribution — staged-put
  mechanics (512 KiB knee, CAS, transactional LO creation) into the
  store-held PgJointTx, the wave-5 deferred API-shape design point
- store-fleet-put: the joint entry+pin tx driver (amendment A1's
  drop discipline lands here — its recorded owner), the pin guard's
  TTL/3 renewal form, the dedup upsert-renewal, pin-first/
  publish-second for large=local, the consolidation one-tx put
- store-fleet-sweep: the SQL sweep lease (ADR-013 §2 semantics),
  SQL-level delete arbitration on the direct + window-execution
  paths, the expired-pin reaping clause (the seam as the named home
  for fleet-clause growth), the fleet liveness registration verb,
  the two-domain arbitration composition
- suite-column-fleet: the fleet column — two-instance factories over
  one schema, the exact-count fleet sweep rows (the wave's gate),
  lease contention, cross-instance arbitration, TTL/renewal rows,
  the fleet-validity predicate rows
- review-wave-6: the fleet gate per the plan, plus a standing
  code-smell/hygiene block — cargo doc --no-deps asserted clean
  (the twice-bitten PGLO-1 rustdoc private-link class), the
  allow(dead_code) scope notes audited against their remainder,
  stale wave-6 forward references, and task-Summary-vs-diff
  correctness

Harness server cited in every server-touching task: dockerized
pglo-poc (postgres:16-alpine) on :15432, db blobs, postgres/poc
(verified live 2026-10-12); env-driven ALKBLOBS_PG_* settings, clean
server-less skips, acceptance requires green against the server.

Dependency graph validated: two parallel roots (construction, pg-lo
joint), put merging them, sweep parallel to put, the fleet column
merging, the review gate last; no cycles.

tasks/review-wave-6.md

@@ -0,0 +1,145 @@
+---
+id: review-wave-6
+name: Wave 6 review gate — the fleet gate
+status: pending
+depends_on: [suite-column-fleet]
+scope: narrow
+risk: low
+impact: phase
+level: review
+tags: [wave-6, review]
+---
+
+## Description
+
+The wave-6 review gate — **the fleet gate** (docs/plans/implementation.md
+§Review gates: "exact-count sweep outcomes under concurrency vs live
+postgres, the joint entry+pin tx atomicity, the sweep lease semantics
+vs ADR-013 §2, the composite fleet-validity predicate enforced at the
+constructor, kv-only put-time rejection"), before wave 7 decomposes.
+The gate reads the implementation against the pinned ADR text line by
+line (the wave-1..5 gates' method) — the documents, not memory.
+
+Gate checks:
+
+- **Exact-count fleet sweep outcomes under concurrency vs live
+  postgres**: the fleet column green against the harness server
+  (server-less runs skip cleanly — a skip never substitutes for
+  acceptance); the two-instance survival shape, the lease-contention
+  abort, the cross-instance arbitration refusal, the race across the
+  window delay, and the maintenance-step reaping all exact-count
+  asserted (INV-4's engine-gated fleet form).
+- **The joint entry+pin tx atomicity**: through the public `put` (not
+  only engine-level) — an independent connection never observes an
+  entry without its pin row or the reverse; the A1 drop discipline
+  audited as implemented (every path from `begin_joint_tx` onward
+  terminates the tx — the wave-4 gate's amendment closed, its owner
+  discharged); the pg-lo consolidation one-tx form (LO writes +
+  companion row + pin row + commit in one tx; zero residue on
+  failure); the large=local pin-first/publish-second ordering (the
+  reverse ordering nowhere coded).
+- **The sweep lease semantics vs ADR-013 §2**: one sweeper per pool
+  across instances; atomic test-and-set; holdership ends at
+  release/owner death/session loss; contention is the
+  `GcAbortCause::SweeperLock` report abort (`Ok(SweepReport)`, nothing
+  deleted — ADR-012 §1), never an error.
+- **The composite fleet-validity predicate enforced at the
+  constructor**: every fleet-valid configuration constructs; every
+  non-fleet-valid configuration is a constructor error (kv ≠
+  postgres, `mem` anywhere, `local` without the shared-media
+  declaration, pg-lo cross-instance); the declaration is explicit,
+  never inferred (ADR-012 §3); the same-instance probe's design
+  audited (a failed probe errors closed).
+- **kv-only put-time rejection** under the re-routing posture
+  (ADR-012 §6.2's machinery, fleet edition).
+- **The TTL/3 renewal on the guard**: the renewal lifecycle audited
+  (no leaked tasks; drop/conversion/batch-contribution stops
+  renewal; a failed renewal never resurrects an expired row —
+  ADR-012 §2's expiry semantics verbatim); the TTL is a fleet
+  constructor parameter (default 60 s), never API.
+- **The fleet liveness verb vs ADR-012 §6.6 / ADR-008 §2**: the named
+  table reference form; the schema-ownership rule (the store reads
+  the embedder's table, never owns it); the protect callback's
+  single-node-only posture recorded; the two-domain arbitration
+  composition (in-process + SQL) decided and recorded.
+- **The one-window-host rule under fleet**: every fleet-valid
+  configuration's window hosts on the kv engine; the pg-lo window
+  clauses dormant; the form branch keys off the engine
+  representation, never a flag.
+- **The non-fleet postures unchanged**: the in-process protocol
+  verbatim under `fleet: false` regardless of engine — the wave-2/3/4/5
+  suites green untouched.
+- **Code-smell / hygiene sweep** (the gate's standing hygiene block —
+  the twice-bitten lesson is now an explicit check, not a hope):
+  - **`cargo doc --no-deps` zero warnings** — the PGLO-1 class
+    (public-module doc links resolving to crate-internal items) has
+    bitten waves 4 and 5; the gate runs rustdoc and asserts clean,
+    and de-links rather than exports.
+  - **The `#![allow(dead_code)]` scope notes match their remaining
+    scope** — the fleet family's note in `src/gc.rs` (its consumers
+    land this wave) must shrink to its true remainder or vanish; the
+    postgres/pg-lo notes likewise audited.
+  - **Stale forward references updated** — every "wave 6" note in the
+    module docs (`store.rs`'s fleet-declaration paragraph, the
+    constructors' "slots in without reshaping" recordings,
+    `pg_lo.rs`'s scope boundary, `postgres.rs`'s scope note, the
+    batch-delete helper's consumer note) reads the landed state.
+  - **Family conventions**: no inline comments in code (doc comments
+    on public API fine), thiserror, tokio-only async, no
+    `unwrap`/`expect` outside tests, naming, one-module-per-file
+    re-export shape, no blocking I/O on the async path.
+  - **Task-description correctness**: each wave-6 task's Summary
+    matches what actually landed (the gate reads the diffs against
+    the task texts, not the Notes' claims alone).
+- **Gates green**: `cargo test` (default), `cargo test --features
+  postgres` (server-less: skipping), `cargo test --features
+  "postgres,pg-lo"`, `cargo test --all-features` (against the
+  server), the pure builds (`cargo check --no-default-features
+  --features postgres` and `--features "postgres,pg-lo"`), `cargo
+  clippy --all-targets -- -D warnings` (default + the postgres/pg-lo
+  variants + `--all-features`), `cargo fmt --check`,
+  `cargo doc --no-deps`.
+
+Findings are fixed inline where cheap, or recorded as wave-7
+amendments where they shape the next decomposition (the ops wave's
+pin-token contract rides the fleet machinery — a renewal-surface
+finding lands beside it). The gate's completion is what unblocks
+wave 7's decomposition.
+
+## Acceptance Criteria
+
+- [ ] Every gate check above read and verified against the cited ADR
+      text (not from memory of it)
+- [ ] Named design points each decided, recorded, and consistent with
+      the specs
+- [ ] Findings fixed inline or recorded as wave-7 amendments with
+      owners
+- [ ] All gates re-run green after any fixes — including
+      `cargo doc --no-deps` explicitly (the PGLO-1 class)
+- [ ] Wave 7 decomposition unblocked (recorded in this task's Summary)
+
+## References
+
+- docs/plans/implementation.md (§Wave 6, §Review gates — the fleet
+  gate)
+- docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md
+  §2/§3
+- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md §2/§4
+- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md §1–§6
+- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §2
+- docs/architecture/store-api.md (§Invariants 4 — the fleet form)
+- docs/architecture/backends-and-dispatch.md (the composite
+  fleet-validity rule)
+- tasks/review-wave-4.md, tasks/review-wave-5.md (the gate method;
+  the amendments A1/A2 this gate audits closed)
+- tasks/store-fleet-construction.md, tasks/store-fleet-put.md,
+  tasks/store-fleet-sweep.md, tasks/engine-pg-lo-joint.md,
+  tasks/suite-column-fleet.md (the wave's tasks)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion