feat(tests): the conformance suite's fleet column — the exact-count fleet sweep outcomes under concurrency, green against the harness server (wave 6)

- tests/conformance/fleet_column.rs (cfg feature = "postgres"; the
  consolidation pieces cfg the postgres+pg-lo pair): the fleet-validity
  rows, the joint entry+pin tx rows (both-or-neither over an
  independent connection; the dedup re-put's upsert-renew; the second
  instance's re-put composing a second row — protection by row; the
  pg-lo consolidation round-trip byte-exact over the shared instance),
  the TTL/renewal rows (the guard's TTL/3 cadence through the short
  test TTL; the never-resurrect semantics through the facade; the
  paused holder's expiry boundary with the delete-then-recover
  backstop), and the exact-count fleet sweep rows — the wave's gate,
  INV-4's engine-gated fleet form: the two-instance exact-count shape,
  the lease contention row (SweeperLock as report data, nothing
  deleted), the cross-instance arbitration row (GcRefuse until the
  foreign row's expiry), the race across the window delay closed by
  the row, the maintenance step's exact reap, and the fleet liveness
  verb row (the schema-ownership rule asserted; the deregistration
  correction flow); the kv-only rejection row mirrored verbatim
  against the fleet kv-only factory
- three fleet factories after the postgres column's registry pattern
  extended to the fleet shape — one minted schema, two Store
  instances over it, each its own owner id (the pin rows compose by
  owner); the dual-tier instances carry private local roots riding
  FleetSharedMedia::asserted; the consolidation factory follows the
  pg-lo column's LO-isolation corollary (a TrackedDb::new constructor
  added to pg_lo_column.rs for the private janitor field); teardown
  drops exactly the minted schemas — idempotent, owned,
  panicking-row-safe, structurally exercised
- the SKIP posture rides the postgres column's reachability probe:
  server-less runs skip cleanly, acceptance is green against pglo-poc
  (:15432) under --features postgres with the consolidation rows
  under --all-features; the test tuning is the window delay 0 and the
  short test pin TTL (the fleet constructors' parameter) — ordering
  rides the tunings or the manual-expiry instrument, no sleep-based
  race assertions
- README amended: the fleet rows table (§Columns beyond the reference
  set), §Column plan (the fleet column is the wave-6 gate's host),
  §Current state — six columns
- task suite-column-fleet completed (Notes + Summary recorded,
  including the recorded deviations: the structural predicate shapes
  reach no fleet constructor; the cross-instance mismatch leg is
  unexercisable on the one-instance harness server — the probe's
  errors-closed posture asserted instead)

Verification: cargo test (default) green; cargo test --features
postgres green server-less (skipping) and green against the harness
server; cargo test --all-features green against the server (125
conformance + 226 library tests); cargo clippy --all-targets
-- -D warnings and cargo fmt --check green on the default, postgres,
and all-features variants

tasks/suite-column-fleet.md

@@ -1,7 +1,7 @@
 ---
 id: suite-column-fleet
 name: Conformance suite — the fleet column (exact-count fleet sweep outcomes under concurrency)
-status: pending
+status: completed
 depends_on: [store-fleet-put, store-fleet-sweep]
 scope: moderate
 risk: medium
@@ -98,21 +98,21 @@ instances over one shared pool**.
 
 ## Acceptance Criteria
 
-- [ ] The fleet column green **against the harness server**
+- [x] The fleet column green **against the harness server**
       (`pglo-poc`, :15432): the fleet-validity rows, the joint-tx
       rows, the TTL/renewal rows, the exact-count fleet sweep rows
       (two-instance survival, lease contention, cross-instance
       arbitration, the race across the delay, the maintenance step,
       the fleet liveness row), and the kv-only re-routing row — every
       row ADR-stamped and traceable to the backlog
-- [ ] The fleet factory contract holds: one schema, two+ instances
+- [x] The fleet factory contract holds: one schema, two+ instances
       over it (distinct owner ids), teardown drops exactly the minted
       schemas, panicking-row-safe — structurally exercised
-- [ ] Server-less runs skip cleanly (the reachability probe; the
+- [x] Server-less runs skip cleanly (the reachability probe; the
       default-build gates stay green with the column skipped)
-- [ ] README amendments recorded (the fleet rows table; current
+- [x] README amendments recorded (the fleet rows table; current
       state)
-- [ ] `cargo test` (default) green — the column compiles out;
+- [x] `cargo test` (default) green — the column compiles out;
       `cargo test --features postgres` green server-less (skipping)
       and green against the server at acceptance;
       `cargo test --all-features` green (the consolidation factory's
@@ -143,8 +143,67 @@ instances over one shared pool**.
 
 ## Notes
 
-> To be filled by implementation agent
+Landed as `tests/conformance/fleet_column.rs` (cfg `feature =
+"postgres"`; its consolidation pieces cfg the `postgres`+`pg-lo`
+pair), wired in `tests/conformance/main.rs`, README amended (§Columns
+beyond the reference set's fleet rows table, §Column plan, §Current
+state — six columns). Three factories: `FleetDualTierFactory` (one
+minted schema, two instances over it — each its own owner id and
+private local root riding `FleetSharedMedia::asserted`),
+`FleetKvOnlyFactory` (the re-routing client shape; implements
+`StoreFactory` so the reference kv-only rejection row mirrors
+verbatim), `FleetConsolidationFactory` (a dedicated database, kv + pg-lo
+schemas, two fleet instances; the pg-lo column's LO-isolation corollary
+— LO reaping, `WITH (FORCE)` drop, drop-guard janitors; a `TrackedDb`
+constructor was added to pg_lo_column.rs since the janitor field is
+private). The oracle reuses the postgres column's skip probe
+(`harness_ready`) and observes the durable state over independent
+connections (pool/window/pin-row counts, schema/table existence, the
+embedder-table instruments, and the manual-expiry instrument for the
+abandonment shape). Column tuning: window delay `0`, TEST_TTL = 900 ms
+(TTL/3 ≈ 300 ms), waits are the expiry cadence itself or the manual
+instrument — no sleep-based race assertions.
+
+Recorded deviations from the task text, none blocking:
+
+- The composite predicate's *structural* non-fleet-valid shapes (kv ≠
+  postgres, mem anywhere, `local` undeclared) have no fleet
+  constructor to reach through (the recorded enforcement map) — the
+  column asserts the constructor-set shape in prose + the runtime
+  rejects that do exist (zero TTL, single-connection pool, the
+  same-instance probe's failure posture). A `TrackedDb::new`
+  constructor was added rather than widening the field's visibility.
+- The pg-lo **cross-instance mismatch** leg is unexercisable against
+  the one-instance harness server (the probe reads
+  `pg_control_system()` off one data directory); the row tests the
+  probe's errors-closed failure posture (an unreachable large
+  instance rejects at the constructor) and records the mismatch leg —
+  the same posture the engine suite's tests carry.
+- The renewal row's "renewed == at_drop" compare reads at_drop *after*
+  the drop and asserts `>=` — one TTL/3 tick may legitimately land
+  between the pre-drop read and the drop; the frozen-after-drop
+  assertion (EXPIRY_HORIZON, `==`) is the never-leaks proof.
 
 ## Summary
 
-> To be filled on completion
+The fleet column is green: the wave's gate rows run against the
+harness server under `--features postgres` (17 rows + 2 structural
+factory tests) and under `--all-features` (the consolidation rows
+join) — the fleet-validity rows, the joint-tx rows (both-or-neither,
+the upsert-renew, second-row composition, the byte-exact
+consolidation round-trip), the TTL/renewal rows (cadence,
+never-resurrect, paused-holder + recover), the exact-count fleet sweep
+rows (two-instance survival with exact counts, lease contention as
+report data, cross-instance arbitration until expiry, the race closed
+by the row, the maintenance step's exact reap, the fleet liveness verb
+with the schema-ownership rule), and the kv-only re-routing row —
+every row ADR-stamped and traced. The fleet factory contract holds
+structurally (one schema, two instances, distinct owner ids, owned
+idempotent teardown, panicking-row-safe); server-less runs skip
+cleanly; the default build compiles the column out. Verification:
+`cargo test` (default) green; `cargo test --features postgres` green
+server-less (skipping) and green against `pglo-poc` (:15432);
+`cargo test --all-features` green against the server (125 conformance
+tests + the full library suite, 226 tests); `cargo clippy --all-targets
+-- -D warnings` and `cargo fmt --check` green on the default, postgres,
+and all-features variants.