docs(tasks): decompose wave 5 — the pg-lo large engine, the window host's large-tier arm, the LO-medium SKIP-posture column

- engine-pg-lo: the Backend impl behind feature pg-lo (default-off) —
  companion-table authority, one-tx staged put at the 512 KiB knee,
  descriptorless lo_get windows, the orphan-recovery sweep, the
  posture deltas recorded; the shared-helper/PgOpts/LO-isolation
  design points named (LOs are database-level — the C7 lesson cited
  so it is not rediscovered)
- engine-pg-lo-window: the EngineWindowState impl per ADR-012 §5's
  pg-lo row — gc_window only, no fleet family anywhere
- store-pg-lo-construction: LargeEngine::PgLo slotting (the large
  sub-enum design point), the consolidation + mem-pglo constructors
  (the fleet-valid set completed, implicitly non-fleet), and the
  one-window-host rule's store-core completion (dormancy + the
  large-host sweep arm)
- suite-column-pg-lo: the second SKIP-posture column, two factories
  spanning feature pairs, the dormancy row, zero LO residue in
  teardown
- review-wave-5: the engine-wave gate; amendment A2 (janitor
  adoption) verified here

Harness server cited in every server-touching task: dockerized
pglo-poc (postgres:16-alpine) on :15432, db blobs, postgres/poc
(verified live 2026-10-12); env-driven ALKBLOBS_PG_* settings, clean
server-less skips, acceptance requires green against the server.

Verification: cargo test 69/19/3 ok, clippy --all-targets -D warnings
green, fmt --check green (docs-only change).

tasks/review-wave-5.md

@@ -0,0 +1,120 @@
+---
+id: review-wave-5
+name: Wave 5 review gate — the pg-lo engine vs the contract
+status: pending
+depends_on: [suite-column-pg-lo]
+scope: narrow
+risk: low
+impact: phase
+level: review
+tags: [wave-5, review]
+---
+
+## Description
+
+The wave-5 review gate — the engine-wave review shape
+(docs/plans/implementation.md §Review gates: "engine-vs-contract
+conformance"), before wave 6 decomposes. The gate reads the
+implementation against the pinned ADR text line by line (the
+wave-1/2/3/4 gates' method).
+
+Gate checks:
+
+- **Engine-vs-contract conformance**: the suite column green against
+  dockerized postgres (server-less runs skip cleanly — a skip never
+  substitutes for acceptance); the engine-state clause families
+  contract-tested per the applicability row (ADR-012 §5's pg-lo row —
+  the window family only, conditional per the one-window-host rule);
+  virgin-store semantics; the `size` metadata-only discipline (the
+  companion-row probe never loads LO content).
+- **The engine shape vs ADR-009 §1–§4**: the companion table is the
+  contract authority (list/size/has/CAS all table-level);
+  `pg_largeobject` never read for addressing; put = one tx with the
+  512 KiB knee as a named constant (the C2 citation); the staged put's
+  held-tx body with both hygiene forms exact-count tested; gets ride
+  descriptorless `lo_get(oid, off, len)` windows (the C4 posture — the
+  held-descriptor fallback named as not-shipped, never coded); the
+  64-bit-variants discipline (the C7 int4 trap not inherited); delete
+  = one tx under table-level arbitration; transactional LO creation
+  (zero crash orphans structurally — the C6 reading).
+- **The posture deltas vs ADR-009 §5/§6**: carried as requirements,
+  not hedges — catalog space never returned (the `VACUUM FULL`
+  operator line + rel-size monitoring named in the module doc);
+  autovacuum inherited, keep it on; the orphan-recovery sweep present
+  for the legacy/bypass class (scope-noted, contract-tested with a
+  planted orphan); the cached-get capacity facts named honestly.
+- **The one-window-host rule vs ADR-012 §5**: the store-core
+  completion — `ensure_gc_schema` follows the host rule at
+  construction (dormancy on dual-SQL: the consolidation shape's pg-lo
+  schema carries no `gc_window`; the pg-lo host on kv=mem); the sweep
+  form branch runs the durable form on the pg-lo host for kv=mem +
+  large=pg-lo and keys off the engine representation, never a flag;
+  **no fleet state anywhere in pg-lo** (nothing of
+  `EngineFleetState`); the fleet joint-put contribution's API shape
+  explicitly deferred to wave 6 (recorded, not silently absent).
+- **The consolidation constructor vs ADR-009/011/012**: the
+  fleet-valid engine set completed; the implicitly-`fleet: false`
+  posture recorded verbatim (wave 6's declaration slots in without
+  reshaping); the connection-settings design point (two DSN+opts
+  pairs; cross-instance valid non-fleet) recorded.
+- **Async/blocking discipline**: tokio-postgres natively async — no
+  `spawn_blocking` seam; no blocking I/O on the async path; the pool
+  is the concurrency posture; no `unwrap`/`expect` outside tests.
+- **Named design points audited as resolved** (each recorded in its
+  task's Notes): the schema name + the consolidation shape's schema
+  sharing; the shared-helper home (quote_identifier, 42P01
+  discriminant, pg_err, timestamp helpers) + the `PgOpts` gate
+  question; the 512 KiB aggregation shape; the LO isolation +
+  janitor shape (amendment A2 verified — zero schema AND zero
+  `pg_largeobject` residue on the shared db); the sub-enum slotting
+  for the large cursor/staging bodies; the connection-settings shape;
+  the dormancy wiring; the orphan sweep's scope note.
+- **Family conventions**: no comments in code (doc comments on public
+  API fine), thiserror, tokio-only async, no unwrap/expect outside
+  tests, naming, one-module-per-file re-export shape, the
+  `#![allow(dead_code)]` scope notes matching their remaining scope.
+- **Gates green**: `cargo test` (default), `cargo test --features
+  pg-lo` (server-less: skipping), `cargo test --features "pg-lo,mem"`,
+  `cargo test --all-features` (against the server), the pg-lo-pure
+  checks (`cargo check --no-default-features --features pg-lo` and
+  `--features "pg-lo,mem"`), `cargo clippy --all-targets -- -D
+  warnings` (default + the pg-lo variants + `--all-features`),
+  `cargo fmt --check`, `cargo doc --no-deps`.
+
+Findings are fixed inline where cheap, or recorded as wave-6
+amendments where they shape the next decomposition (the fleet
+mechanism's joint-tx driver already carries amendment A1; any pg-lo
+contribution-shape finding lands beside it). The gate's completion is
+what unblocks wave 6's decomposition.
+
+## Acceptance Criteria
+
+- [ ] Every gate check above read and verified against the cited ADR
+      text (not from memory of it)
+- [ ] Named design points each decided, recorded, and consistent with
+      the specs
+- [ ] Findings fixed inline or recorded as wave-6 amendments with
+      owners
+- [ ] All gates re-run green after any fixes
+- [ ] Wave 6 decomposition unblocked (recorded in this task's Summary)
+
+## References
+
+- docs/plans/implementation.md (§Wave 5, §Review gates — engine wave
+  reviews)
+- docs/architecture/decisions/009-pg-lo-large-tier-engine.md
+- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md §1/§2
+- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md §3/§4/§5/§6.7
+- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §4
+- docs/architecture/store-api.md
+- docs/research/poc-pglo-findings.md (the evidence base the engine
+  claims)
+- tasks/review-wave-4.md (the gate method; the structural twin's gate)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion