feat(tests): the conformance suite's pg-lo column — the LO-medium SKIP-posture column green (wave 5)

- tests/conformance/pg_lo_column.rs (new): the two pair-gated factories
  (DualTierMemPgLoFactory on all(mem, pg-lo) — the one-window-host rule's
  named test topology; DualTierPostgresPgLoFactory on
  all(postgres, pg-lo) — the consolidation posture, two schemas per open,
  carrying the dormancy row), a fresh dedicated database per open with
  the engine-owned schemas minted inside, teardown reaping tracked LOIDs
  (lo_unlink) then dropping the minted schemas then the database
  (WITH (FORCE)) with per-open drop-guard janitors for the abandoned
  paths, and the rows: the verbatim form-independent mirror (INV-1, INV-6,
  the two no-op abort shapes), the schedule-relative INV-2/3, the
  two-sweep exact counts over the full protection set across each
  factory's observed window host, the window-delay race, the
  holder-stages-only lease, INV-5's durable row, the three dispatch rows
  over the LO-medium placement oracle, the INV-1 extension (window-edge
  ranged reads + the planted-overclaim beyond-length clean failure), the
  virgin-store rows, and the dormancy row; structural isolation +
  panicking-row tests probing zero orphan residue (no kv-only rejection
  row — recorded; pg-lo is a large engine)
- the LO-isolation corollary carried in the engine task's recorded
  per-test-database shape (the C7 lesson): zero LO residue on the shared
  harness database is structural, so the engine suite's
  shared_harness_db_holds_zero_lo_residue gate stays green alongside the
  column under --all-features
- main.rs: the pg_lo_column gate (feature pg-lo, default-off) + the
  columns' doc paragraph
- README: the pg-lo rows table in §Columns beyond the reference set, the
  SKIP-posture note naming the second landed column and the per-factory
  feature-pair gating, current state = five columns
- store.rs: one mechanical gate fix — the PgOpts import was unused in the
  sqlite+pg-lo config (tripping clippy --features pg-lo -D warnings);
  the gate now names the configs that consume it

Verification (harness server live 2026-10-12): --all-features against the
server fully green (188 lib + 106 conformance + 4 git-interop; zero
LO/schema/database residue after the run); default test green (69/19/3);
--features "pg-lo,mem" and "postgres,pg-lo" green server-less
(skipping cleanly) and --features pg-lo alone; clippy -D warnings green
on default, pg-lo, pg-lo+mem, postgres+pg-lo, all-features; fmt --check
green; cargo doc --no-deps clean.

tests/conformance/README.md

@@ -336,6 +336,72 @@ connections fail closed on next use).
 | `kv_tier_misses_fall_through_to_the_large_tier_per_op` | ADR-012 §6.1 (fall-through per op); ADR-012 §6.5 ruling 5 (miss shapes); ADR-006; ADR-012 §6.3; ADR-007 §5 |
 | `virgin_store_reads_are_no_ops_on_a_fresh_schema` | store-api.md §Error model (virgin-store semantics); ADR-012 §6.5; ADR-007 §5 (the constructor always ensures the schema — the facade's fresh-schema form of the tolerance) |
 
+**The pg-lo column's own rows**
+(tests/conformance/pg_lo_column.rs, the second SKIP-posture column —
+the **LO-medium column**, ADR-009, landed wave 5): the reference
+inventory's form-independent rows mirror verbatim against a
+dual-tier factory (INV-1's round-trip family over the content
+matrix, INV-6's stat-discipline row — whose non-fetching discipline
+rides ADR-009's companion-row probe on this medium — and the
+`NoLivenessSources`/`ProtectFailed` abort shapes), and the column
+grows the durable-schedule sweep family (§The schedule-relative
+reading for SQL-backed columns; ADR-012 §6.7 — the same window delay
+tuning, `0` — execute-on-next-sweep), the dispatch rows with the
+placement oracle adapted to the LO medium (large entries are
+companion rows + LOs — an independent connection counting
+`lo_entries` and probing `pg_largeobject`; kv entries per the
+factory's kv engine: the mem-pglo factory's kv half is in-process,
+the mem introspection shape, the postgres-pglo factory's kv half
+counts the kv schema's `blobs` rows), the INV-1 extension row (the
+LO medium's ranged reads across the shipped window edge, EOF
+clamping, and the beyond-length clean failure against a planted
+overclaiming companion row), and the virgin-store row. **No
+kv-only rejection row** — no kv-only pg-lo constructor exists (pg-lo
+is a large engine; the postgres column hosts that row for the SQL
+kv engines).
+
+The **two factories span feature pairs — the first column whose
+factories need different feature sets** (a recorded design point):
+`DualTierMemPgLoFactory` (*kv = mem* + *large = pg-lo*, the
+one-window-host rule's named test topology — the durable-schedule
+rows run with the window hosted on the **large engine**,
+`gc_window` in the pg-lo schema) gates on
+`all(feature = "mem", feature = "pg-lo")`;
+`DualTierPostgresPgLoFactory` (*kv = postgres* + *large = pg-lo* on
+one pg instance — the consolidation posture) gates on
+`all(feature = "postgres", feature = "pg-lo")` and carries the
+**dormancy row** (the pg-lo schema carries no `gc_window`; the
+window lives on the kv schema — ADR-012 §5); the column's full run
+(acceptance) is `--all-features` against the server. The factories
+follow the alkstore pg-factory pattern with the **LO-isolation
+corollary carried in the engine task's recorded shape** (the C7
+lesson): a fresh dedicated database per `open()` (unique per call,
+tracked per-instance; engine schemas minted inside it), teardown
+reaping the instance's LOs (`SELECT loid FROM lo_entries` →
+`lo_unlink`), dropping exactly the minted schemas
+(`DROP SCHEMA IF EXISTS … CASCADE`), and dropping the database
+(`WITH (FORCE)`) — idempotent, panicking-row-safe, with a
+drop-guard janitor per open backing the abandoned paths — so zero
+LO residue on the shared harness database is structural (the engine
+suite's `shared_harness_db_holds_zero_lo_residue` gate measures it),
+and the structural teardown assertions probe zero orphan residue
+inside the dedicated database before it goes.
+
+| Row (`pg_lo_column.rs`) | Traces to |
+|---|---|
+| `dedup_identical_content_is_one_pool_entry` | INV-2 (kv and large legs; counts read against the durable schedule; ADR-009 §2/§4 — the companion table, delete = lo_unlink + row delete) |
+| `stage_hygiene_zero_residue_on_failure_exactly_one_entry_on_success` | INV-3 (the LO tier's real staged form — the held tx's failure paths roll back to no row, no LO pages; schedule-relative counts; ADR-009 §2) |
+| `two_sweep_exact_counts_over_the_full_protection_set` | INV-4/INV-5 (the full protection set across two sweeps, both tiers; the window observed on its host — the pg-lo schema for mem-pglo, the kv schema for postgres-pglo; ADR-012 §5) |
+| `a_put_landing_during_the_window_survives_the_executing_sweep` | INV-4 (the sweep-vs-put race across the window delay; execution-time re-arbitration; ADR-012 §5 — the host rule's shapes) |
+| `the_contended_second_sweeper_aborts_as_data_and_the_holder_stages_only` | INV-4 (the `SweeperLock` abort shape — abort before staging; the holder's durable-form completion: stages only) |
+| `list_correctness_is_observable_through_durable_schedule_outcomes` | INV-5 (exact counts, never list comparison) |
+| `lo_windows_read_across_window_boundaries_and_a_short_body_fails_cleanly` | INV-1's LO-medium extension (ranged reads across the shipped window edge; EOF clamping incl. the `u64::MAX` clamp — the C7 trap not inherited; the beyond-length clean failure); store-api.md §Read path; ADR-009 §2/§3 (the companion table as authority; the `lo_get` windows); ADR-006; ADR-010 §1 |
+| `routing_is_a_pure_function_of_length_across_put_paths_and_re_puts` | ADR-003 §Dispatch policy (purity/no-migration); ADR-009 §2 (the companion table); ADR-012 §5 (the topology); ADR-012 §6.3; ADR-012 §6.7; INV-7 facade-contract row |
+| `threshold_boundary_lengths_route_deterministically` | ADR-003 §Dispatch policy (at/below/above, tuned + shipped-default thresholds); ADR-009 §2; ADR-012 §6.3 |
+| `kv_tier_misses_fall_through_to_the_large_tier_per_op` | ADR-012 §6.1 (fall-through per op); ADR-012 §6.5 ruling 5 (miss shapes); ADR-006; ADR-009 §2/§3 (the `lo_get` windows serve the fall-through); ADR-012 §6.3 |
+| `virgin_store_reads_are_no_ops_on_a_fresh_schema` | store-api.md §Error model (virgin-store semantics); ADR-012 §6.5; ADR-009 §2 (the companion-table bootstrap); ADR-012 §5 (the mem-pglo row asserts the window on the pg-lo host — `gc_window` present-and-empty, `gc_pins` never) |
+| `the_window_lives_on_the_kv_schema_and_the_pg_lo_schema_stays_dormant` (postgres-pglo only) | the dormancy row: ADR-012 §5 (the one-window-host rule's kv-host arm — the pg-lo window clauses dormant, no `gc_window` in the pg-lo schema; the schedule observed on the kv host); ADR-008 §2; ADR-012 §6.7 |
+
 ## Column plan
 
 **mem is the contract-reference engine** (ADR-011 §2): wave 2 lands
@@ -345,12 +411,16 @@ column propagates as a requirement to all other columns (INV-7). The
 pg columns (postgres, pg-lo) additionally run the SKIP posture above —
 the **postgres column is the posture's first landed host** (server-less
 runs skip cleanly; its wave-4 acceptance is the green run against the
-harness server); the fleet-form rows of INV-4 are engine-gated to the
-postgres column and first run in wave 6.
+harness server) and the **pg-lo column is the second** (landed wave 5;
+its two factories gate on the `mem`+`pg-lo` and `postgres`+`pg-lo`
+feature pairs respectively — the first column whose factories need
+different feature sets — with the column's full run `--all-features`
+against the harness server; the fleet-form rows of INV-4 are
+engine-gated to the postgres column and first run in wave 6).
 
 ## Current state
 
-The harness is green on **four columns** (waves 2–4). The **mem
+The harness is green on **five columns** (waves 2–5). The **mem
 column** is the contract-reference column: the factory binding is the
 concrete `alkblobs::Store` facade (see §The factory contract — the
 binding demonstrator remains in `binding.rs`), the reference row set
@@ -431,3 +501,44 @@ failure — and its acceptance is the green run **against the harness
 server** (dockerized `pglo-poc`, `postgres:16-alpine`, :15432, db
 `blobs`, verified live 2026-10-12; the alkstore harness's same
 server).
+
+The **pg-lo column** (the suite's **second SKIP-posture column** —
+the LO-medium column, feature `pg-lo` **default-off**, ADR-009, its
+two factories gating on the `mem`+`pg-lo` and `postgres`+`pg-lo`
+feature pairs — the first column whose factories need different
+feature sets, landed wave 5) mirrors the form-independent reference
+rows (INV-1's round-trip family, INV-6's stat-discipline row riding
+ADR-009's companion-row probe, and the `NoLivenessSources`/
+`ProtectFailed` abort shapes) and grows the durable-schedule sweep
+rows (run on **both factories** — the window observed on its host:
+the pg-lo schema for the mem-pglo factory per the one-window-host
+rule's named test topology, the kv schema for the postgres-pglo
+consolidation shape, which carries the **dormancy row**), the
+dispatch rows with the placement oracle adapted to the LO medium
+(companion rows + `pg_largeobject` probing for the large tier; the
+mem kv half in-process, the postgres kv half's `blobs` rows), the
+INV-1 extension row (the LO medium's ranged reads across the
+shipped window edge and the beyond-length clean failure), and the
+virgin-store rows — the recorded inventory is in §Columns beyond
+the reference set. **No kv-only rejection row mirrors here** (no
+kv-only pg-lo constructor exists; recorded). Connection settings
+ride the environment (`ALKBLOBS_PG_HOST/PORT/USER/PASSWORD/DB` —
+`ALKBLOBS_PG_HOST` gates; the rest default to the harness server's
+values) and the runners gate behind the reachability probe — a skip
+is never a failure — and its acceptance is the green run
+**against the harness server under `--all-features`** (dockerized
+`pglo-poc`, verified live 2026-10-12). Its factories declare the
+column-tuned threshold and the test tuning of the window delay
+(`0` — execute-on-next-sweep) and follow the alkstore pg-factory
+pattern with the **LO-isolation corollary carried in the engine
+task's recorded shape** (the C7 lesson): a fresh dedicated database
+per `open()` (unique per call, engine schemas minted inside it,
+tracked per-instance; drop-guard janitors backing the abandoned
+paths), teardown reaping the instance's LOs (`SELECT loid FROM
+lo_entries` → `lo_unlink`), dropping exactly the minted schemas,
+and dropping the database (`WITH (FORCE)`) — idempotent,
+panicking-row-safe — so zero LO residue on the shared database is
+structural (the engine suite's
+`shared_harness_db_holds_zero_lo_residue` gate measures it) and the
+structural teardown assertions probe zero orphan residue inside the
+dedicated database before it goes.

tests/conformance/main.rs

@@ -33,7 +33,12 @@
 //! columns); [`postgres_column`] — the suite's first SKIP-posture
 //! column (the fleet-capable-kv shape, `kv = postgres` + `large =
 //! `local`, feature `postgres` default-off), which mirrors the same
-//! sets against the harness server and skips cleanly server-less.
+//! sets against the harness server and skips cleanly server-less;
+//! [`pg_lo_column`] — the suite's second SKIP-posture column (the
+//! LO-medium column, feature `pg-lo` default-off, its two factories
+//! spanning feature pairs `mem`+`pg-lo` and `postgres`+`pg-lo`), which
+//! runs the same sets against the LO medium and skips cleanly
+//! server-less.
 //!
 //! Items beyond the tests below are the later columns' surface, hence
 //! the scoped `#![allow(dead_code)]` — it shrinks as columns land.
@@ -48,6 +53,8 @@ mod factory;
 mod local_column;
 #[cfg(feature = "mem")]
 mod mem_column;
+#[cfg(feature = "pg-lo")]
+mod pg_lo_column;
 #[cfg(feature = "postgres")]
 mod postgres_column;
 mod rows;