feat(store): the fleet declaration — the composite fleet-validity predicate at the constructor (wave 6)

- Three `_fleet` twin constructors slot the explicit `fleet: true`
  declaration in without reshaping the fleet-capable constructors;
  every pre-existing constructor stays implicitly `fleet: false` with
  byte-unchanged behavior (the recorded non-event landed as recorded):
  `kv_only_postgres_fleet` (the re-routing client posture, large =
  none), `dual_tier_postgres_local_fleet` (the shared-media posture),
  `dual_tier_postgres_pglo_fleet` (the consolidation posture).
- The composite fleet-validity predicate (`fleet_validity_error`) is
  one function, one sentence, both tiers, run at the constructor keyed
  off the engine representation: kv = postgres AND (pg-lo on the same
  pg instance OR local on declared shared media OR none). The
  structural clauses (mem never, sqlite never, local needs the
  declaration) are enforced by the constructor set's shape and tested
  per clause at the predicate level; the pg-lo same-instance clause is
  the runtime arm: `pg_control_system().system_identifier` compared
  across one pooled connection per engine — mismatch or failed probe
  is a constructor error, never a silent pass.
- The named design points decided and recorded: the shared-media
  assertion is a sealed dedicated type (`FleetSharedMedia::asserted()`,
  never a bare flag); the pin TTL is a fleet constructor parameter
  (default `DEFAULT_PIN_TTL` 60 s, `Duration::ZERO` rejected at entry)
  wired through `PostgresBackend::new_with_pin_ttl` to the renewal
  body (proven against the live server); the owner id mints 32 raw
  bytes at construction (SHA-256 fold over pid/nanos/instance
  counter/ASLR anchor), stable per instance, crate-internal.
- The store carries its fleet state (`FleetState`: the declaration
  flag, the TTL, the owner id) — crate-internal (fleet parameters,
  not API); the one-window-host posture verified intact under fleet
  (kv host's both-tables GC schema, pg-lo window clauses dormant, the
  form branch keyed off the engine representation), and the
  declaration turns nothing else on yet (put/sweep run the non-fleet
  machinery until the driver tasks).
- Constructor docs updated to the landed state (module doc's
  fleet-declaration paragraph, the three non-fleet recordings, the
  scope notes, gc.rs/postgres.rs/pg_lo.rs wave-6 notes); `cargo doc
  --no-deps` clean in the default build.

Verification: cargo test (default) green; --features postgres and
--features "postgres,pg-lo" green server-less (skipping cleanly) and
against the harness server (pglo-poc, :15432 — verified live 2026-
10-12); --all-features green; clippy -D warnings green (default +
postgres + postgres,pg-lo + all-features); cargo fmt --check green;
cargo doc --no-deps clean.

src/gc.rs

@@ -70,9 +70,11 @@
 //! SQL-backed, pg-lo when the kv engine is not (the one-window-host
 //! rule, ADR-012 §5); the sweep's durable form drives
 //! `window_stage`/`window_take` on that same host), while the fleet
-//! family waits for wave 6 — its postgres clause bodies landed with
-//! wave 4, but the store core consumes the family only under the
-//! `fleet: true` declaration. It shrinks as that lands.
+//! family waits for its store-core consumers — its postgres clause
+//! bodies landed with wave 4, and the store core consumes the family
+//! only under the `fleet: true` declaration (the declaration's fleet
+//! constructors landed; the put/sweep drivers are the remaining
+//! tasks). The note shrinks as those land.
 
 #![allow(dead_code)]
 

src/lib.rs

@@ -18,6 +18,9 @@ pub use hashing::{Algorithm, Digest};
 pub use keys::Key;
 pub use store::{Store, StoreMode, DEFAULT_DELETE_WINDOW_DELAY};
 
+#[cfg(feature = "postgres")]
+pub use store::{FleetSharedMedia, DEFAULT_PIN_TTL};
+
 #[cfg(feature = "mem")]
 pub mod mem;
 

src/pg_lo.rs

@@ -295,6 +295,24 @@ impl PgLoBackend {
         })
     }
 
+    /// The pg instance's `system_identifier` (`pg_control_system()`,
+    /// PG14+) — read across one pooled connection. The fleet
+    /// constructor's same-instance probe's large-side instrument
+    /// (ADR-012 §4): the kv engine's identifier compared against this
+    /// — server-side instance identity, immune to DSN aliases. A probe
+    /// failure surfaces as an error (the probe errors closed — never a
+    /// silent pass). pg-lo never hosts fleet state; it only answers
+    /// the probe.
+    pub(crate) async fn system_identifier(&self) -> Result<u64, Error> {
+        let client = self.pool.get().await.map_err(err)?;
+        let row = client
+            .query_one("SELECT system_identifier FROM pg_control_system()", &[])
+            .await
+            .map_err(pg_err)?;
+        let id: i64 = row.try_get(0).map_err(pg_err)?;
+        Ok(id as u64)
+    }
+
     /// The catalog table-existence probe — test-only: the bootstrap
     /// test's instrument, answering for the engine-owned schema the
     /// backend was constructed with.

src/postgres.rs

@@ -111,7 +111,9 @@
 //! [`EngineFleetState`] impl carries the fleet family: the joint
 //! entry+pin transaction, the pin clauses, delete-time SQL arbitration
 //! with the engine-side liveness-table registration, and the sweep
-//! lease. The store core drives these clauses in wave 6 (fleet mode) —
+//! lease. The store core drives these clauses under the fleet
+//! declaration (`fleet: true` — the `_fleet` constructors landed, with
+//! the put/sweep drivers the fleet mechanism's remaining tasks) —
 //! under `fleet: false` none of the fleet clauses run, while
 //! `ensure_gc_schema` runs on every postgres store construction (the
 //! `store-postgres-construction` wiring, landed: the constructors are
@@ -137,10 +139,11 @@
 //!   ownership stays with the store core from `begin_joint_tx` until
 //!   `pin_commit` consumes it (ADR-010 §2's pinned ruling).
 //! - **`pin_renew`'s successor time** — the clause signature carries
-//!   no expiry, so the engine computes `expiry = now + DEFAULT_PIN_TTL`
-//!   (ADR-008's default 60 s; the shipped constant is a backend field,
-//!   constructor-tunable when wave 6's fleet constructor lands). The
-//!   store owns the TTL and the TTL/3 cadence — `pin_commit`'s pin
+//!   no expiry, so the engine computes `expiry = now + pin_ttl` (the
+//!   backend's pin-TTL field: the shipped default 60 s, constructor-
+//!   tunable through the fleet constructors' `new_with_pin_ttl`
+//!   instrument — the store's fleet `pin_ttl` parameter, ADR-008 §2).
+//!   The store owns the TTL and the TTL/3 cadence — `pin_commit`'s pin
 //!   rows carry the store-resolved expiry; renewals take the
 //!   successor-time shape recorded here.
 //! - **Timestamp encoding** — signed i64 nanoseconds from the Unix
@@ -240,8 +243,9 @@ pub(crate) struct PostgresBackend {
     window_table: String,
     /// The pin-TTL the successor-time source renews against (the
     /// recorded design point: ADR-008's default 60 s, shipped as a
-    /// backend constant; constructor-tunability arrives with wave 6's
-    /// fleet constructor).
+    /// backend constant; the fleet constructors tune it through
+    /// [`PostgresBackend::new_with_pin_ttl`] — the store's fleet
+    /// `pin_ttl` parameter landed).
     pin_ttl: Duration,
     /// The sweep lease's held checkout: `Some` exactly while the lease
     /// is held — the same-connection acquire/release discipline (the
@@ -277,6 +281,22 @@ impl PostgresBackend {
     /// cannot be built (`max_size = 0` fails at entry), or the DDL
     /// errors.
     pub(crate) async fn new(config: &str, opts: PgOpts) -> Result<Self, Error> {
+        Self::new_with_pin_ttl(config, opts, DEFAULT_PIN_TTL).await
+    }
+
+    /// Open the engine with a constructor-carried pin TTL — the fleet
+    /// constructors' instrument (wave 6's declaration landed): the
+    /// store's fleet `pin_ttl` (ADR-008 §2, default [`DEFAULT_PIN_TTL`])
+    /// configures the backend so [`EngineFleetState::pin_renew`]'s
+    /// successor-time body reads the TTL it was constructed with. The
+    /// non-fleet constructors ride [`Self::new`] (the shipped default;
+    /// nothing renews under `fleet: false`, so the value is dormant
+    /// there).
+    pub(crate) async fn new_with_pin_ttl(
+        config: &str,
+        opts: PgOpts,
+        pin_ttl: Duration,
+    ) -> Result<Self, Error> {
         let pool = build_pool(config, opts.max_size, opts.synchronous_commit)?;
         let schema = if opts.schema.is_empty() {
             DEFAULT_SCHEMA.to_owned()
@@ -298,7 +318,7 @@ impl PostgresBackend {
             schema,
             pins_table,
             window_table,
-            pin_ttl: DEFAULT_PIN_TTL,
+            pin_ttl,
             lease: Mutex::new(None),
             liveness_sources: Arc::new(Mutex::new(Vec::new())),
             #[cfg(test)]
@@ -308,6 +328,29 @@ impl PostgresBackend {
         })
     }
 
+    /// The pg instance's `system_identifier` (`pg_control_system()`,
+    /// PG14+) — read across one pooled connection. The fleet
+    /// constructor's same-instance probe's instrument (ADR-012 §4):
+    /// the kv engine's and the pg-lo engine's identifiers compared —
+    /// server-side instance identity, immune to DSN aliases. A probe
+    /// failure surfaces as an error (the probe errors closed — never
+    /// a silent pass).
+    pub(crate) async fn system_identifier(&self) -> Result<u64, Error> {
+        Self::system_identifier_of(&self.pool).await
+    }
+
+    /// The probe's body over a pool — shared with the pg-lo engine's
+    /// twin.
+    async fn system_identifier_of(pool: &Pool) -> Result<u64, Error> {
+        let client = pool.get().await.map_err(err)?;
+        let row = client
+            .query_one("SELECT system_identifier FROM pg_control_system()", &[])
+            .await
+            .map_err(pg_err)?;
+        let id: i64 = row.try_get(0).map_err(pg_err)?;
+        Ok(id as u64)
+    }
+
     /// Open a pool without schema creation — the virgin-store
     /// tolerance test's instrument (constructor-vs-lazy is a recorded
     /// design point; the read paths' no-schema-yet semantics are tested
@@ -415,7 +458,10 @@ CREATE TABLE IF NOT EXISTS {table} (
 }
 
 /// The pin-TTL constant's seconds ([`DEFAULT_PIN_TTL`]) — ADR-008's
-/// default, constructor-tunable when wave 6's fleet constructor lands.
+/// default; the store re-exports it as the fleet constructors' shipped
+/// `pin_ttl` value ([`crate::store::DEFAULT_PIN_TTL`]), and the fleet
+/// constructors tune the backend's `pin_ttl` through
+/// [`PostgresBackend::new_with_pin_ttl`].
 pub(crate) const DEFAULT_PIN_TTL_SECS: u64 = 60;
 
 /// The shipped pin-TTL ([`PostgresBackend::pin_renew`]'s successor-time
@@ -804,9 +850,12 @@ impl EngineWindowState for PostgresBackend {
 
 /// The fleet family (ADR-012 §5's postgres row — all yes): the joint
 /// entry+pin transaction, the pin clauses, delete-time SQL arbitration,
-/// and the sweep lease. Fleet activation is wave 6's constructor
-/// declaration — under `fleet: false` the store core never calls these;
-/// the clauses exist and are contract-tested per their applicability.
+/// and the sweep lease. Fleet activation is the constructor
+/// declaration (`fleet: true` — the `_fleet` constructors' explicit
+/// declaration, ADR-012 §3) — under `fleet: false` the store core
+/// never calls these; the clauses exist and are contract-tested per
+/// their applicability, and the store core's put/sweep drivers
+/// consume them as the fleet mechanism's tasks land.
 impl EngineFleetState for PostgresBackend {
     type JointTx = PgJointTx;
 
@@ -889,11 +938,13 @@ impl EngineFleetState for PostgresBackend {
         }
     }
 
-    /// Renew the `(key, owner)` pin row: `expiry = now + DEFAULT_PIN_TTL`
-    /// (the recorded successor-time source) — and only against a live
-    /// row: the update's predicate requires the existing row un-expired,
-    /// so an expired or absent row is never resurrected (`false`,
-    /// nothing updated).
+    /// Renew the `(key, owner)` pin row: `expiry = now + pin_ttl` (the
+    /// recorded successor-time source — the TTL the backend was
+    /// constructed with: the shipped default, or the fleet
+    /// constructor's value through `new_with_pin_ttl`) — and only
+    /// against a live row: the update's predicate requires the
+    /// existing row un-expired, so an expired or absent row is never
+    /// resurrected (`false`, nothing updated).
     async fn pin_renew(&self, key: &[u8], owner: &[u8]) -> Result<bool, Error> {
         let client = self.pool.get().await.map_err(err)?;
         let now = SystemTime::now();
@@ -1123,6 +1174,29 @@ mod tests {
         harness_with(tag, PgOpts::default()).await
     }
 
+    /// The TTL-tuned twin of [`harness`]: the backend opens through
+    /// `new_with_pin_ttl` (the fleet constructors' instrument), so the
+    /// renewal-body wiring tests the constructor-carried value.
+    async fn harness_with_ttl(tag: &str, pin_ttl: Duration) -> Option<Harness> {
+        let Some(dsn) = harness_dsn() else {
+            skip_note();
+            return None;
+        };
+        let schema = fresh_schema(tag);
+        let opts = PgOpts {
+            schema: schema.clone(),
+            ..PgOpts::default()
+        };
+        let backend = PostgresBackend::new_with_pin_ttl(&dsn, opts, pin_ttl)
+            .await
+            .expect("open");
+        backend.ensure_gc_schema().await.expect("gc schema");
+        Some(Harness {
+            backend,
+            _janitor: SchemaJanitor::new(&dsn, &schema),
+        })
+    }
+
     async fn harness_with(tag: &str, opts: PgOpts) -> Option<Harness> {
         let Some(dsn) = harness_dsn() else {
             skip_note();
@@ -2310,6 +2384,45 @@ mod tests {
         );
     }
 
+    /// The constructor-carried pin TTL reaches the renewal body: a
+    /// backend opened through `new_with_pin_ttl` (the fleet
+    /// constructors' instrument) renews a live row to
+    /// `now + pin_ttl` — the constructor's value, not the shipped
+    /// default (the wave-4 recorded design point, landed with the
+    /// fleet declaration).
+    #[tokio::test]
+    async fn pin_renew_renews_to_the_constructor_carried_ttl() {
+        let Some(backend) = harness_with_ttl("renew-ttl", Duration::from_secs(3600)).await else {
+            return;
+        };
+        let key = b"\x01renew-ttl-key".to_vec();
+        let owner = b"\x0ainstance-id".to_vec();
+
+        let live = SystemTime::now() + Duration::from_secs(30);
+        {
+            let client = backend.pool.get().await.unwrap();
+            let sql = format!(
+                "INSERT INTO {} (key, owner, expiry) VALUES ($1, $2, $3)",
+                backend.pins_table
+            );
+            client
+                .execute(sql.as_str(), &[&key, &owner, &time_to_nanos(live)])
+                .await
+                .unwrap();
+        }
+        assert!(
+            backend.pin_renew(&key, &owner).await.unwrap(),
+            "live row renews"
+        );
+        let after = pin_rows(&backend).await;
+        let expected = time_to_nanos(SystemTime::now()) + 3600i64 * 1_000_000_000;
+        let got = after[0].2;
+        assert!(
+            (got - expected).abs() < 3_000_000_000,
+            "renewed to the constructor-carried successor time now + 3600s: {got} vs {expected}"
+        );
+    }
+
     /// `pin_check`'s two-variant classification against un-expired pin
     /// rows: absent or only-expired rows → `Unprotected`; any live row
     /// → `Protected`. Protection composes by row, so any owner's live

tasks/store-fleet-construction.md

@@ -1,7 +1,7 @@
 ---
 id: store-fleet-construction
 name: the fleet declaration — the composite fleet-validity predicate at the constructor
-status: pending
+status: completed
 depends_on: []
 scope: moderate
 risk: medium
@@ -173,8 +173,114 @@ is the admission gate and the state those tasks consume.
 
 ## Notes
 
-> To be filled by implementation agent
+Landed 2026-10-12. Design decisions (each recorded in-code as a named
+design point; all keyed off the landed ADR text):
+
+- **The declaration slots in as `_fleet` twin constructors, without
+  reshaping (`kv_only_postgres_fleet`, `dual_tier_postgres_local_fleet`,
+  `dual_tier_postgres_pglo_fleet`).** Every pre-existing constructor's
+  signature and behavior is byte-unchanged and stays implicitly
+  `fleet: false` (the ADR-005 in-process protocol verbatim) — the
+  recorded non-event landed as recorded; no fleet parameter rides the
+  non-fleet signatures. The store carries `fleet:
+  Option<FleetState>` — `Some` exactly under the declaration, the flag
+  the put/sweep paths branch on (never re-derived from the engine set).
+- **The declaration's type shape (named design point):** the pin TTL
+  rides as a `Duration` parameter (mirroring `window_delay`'s shape,
+  shipped default the re-exported `DEFAULT_PIN_TTL`, 60 s), and the
+  shared-media assertion is a **sealed dedicated type** —
+  `FleetSharedMedia` with a private seal field; the caller cannot
+  construct it accidentally and must name `FleetSharedMedia::asserted()`
+  at the call site (the reading ADR-008 §3's "explicit declaration"
+  wording supports). No bare flag anywhere.
+- **The composite fleet-validity predicate** is one function
+  (`fleet_validity_error` over engine-representation-derived shape
+  descriptors `FleetKvShape`/`FleetLargeShape`), one sentence, both
+  tiers, run inside every fleet constructor keyed off the engine
+  representation like every other dispatch in this store. **Enforcement
+  map (recorded):** the structural clauses (kv = postgres, mem never,
+  sqlite never, `local` needs the declaration) are enforced by the
+  constructor set's shape itself — no `_fleet` constructor is named for
+  a mem/sqlite kv engine (the recorded "not fleet-anything" postures
+  carry no fleet parameter) — with the predicate's rejection arms
+  unit-tested per clause at the predicate level (the same error a
+  would-be construction carries); the pg-lo shape's runtime-checkable
+  clause probes at its constructor.
+- **The same-instance probe (named design point):** the instance's
+  `system_identifier` via `pg_control_system()` (PG14+) read across
+  one pooled connection per engine (`PostgresBackend::system_identifier`
+  / `PgLoBackend::system_identifier`) and compared — server-side
+  instance identity, immune to DSN aliases (textual DSN comparison
+  rejected as specified). **A mismatch or any probe failure is a
+  constructor error (errors closed, never a silent pass).** The probe
+  is instance-level, not database-level: verified positively with two
+  distinct *databases* on one instance (one `system_identifier` — the
+  data directory's).
+- **The owner id's minting (named design point):** 32 raw bytes, a
+  SHA-256 fold over process id + wall-clock nanos + a process-global
+  instance counter + an ASLR anchor; minted once at construction,
+  stable for the instance's life; uniqueness is the contract (the
+  counter separates instances in one process; time+pid+ASLR separate
+  processes), not secrecy; crate-internal, never public API. Carried
+  as the `owner` bytes of every `PinRow` the store will mint.
+- **The pin TTL's wiring:** `PostgresBackend::new_with_pin_ttl` (the
+  fleet constructors' instrument; `new` keeps the shipped default) —
+  proven against the live server: a backend opened through the
+  constructor renews a live pin row to `now + pin_ttl` (the
+  constructor-carried value, not the default).
+  `Duration::ZERO` is a constructor error at entry, before any I/O
+  (the TTL/3 cadence degenerates at zero).
+- **The one-window-host posture verified intact:** every fleet-valid
+  configuration has kv = postgres, and the fleet constructors' tests
+  assert the kv host's both-tables GC schema and the pg-lo schema's
+  dormancy (no `gc_window`, no `gc_pins`) — the form branch untouched
+  (keys off the engine representation, never a flag); a behavioral
+  test additionally proves the declaration turns nothing else on (a
+  fleet store's put/sweep run exactly the non-fleet machinery until
+  the put/sweep driver tasks land).
+- **Fleet constructor parameters, not API (ADR-008 §3):** `FleetState`,
+  `fleet_validity_error`, the shape descriptors, and `mint_owner_id`
+  are crate-internal; the public surface adds only the three
+  constructors, `FleetSharedMedia`, and `DEFAULT_PIN_TTL`
+  (feature `postgres`).
+- **Docs updated to the landed state:** the store.rs module doc's
+  fleet-declaration paragraph, the three postgres constructors' "Non-fleet
+  (ADR-012 §3)" recordings, the `#![allow(dead_code)]` scope note, the
+  postgres.rs pin-TTL design points (`new_with_pin_ttl` landed), the
+  gc.rs fleet-family note, and the pg-lo probe note. The remaining
+  wave-6 forward references (joint-tx put driver, fleet sweep, joint
+  contribution) are the later tasks', accurately scoped.
+- **Doc hygiene:** `cargo doc --no-deps` zero warnings in the default
+  build (the PGLO-1 class avoided: the module doc de-links the
+  feature-gated/private fleet items rather than widening gates; the
+  pre-existing gated-build doc-link warnings were counted before and
+  after — identical, not this change's).
 
 ## Summary
 
-> To be filled on completion
+The fleet declaration landed: three `_fleet` constructors
+(`kv_only_postgres_fleet`, `dual_tier_postgres_local_fleet`,
+`dual_tier_postgres_pglo_fleet`) carry the explicit `fleet: true`
+declaration with the composite fleet-validity predicate enforced at the
+constructor (kv = postgres AND large = pg-lo same-instance / local on
+the sealed shared-media declaration / none-the-re-routing posture) and
+the fleet parameters (pin TTL, default 60 s, wired through
+`new_with_pin_ttl` to the engine's renewal body; `FleetSharedMedia`
+sealed assertion; the probe = `pg_control_system().system_identifier`
+compared across one connection per engine, mismatch or failed probe a
+constructor error). The store carries its fleet state (`FleetState`:
+flag, TTL, the 32-byte minted owner id) — `fleet: false` postures
+byte-unchanged (all existing suites green untouched). Per-clause tests:
+every fleet-valid shape constructs and introspects against the live
+harness server (including the two-databases-one-instance probe shape
+and the kv-host window/dormancy assertions); mem, sqlite, and local-
+without-declaration reject per the predicate's tested arms; a
+unresolvable-instance DSN errors closed; a zero TTL rejects at entry.
+Verified: `cargo test` (default) green; `--features postgres` and
+`--features "postgres,pg-lo"` green server-less (skipping cleanly) and
+against the harness server (pglo-poc, :15432, PG 16.15 — verified live
+2026-10-12); `--all-features` green; clippy `-D warnings` green (all
+four feature combinations); `cargo fmt --check` green; `cargo doc
+--no-deps` clean. Wave 6's remaining tasks (`store-fleet-put`,
+`store-fleet-sweep`, `engine-pg-lo-joint`, `suite-column-fleet`) consume
+this task's declaration and state.