feat(store): the fleet declaration — the composite fleet-validity predicate at the constructor (wave 6)

- Three `_fleet` twin constructors slot the explicit `fleet: true`
  declaration in without reshaping the fleet-capable constructors;
  every pre-existing constructor stays implicitly `fleet: false` with
  byte-unchanged behavior (the recorded non-event landed as recorded):
  `kv_only_postgres_fleet` (the re-routing client posture, large =
  none), `dual_tier_postgres_local_fleet` (the shared-media posture),
  `dual_tier_postgres_pglo_fleet` (the consolidation posture).
- The composite fleet-validity predicate (`fleet_validity_error`) is
  one function, one sentence, both tiers, run at the constructor keyed
  off the engine representation: kv = postgres AND (pg-lo on the same
  pg instance OR local on declared shared media OR none). The
  structural clauses (mem never, sqlite never, local needs the
  declaration) are enforced by the constructor set's shape and tested
  per clause at the predicate level; the pg-lo same-instance clause is
  the runtime arm: `pg_control_system().system_identifier` compared
  across one pooled connection per engine — mismatch or failed probe
  is a constructor error, never a silent pass.
- The named design points decided and recorded: the shared-media
  assertion is a sealed dedicated type (`FleetSharedMedia::asserted()`,
  never a bare flag); the pin TTL is a fleet constructor parameter
  (default `DEFAULT_PIN_TTL` 60 s, `Duration::ZERO` rejected at entry)
  wired through `PostgresBackend::new_with_pin_ttl` to the renewal
  body (proven against the live server); the owner id mints 32 raw
  bytes at construction (SHA-256 fold over pid/nanos/instance
  counter/ASLR anchor), stable per instance, crate-internal.
- The store carries its fleet state (`FleetState`: the declaration
  flag, the TTL, the owner id) — crate-internal (fleet parameters,
  not API); the one-window-host posture verified intact under fleet
  (kv host's both-tables GC schema, pg-lo window clauses dormant, the
  form branch keyed off the engine representation), and the
  declaration turns nothing else on yet (put/sweep run the non-fleet
  machinery until the driver tasks).
- Constructor docs updated to the landed state (module doc's
  fleet-declaration paragraph, the three non-fleet recordings, the
  scope notes, gc.rs/postgres.rs/pg_lo.rs wave-6 notes); `cargo doc
  --no-deps` clean in the default build.

Verification: cargo test (default) green; --features postgres and
--features "postgres,pg-lo" green server-less (skipping cleanly) and
against the harness server (pglo-poc, :15432 — verified live 2026-
10-12); --all-features green; clippy -D warnings green (default +
postgres + postgres,pg-lo + all-features); cargo fmt --check green;
cargo doc --no-deps clean.

tasks/store-fleet-construction.md

@@ -1,7 +1,7 @@
 ---
 id: store-fleet-construction
 name: the fleet declaration — the composite fleet-validity predicate at the constructor
-status: pending
+status: completed
 depends_on: []
 scope: moderate
 risk: medium
@@ -173,8 +173,114 @@ is the admission gate and the state those tasks consume.
 
 ## Notes
 
-> To be filled by implementation agent
+Landed 2026-10-12. Design decisions (each recorded in-code as a named
+design point; all keyed off the landed ADR text):
+
+- **The declaration slots in as `_fleet` twin constructors, without
+  reshaping (`kv_only_postgres_fleet`, `dual_tier_postgres_local_fleet`,
+  `dual_tier_postgres_pglo_fleet`).** Every pre-existing constructor's
+  signature and behavior is byte-unchanged and stays implicitly
+  `fleet: false` (the ADR-005 in-process protocol verbatim) — the
+  recorded non-event landed as recorded; no fleet parameter rides the
+  non-fleet signatures. The store carries `fleet:
+  Option<FleetState>` — `Some` exactly under the declaration, the flag
+  the put/sweep paths branch on (never re-derived from the engine set).
+- **The declaration's type shape (named design point):** the pin TTL
+  rides as a `Duration` parameter (mirroring `window_delay`'s shape,
+  shipped default the re-exported `DEFAULT_PIN_TTL`, 60 s), and the
+  shared-media assertion is a **sealed dedicated type** —
+  `FleetSharedMedia` with a private seal field; the caller cannot
+  construct it accidentally and must name `FleetSharedMedia::asserted()`
+  at the call site (the reading ADR-008 §3's "explicit declaration"
+  wording supports). No bare flag anywhere.
+- **The composite fleet-validity predicate** is one function
+  (`fleet_validity_error` over engine-representation-derived shape
+  descriptors `FleetKvShape`/`FleetLargeShape`), one sentence, both
+  tiers, run inside every fleet constructor keyed off the engine
+  representation like every other dispatch in this store. **Enforcement
+  map (recorded):** the structural clauses (kv = postgres, mem never,
+  sqlite never, `local` needs the declaration) are enforced by the
+  constructor set's shape itself — no `_fleet` constructor is named for
+  a mem/sqlite kv engine (the recorded "not fleet-anything" postures
+  carry no fleet parameter) — with the predicate's rejection arms
+  unit-tested per clause at the predicate level (the same error a
+  would-be construction carries); the pg-lo shape's runtime-checkable
+  clause probes at its constructor.
+- **The same-instance probe (named design point):** the instance's
+  `system_identifier` via `pg_control_system()` (PG14+) read across
+  one pooled connection per engine (`PostgresBackend::system_identifier`
+  / `PgLoBackend::system_identifier`) and compared — server-side
+  instance identity, immune to DSN aliases (textual DSN comparison
+  rejected as specified). **A mismatch or any probe failure is a
+  constructor error (errors closed, never a silent pass).** The probe
+  is instance-level, not database-level: verified positively with two
+  distinct *databases* on one instance (one `system_identifier` — the
+  data directory's).
+- **The owner id's minting (named design point):** 32 raw bytes, a
+  SHA-256 fold over process id + wall-clock nanos + a process-global
+  instance counter + an ASLR anchor; minted once at construction,
+  stable for the instance's life; uniqueness is the contract (the
+  counter separates instances in one process; time+pid+ASLR separate
+  processes), not secrecy; crate-internal, never public API. Carried
+  as the `owner` bytes of every `PinRow` the store will mint.
+- **The pin TTL's wiring:** `PostgresBackend::new_with_pin_ttl` (the
+  fleet constructors' instrument; `new` keeps the shipped default) —
+  proven against the live server: a backend opened through the
+  constructor renews a live pin row to `now + pin_ttl` (the
+  constructor-carried value, not the default).
+  `Duration::ZERO` is a constructor error at entry, before any I/O
+  (the TTL/3 cadence degenerates at zero).
+- **The one-window-host posture verified intact:** every fleet-valid
+  configuration has kv = postgres, and the fleet constructors' tests
+  assert the kv host's both-tables GC schema and the pg-lo schema's
+  dormancy (no `gc_window`, no `gc_pins`) — the form branch untouched
+  (keys off the engine representation, never a flag); a behavioral
+  test additionally proves the declaration turns nothing else on (a
+  fleet store's put/sweep run exactly the non-fleet machinery until
+  the put/sweep driver tasks land).
+- **Fleet constructor parameters, not API (ADR-008 §3):** `FleetState`,
+  `fleet_validity_error`, the shape descriptors, and `mint_owner_id`
+  are crate-internal; the public surface adds only the three
+  constructors, `FleetSharedMedia`, and `DEFAULT_PIN_TTL`
+  (feature `postgres`).
+- **Docs updated to the landed state:** the store.rs module doc's
+  fleet-declaration paragraph, the three postgres constructors' "Non-fleet
+  (ADR-012 §3)" recordings, the `#![allow(dead_code)]` scope note, the
+  postgres.rs pin-TTL design points (`new_with_pin_ttl` landed), the
+  gc.rs fleet-family note, and the pg-lo probe note. The remaining
+  wave-6 forward references (joint-tx put driver, fleet sweep, joint
+  contribution) are the later tasks', accurately scoped.
+- **Doc hygiene:** `cargo doc --no-deps` zero warnings in the default
+  build (the PGLO-1 class avoided: the module doc de-links the
+  feature-gated/private fleet items rather than widening gates; the
+  pre-existing gated-build doc-link warnings were counted before and
+  after — identical, not this change's).
 
 ## Summary
 
-> To be filled on completion
+The fleet declaration landed: three `_fleet` constructors
+(`kv_only_postgres_fleet`, `dual_tier_postgres_local_fleet`,
+`dual_tier_postgres_pglo_fleet`) carry the explicit `fleet: true`
+declaration with the composite fleet-validity predicate enforced at the
+constructor (kv = postgres AND large = pg-lo same-instance / local on
+the sealed shared-media declaration / none-the-re-routing posture) and
+the fleet parameters (pin TTL, default 60 s, wired through
+`new_with_pin_ttl` to the engine's renewal body; `FleetSharedMedia`
+sealed assertion; the probe = `pg_control_system().system_identifier`
+compared across one connection per engine, mismatch or failed probe a
+constructor error). The store carries its fleet state (`FleetState`:
+flag, TTL, the 32-byte minted owner id) — `fleet: false` postures
+byte-unchanged (all existing suites green untouched). Per-clause tests:
+every fleet-valid shape constructs and introspects against the live
+harness server (including the two-databases-one-instance probe shape
+and the kv-host window/dormancy assertions); mem, sqlite, and local-
+without-declaration reject per the predicate's tested arms; a
+unresolvable-instance DSN errors closed; a zero TTL rejects at entry.
+Verified: `cargo test` (default) green; `--features postgres` and
+`--features "postgres,pg-lo"` green server-less (skipping cleanly) and
+against the harness server (pglo-poc, :15432, PG 16.15 — verified live
+2026-10-12); `--all-features` green; clippy `-D warnings` green (all
+four feature combinations); `cargo fmt --check` green; `cargo doc
+--no-deps` clean. Wave 6's remaining tasks (`store-fleet-put`,
+`store-fleet-sweep`, `engine-pg-lo-joint`, `suite-column-fleet`) consume
+this task's declaration and state.