From e84a8747156c7b99b350c85355dccfa7b5d1ccf4 Mon Sep 17 00:00:00 2001 From: "glm-5.3-flash" Date: Mon, 12 Oct 2026 17:39:43 +0000 Subject: [PATCH] =?UTF-8?q?review(store):=20the=20wave-6=20fleet=20gate=20?= =?UTF-8?q?=E2=80=94=20every=20gate=20check=20green,=20four=20inline=20fin?= =?UTF-8?q?dings=20fixed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The wave-6 review gate (docs/plans/implementation.md §Review gates, the fleet gate) read the landed implementation against the pinned ADR text line by line: the exact-count fleet sweep outcomes vs live postgres, the joint entry+pin tx atomicity, the sweep lease vs ADR-013 §2, the composite fleet-validity predicate, kv-only put-time rejection, the TTL/3 renewal lifecycle, the fleet liveness verb, the one-window-host rule, and the non-fleet postures — all conformant, the task-hash log matched, the wave-2..5 suites green untouched. Fixed inline: - the A1 termination discipline's two uncovered paths — the kv driver's pin-row expiry mint propagated between begin_joint_tx and pin_commit without terminating the held tx (the PG-2 hazard), and fleet_joint_publish could abandon an already-begun tx on its host/row paths; the drivers now resolve the row inside their caught drives and hand it precomputed to the publish tail - a wave-6 pg-pure test-build clippy regression: the fleet test instruments' wildcard match arms went unreachable under --no-default-features (helpers now ride Store::fleet_host()) - the stale/missing allow(dead_code) scope notes: store.rs's landed- state paragraph (the fleet sweep "not yet driven" → landed), gc.rs's sharpened remainder, local/sqlite/backend notes corrected, the pg_lo/postgres allow-scope sentences added; a measure-then- note check across six feature shapes (no allow removed) - a PGLO-1-class near-miss: the new notes de-linked the private items they name; cargo doc --no-deps zero warnings, the gated build's pre-existing count 32 → 31 (nothing added) Verification (tests live against pglo-poc :15432): cargo test (73/ 19/3 default; 131/52/3 postgres; 167/73/3 postgres+pg-lo; 226/125/4 all-features), the pg-pure builds, clippy --all-targets -D warnings on all seven feature variants, fmt --check, doc clean, shared-db schema residue 0. Wave 7 (the ops surface) decomposition unblocked. --- src/backend.rs | 14 +-- src/gc.rs | 15 ++- src/local.rs | 12 ++- src/pg_lo.rs | 7 +- src/postgres.rs | 9 +- src/sqlite.rs | 11 ++- src/store.rs | 97 +++++++++++-------- tasks/review-wave-6.md | 210 +++++++++++++++++++++++++++++++++++++++-- 8 files changed, 308 insertions(+), 67 deletions(-) diff --git a/src/backend.rs b/src/backend.rs index 5ca9b59..41fc490 100644 --- a/src/backend.rs +++ b/src/backend.rs @@ -31,13 +31,13 @@ //! the crate-internal engine-state companion seam lives in [`crate::gc`]. //! //! The `#![allow(dead_code)]` below still has real scope: `Backend` -//! trait items with no in-tree caller yet (the engines' reporting -//! names — the dispatch/conformance identity the reporting and fleet -//! waves consume) plus the wave-1 seam tests' doubles. The kv engines' -//! whole-value `put` gained its in-tree callers in wave 3 (sqlite is -//! the default build's kv engine and the facade's put seam drives the -//! kv tier through it); the allow shrinks as the remaining callers -//! land. +//! trait items with no in-tree lib caller (`Backend::name` — the +//! engines' reporting identity, consumed today by the engines' and +//! the seam tests) plus the wave-1 seam tests' doubles. The kv +//! engines' whole-value `put` gained its in-tree callers in wave 3 +//! (sqlite is the default build's kv engine and the facade's put seam +//! drives the kv tier through it); the allow shrinks as the remaining +//! callers land. #![allow(dead_code)] diff --git a/src/gc.rs b/src/gc.rs index ddceaf9..9271a36 100644 --- a/src/gc.rs +++ b/src/gc.rs @@ -69,15 +69,24 @@ //! `ensure_gc_schema` on the window's host — the kv engine when it is //! SQL-backed, pg-lo when the kv engine is not (the one-window-host //! rule, ADR-012 §5); the sweep's durable form drives -//! `window_stage`/`window_take` on that same host), while the fleet -//! family's consumers have landed: the joint-tx put driver +//! `window_stage`/`window_take` on that same host), and the fleet +//! family's consumers have all landed: the joint-tx put driver //! (`store-fleet-put`: the store core's `begin_joint_tx` → engine //! contribution → `pin_commit` flow, plus the pin guard's TTL/3 //! renewal task minted there) and the fleet sweep (`store-fleet-sweep` //! — the sweep lease, `pin_reap`, and the SQL-level arbitration verbs //! are driven: the sweep runs under the lease, the delete paths fold //! the SQL arbitration behind the in-process domain, the maintenance -//! step reaps expired pin rows). +//! step reaps expired pin rows). What the allow still covers: the +//! fleet trait and its registration bookkeeping in non-postgres +//! builds (no implementer or consumer compiles without feature +//! `postgres`), the seam's `pin_check` clause — the pins-only +//! classifier, deliberately unconsumed (its remaining consumer is +//! wave 7's ops renewal probe), and the ADR-005 conversion-ordering +//! primitive (`GcHome::convert`/`RegistryCore::convert`) plus the +//! `GcHome::pin_count` observation aid — test-consumed today, with +//! the conversion's in-sweep consumer being wave 7's liveness edit +//! flow. #![allow(dead_code)] diff --git a/src/local.rs b/src/local.rs index 6d90c03..8dfbb34 100644 --- a/src/local.rs +++ b/src/local.rs @@ -42,10 +42,14 @@ //! a key is never overwritten — a losing race or a re-put is dedup, //! landing as `Ok` with the stage discarded. //! -//! The `#![allow(dead_code)]` below marks the narrow remaining scope: -//! in default builds (no `mem`) nothing constructs the engine, so -//! `LocalBackend::new`/the staged-put bodies have no caller until -//! wave 3's facade constructors and `store-put-paths` name them. +//! The engine is built by the store facade's local large-tier arms — +//! `dual_tier_mem_local`, `dual_tier_sqlite_local`, +//! `dual_tier_postgres_local` (+ the fleet twin's shared-media +//! declaration) — which give every lib body an in-tree caller; the +//! `#![allow(dead_code)]` below covers only the test-instrument +//! remainder: the cfg(test) staged-commit failure injection, whose +//! consumers are the store-core tests behind feature `mem`, so the +//! knob's consumers do not compile in default builds. #![allow(dead_code)] diff --git a/src/pg_lo.rs b/src/pg_lo.rs index b8dc1a8..0f3f551 100644 --- a/src/pg_lo.rs +++ b/src/pg_lo.rs @@ -228,7 +228,12 @@ //! (`ALKBLOBS_PG_HOST/PORT/USER/PASSWORD/DB`); tests skip cleanly //! server-less; acceptance requires green against the harness server //! (dockerized `pglo-poc`, `postgres:16-alpine`, :15432, db `blobs`, -//! user/password `postgres`/`poc` — verified live 2026-10-12). +//! user/password `postgres`/`poc` — verified live 2026-10-12). The +//! `#![allow(dead_code)]` below covers the crate-internal orphan- +//! recovery sweep (`PgLoBackend::reap_orphans`/`reap_orphans_tx` — +//! the maintenance verb whose consumer is the embedder's operator +//! runbook, not the in-crate store paths) and the feature-subset +//! shapes (the joint form compiles only with feature `postgres`). #![allow(dead_code)] diff --git a/src/postgres.rs b/src/postgres.rs index a129056..e045796 100644 --- a/src/postgres.rs +++ b/src/postgres.rs @@ -201,7 +201,14 @@ //! (`ALKBLOBS_PG_HOST/PORT/USER/PASSWORD/DB`); tests skip cleanly //! server-less; acceptance requires green against the harness server //! (dockerized `pglo-poc`, `postgres:16-alpine`, :15432, db `blobs`, -//! user/password `postgres`/`poc` — verified live 2026-10-12). +//! user/password `postgres`/`poc` — verified live 2026-10-12). The +//! `#![allow(dead_code)]` below covers the crate-internal batch-delete +//! helper (`PostgresBackend::delete_batch` — the sweep-batch shape +//! remaining available to batch consumers; the store core's delete +//! paths arbitrate and delete per key), the same-instance probe's +//! engine read (`system_identifier` — consumed by the pg-lo fleet +//! constructor, feature `pg-lo`), the i64-nanos decode helper +//! (test-instrument callers), and the feature-subset shapes. #![allow(dead_code)] diff --git a/src/sqlite.rs b/src/sqlite.rs index e0202d7..6ab91cd 100644 --- a/src/sqlite.rs +++ b/src/sqlite.rs @@ -48,11 +48,12 @@ //! `dual_tier_sqlite_local` / `kv_only_sqlite` (the wave-3 constructor //! wiring, landed) — which also runs the GC schema's engine-neutral //! call (`ensure_gc_schema`, creating `gc_window`). The -//! `#![allow(dead_code)]` below has real scope only through that -//! wiring's cfg-gates: a build with the feature off never compiles this -//! module, and the test-only instruments (the tableless constructor, -//! the commit-failure injection, the probe helpers) sit behind -//! `#[cfg(test)]`. +//! `#![allow(dead_code)]` below still has real scope: the +//! `nanos_to_time` i64-nanos decode helper (the row timestamps are +//! metadata the lib surface never decodes — its only current callers +//! are the test instruments that read `committed_at`-shaped columns), +//! plus the feature-subset shapes the cfg-gates leave without +//! consumers. #![allow(dead_code)] diff --git a/src/store.rs b/src/store.rs index 620972f..396d480 100644 --- a/src/store.rs +++ b/src/store.rs @@ -302,16 +302,22 @@ //! either host; the mem/local constructors' inline form has no delay //! in effect. //! -//! The `#![allow(dead_code)]` below marks the work still ahead, not -//! the GC protocol (the window host's construction call and the -//! durable form are driven below on either host). The fleet -//! declaration and the fleet put path have landed (the constructors' -//! predicate, parameters, and fleet state; the joint-tx put driver — -//! `begin_joint_tx` → the engine's contribution → `pin_commit`, with -//! the pin guard's TTL/3 renewal duty); the fleet sweep -//! (`store-fleet-sweep`) holds the fleet mechanism's remaining -//! store-core scope — the sweep lease and the SQL-level arbitration -//! clauses are contract-tested but not yet driven. +//! The `#![allow(dead_code)]` below marks the seam's remaining dead +//! scope, not the GC protocol: the fleet machinery's full family and +//! every clause consumer have landed — the fleet declaration (the +//! constructors' predicate, parameters, and fleet state), the fleet +//! put path (`begin_joint_tx` → the engine's contribution → +//! `pin_commit`, with the pin guard's TTL/3 renewal duty), and the +//! fleet sweep (the sweep lease composing the in-process single- +//! flighter, `pin_reap` under it, the SQL-level delete arbitration +//! behind the in-process domain, the fleet liveness verb). What the +//! allow still covers: the fleet predicate/state items in +//! non-postgres builds (their consumers compile only with feature +//! `postgres`), the inline sweep form (mem builds' non-SQL posture — +//! the default and pg builds run the durable forms), the +//! `window_delay` introspection accessor (the construction tests' +//! instrument), and the feature-subset shapes the engine enums carry +//! for the constructor matrix. #![allow(dead_code)] @@ -2360,8 +2366,12 @@ impl Store { /// a completed, warning-level no-op, so the blanket termination after /// any failure (including the clause bodies' own rollback paths) is /// always safe; `pin_commit`'s failure paths (the terminal step, which -/// consumes the tx) roll back per the wave-4 clause contract. The -/// zero-residue atomicity of the tx itself is the engine clause's +/// consumes the tx) roll back per the wave-4 clause contract. The pin +/// row's expiry mint (`fleet_pin_row`'s clock-overflow error) is a +/// pre-`pin_commit` step like any other: the kv driver terminates the +/// held tx on it, and the pg-lo drivers resolve the row inside their +/// caught drives. The zero-residue atomicity of the tx itself is the +/// engine clause's /// contract (wave 4); the driver's duty is only never abandoning the /// tx mid-flight — its row-only and one-LO drivers below each state /// their interior `?` surface. @@ -2554,7 +2564,13 @@ impl Store { return Err(e); } } - let row = self.fleet_pin_row(fleet, &key)?; + let row = match self.fleet_pin_row(fleet, &key) { + Ok(row) => row, + Err(e) => { + Self::terminate_joint_tx(&mut tx).await; + return Err(e); + } + }; match EngineFleetState::pin_commit(&**host, tx, std::slice::from_ref(&row)).await { Ok(()) => {} Err(e) => return Err(e), @@ -2645,26 +2661,28 @@ impl Store { } /// The joint publish's tail (shared by both pg-lo drivers): the - /// in-process pin mint, the row's `pin_commit` (the entry + pin - /// row in one step — the CAS contribution, fresh or empty, is - /// already inside the tx), and the renewal's spawn onto the durable - /// row. + /// row's `pin_commit` (the entry + pin row in one step — the CAS + /// contribution, fresh or empty, is already inside the tx), then + /// the in-process pin mint and the renewal's spawn onto the durable + /// row. The publish-time protection is the row (durable with the + /// entry in the one committed tx — ADR-012 §4); the in-process + /// refcount is the instance-local bookkeeping minted after it. + /// + /// Every fallible step is resolved before the held tx can be + /// abandoned: the host and the pin row arrive precomputed (the + /// callers resolve both inside their caught drives — the row's + /// expiry-mint failure is a pre-`pin_commit` path terminating the + /// tx there), and `pin_commit` is the terminal-consume step whose + /// own failure paths roll back per the wave-4 clause contract. #[cfg(feature = "postgres")] async fn fleet_joint_publish( &self, + host: &Arc, fleet: &FleetState, tx: PgJointTx, key: Key, + row: PinRow, ) -> Result<(Key, Pin), Error> { - let host = match self.fleet_host() { - Some(host) => host, - None => { - return Err(Error::Io( - "fleet put without the postgres kv host".to_owned(), - )) - } - }; - let row = self.fleet_pin_row(fleet, &key)?; match EngineFleetState::pin_commit(&**host, tx, std::slice::from_ref(&row)).await { Ok(()) => {} Err(e) => return Err(e), @@ -2735,11 +2753,12 @@ impl Store { } let key = Key::from(hasher.finish()); let _fresh = stage.publish(&key.as_bytes()).await?; - Ok(key) + let row = self.fleet_pin_row(fleet, &key)?; + Ok((key, row)) } .await; match driven { - Ok(key) => self.fleet_joint_publish(fleet, tx, key).await, + Ok((key, row)) => self.fleet_joint_publish(host, fleet, tx, key, row).await, Err(e) => { Self::terminate_joint_tx(&mut tx).await; Err(e) @@ -2845,11 +2864,12 @@ impl Store { derived?; let key = Key::from(hasher.finish()); let _fresh = stage.publish(&key.as_bytes()).await?; - Ok(key) + let row = self.fleet_pin_row(fleet, &key)?; + Ok((key, row)) } .await; match driven { - Ok(key) => self.fleet_joint_publish(fleet, tx, key).await, + Ok((key, row)) => self.fleet_joint_publish(host, fleet, tx, key, row).await, Err(e) => { Self::terminate_joint_tx(&mut tx).await; Err(e) @@ -9853,20 +9873,21 @@ mod postgres_fleet_sweep_tests { /// bypassing the put seam — the dead-candidate instrument (no pin /// row, no pin guard: the entry is genuinely unprotected). async fn plant_kv(store: &Store, key: &[u8], value: &[u8]) { - match store.kv() { - KvEngine::Postgres(engine) => engine.put(key, value).await.expect("kv plant"), - _ => panic!("these tests construct postgres fleet stores"), - } + store + .fleet_host() + .expect("these tests construct postgres fleet stores") + .put(key, value) + .await + .expect("kv plant"); } /// Mint a pin row with an arbitrary owner id and expiry (row-only /// joint tx, no `joint_put`) — the foreign-owner and expired-row /// instruments. async fn mint_pin_row(store: &Store, key: &[u8], owner: &[u8], expiry: SystemTime) { - let host = match store.kv() { - KvEngine::Postgres(engine) => engine, - _ => panic!("these tests construct postgres fleet stores"), - }; + let host = store + .fleet_host() + .expect("these tests construct postgres fleet stores"); let tx = EngineFleetState::begin_joint_tx(&**host).await.unwrap(); EngineFleetState::pin_commit( &**host, diff --git a/tasks/review-wave-6.md b/tasks/review-wave-6.md index ebc10a9..37dee63 100644 --- a/tasks/review-wave-6.md +++ b/tasks/review-wave-6.md @@ -1,7 +1,7 @@ --- id: review-wave-6 name: Wave 6 review gate — the fleet gate -status: pending +status: completed depends_on: [suite-column-fleet] scope: narrow risk: low @@ -108,15 +108,15 @@ wave 7's decomposition. ## Acceptance Criteria -- [ ] Every gate check above read and verified against the cited ADR +- [x] Every gate check above read and verified against the cited ADR text (not from memory of it) -- [ ] Named design points each decided, recorded, and consistent with +- [x] Named design points each decided, recorded, and consistent with the specs -- [ ] Findings fixed inline or recorded as wave-7 amendments with +- [x] Findings fixed inline or recorded as wave-7 amendments with owners -- [ ] All gates re-run green after any fixes — including +- [x] All gates re-run green after any fixes — including `cargo doc --no-deps` explicitly (the PGLO-1 class) -- [ ] Wave 7 decomposition unblocked (recorded in this task's Summary) +- [x] Wave 7 decomposition unblocked (recorded in this task's Summary) ## References @@ -138,8 +138,202 @@ wave 7's decomposition. ## Notes -> To be filled by implementation agent +> Gate completed 2026-10-12, the wave-1..5 method: every gate check read +> against the pinned text (ADR-008 §2/§3, ADR-010 §2, ADR-012 §1–§6, +> ADR-013 §2, store-api.md §Invariants 4's engine-gated fleet form, +> backends-and-dispatch.md's composite fleet-validity rule, and the +> engine-state seam trait in src/gc.rs), then verified against the +> landed diffs (b6b3532 → 53b85dd; the operator's hash log matched +> `git log` exactly) and re-run gates. The task hashes were confirmed: +> store-fleet-construction b6b3532, engine-pg-lo-joint 76be7b0, +> store-fleet-put 950af9a, store-fleet-sweep 3a51bb4, +> suite-column-fleet 53b85dd. +> +> **Gate checks, each verdict:** +> +> - **Exact-count fleet sweep outcomes vs live postgres** — conformant. +> The fleet column green against the harness server (pglo-poc, :15432; +> a skip never substituted — the suite ran live): the two-instance +> exact-count shape (b marks all three, stages exactly 3, deletes +> exactly the two unpinned twins, cancels exactly the pinned entry +> via A's un-expired row; the byte-identical survivor read back from +> the other instance), the lease-contention abort as report data with +> nothing staged/deleted, the cross-instance arbitration refusal +> until expiry, the race across the window delay, the maintenance +> step's exact reap, the embedder-table liveness row with the +> schema-ownership rule, and the kv-only re-routing row — every row +> ADR-stamped; 16 stamps counted in the column file. +> - **Joint entry+pin tx atomicity** — conformant through the public +> `put` (the both-or-neither row asserts over an independent +> connection), with two A1 termination-path findings fixed inline +> (below). The pg-lo consolidation one-tx form verified +> structurally (`put_joint_staged` borrows the held `PgJointTx` +> checkout it never owns; no Drop, no COMMIT/ROLLBACK on any path — +> transactional LO creation makes the pages die with the driver's +> termination) and live (the byte-exact consolidation round-trip +> row). The `large = local` ordering is pin-first/publish-second in +> code (`fleet_staged_commit`: row-only joint tx, then +> commit-rename), with the reverse ordering nowhere coded. +> - **Sweep lease vs ADR-013 §2** — conformant: atomic test-and-set +> (`pg_try_advisory_lock`, session-scoped), one sweeper per pool +> across instances (the in-process flag composes — both domains, +> either domain's contention aborting as `SweeperLock` report data +> with nothing deleted), holdership ends at release / owner death / +> session loss (in-instance reaping of dead checkouts — the wave-4 +> PG-1 fix present), and the pool-sizing composition enforced at +> every `_fleet` constructor's entry (`max_size >= 2`). +> - **Composite fleet-validity predicate at the constructor** — +> conformant: the one-sentence predicate as code (`fleet_validity_error` +> over engine-representation-derived shapes, never a flag), the +> structural clauses enforced by the constructor set's shape with +> the predicate's rejection arms unit-tested per clause, the pg-lo +> same-instance probe design recorded and implemented +> (`pg_control_system().system_identifier` compared across one +> connection per engine; a mismatch **or any probe failure** errors +> closed), the declaration explicit and never inferred (a sealed +> `FleetSharedMedia` named type plus the `_fleet` twin constructors; +> the pre-existing constructors byte-unchanged, implicitly +> `fleet: false`), the TTL a fleet constructor parameter (zero +> rejected at entry before any I/O). +> - **kv-only put-time rejection** — conformant: ADR-012 §6.2's +> machinery unchanged under fleet (known-length rejects at entry, +> unknown-length at mid-stream threshold overflow; the fleet column's +> re-routing row green). +> - **The TTL/3 renewal on the guard** — conformant: per-guard tokio +> task on the TTL/3 cadence (the 1 ms floor named), spawned at the +> row's durability, aborted at every guard-life boundary (drop, +> `Batch::add` moving the duty into the batch, the ordered-step +> conversion's pre-stop), silent on `Err`, ended by the never- +> resurrect `Ok(false)` (`pin_renew`'s `expiry > now` predicate — +> live-tested); no leaked tasks; the TTL never API. +> - **Fleet liveness verb vs ADR-012 §6.6 / ADR-008 §2** — conformant: +> the same verb with the fleet-shaped `LivenessRegistration` argument +> (the named table reference form; the verb fallible with the +> error surface decided and recorded; in-process sources +> allow-and-document — instance-local protection); the +> schema-ownership rule holds (the engine is handed a reference, +> never creates the table — live-asserted); the protect callback's +> single-node-only posture recorded in the verb docs; the two-domain +> arbitration composition decided and recorded (in-process first, +> SQL second, implemented once at `arbitrated_delete`, shared by the +> direct path and window execution). +> - **One-window-host rule under fleet** — conformant: every +> fleet-valid configuration ensures both GC tables on the kv host; +> the pg-lo window clauses dormant (no `gc_window` in the pg-lo +> schema — constructor-tested); the form branch keys off the engine +> representation (the `sweep_window` match), never a flag. +> - **Non-fleet postures unchanged** — conformant: the in-process +> protocol verbatim under `fleet: false`; the wave-2/3/4/5 suites +> green untouched alongside the fleet additions. +> - **Hygiene sweep** — findings fixed inline (below); `cargo doc +> --no-deps` zero warnings (the new allow-scope notes initially +> linked private items — PGLO-1's shape — and were de-linked); the +> `#![allow(dead_code)]` scope notes audited against a measured +> remainder (allow-stripped `cargo check` across the default, +> postgres, sqlite-only, mem, postgres+pg-lo, and all-features +> shapes) and corrected where stale. +> - **Task-description correctness** — the diffs read against the five +> task texts; the Summaries match what landed, with the one finding +> (the A1 coverage gap, below) fixed inline rather than amending the +> task texts. +> +> **Findings fixed inline:** +> +> - **W6-1 — two A1 termination paths were uncovered (fixed).** A1's +> discipline (catch-propagate-terminate: every path from +> `begin_joint_tx` onward terminates the held tx before +> propagating) was not complete: `fleet_put_kv`'s pin-row expiry +> mint propagated with `?` between `begin_joint_tx` and `pin_commit` +> without terminating (the exact PG-2 dirty-session hazard A1 +> exists for), and `fleet_joint_publish` — invoked with an already- +> begun tx — propagated on its host-None and row-mint paths without +> termination. Fixed: the kv driver terminates the tx on the +> row-mint error; the pg-lo drivers resolve the pin row inside +> their caught drives and hand the precomputed host + row to +> `fleet_joint_publish`, whose only fallible step left is the +> terminal `pin_commit` (clause-owned rollback). The A1 design-point +> doc records the row-mint path; `fleet_joint_publish`'s doc +> ordering corrected (the code mints the in-process refcount after +> `pin_commit` — the row is the publish-time protection, the +> refcount the instance-local bookkeeping; the invariant is row- +> carried, so the ordering is safe as written). +> - **W6-2 — the pg-pure test builds failed `clippy --all-targets`** +> (fixed). `--no-default-features --features postgres[,pg-lo]` with +> tests: the wave-6 test instruments' `_ => panic!` match arms went +> unreachable-pattern (single-variant KvEngine) and a let-else was +> irrefutable — a wave-6 regression invisible to the gate lists +> (those run only `cargo check` for the pure builds, and the clippy +> variants that are listed are default/postgres/all-features, which +> passed). Fixed: the test helpers ride `Store::fleet_host()`'s +> expect instead of matching the engine enum (in-crate private +> access, cfg-exact). All seven clippy feature variants now green, +> the four pure shapes among them. +> - **W6-3 — stale/missing allow(dead_code) scope notes** (fixed). +> store.rs's module-doc paragraph still said the fleet sweep was +> "not yet driven" (landed 3a51bb4) — rewritten to the landed state +> plus the allow's true remainder; local.rs's note still pointed at +> wave 3 ("until wave 3's facade constructors... name them") — +> corrected to its true remainder (the cfg(test) commit-failure +> injection knob behind feature `mem`; an allow-stripped check +> confirmed the lib bodies live); sqlite.rs's note misclaimed the +> remainder (its real residue is the test-instrument nanos decode) +> — corrected; backend.rs's "the reporting and fleet waves consume" +> forward reference → the landed reading (`Backend::name`, +> test-consumed today); gc.rs's note sharpened to name the true +> remainder (`pin_check` deliberately unconsumed — wave 7's ops +> renewal probe; `convert`/`pin_count` test-consumed today); the +> postgres.rs and pg_lo.rs notes gained their missing allow-scope +> sentences (the batch-delete helper, `system_identifier`, +> `reap_orphans`, the feature-subset shapes). No allow was removed: +> every file still carries real dead scope. +> - **W6-4 — harness schema residue from a stale parallel run** (not a +> code finding). Three `alkblobs_fleet_*` schemas belonged to +> earlier battery pids (their teardown raced a parallel run), not to +> the suite as landed: a fresh full conformance run left zero new +> schemas (A2's janitor discipline holds); the stale three were +> dropped manually — residue 0. +> +> **Verification (post-fixes; tests live against pglo-poc :15432 unless +> noted):** `cargo test` 73/19/3 ok (default); `cargo test --features +> postgres` 131/52/3 ok; `cargo test --features postgres,pg-lo` +> 167/73/3 ok; `cargo test --all-features` 226/125/4 ok; pg-pure +> test-builds green (`--no-default-features --features postgres` / +> `postgres,pg-lo`; the suite skips cleanly server-less); +> `cargo check --no-default-features --features postgres` and +> `--features postgres,pg-lo` green (the pure builds); clippy +> `--all-targets -D warnings` green on all seven feature variants +> (default, mem, postgres, postgres+pg-lo(+mem), all-features, and the +> pg-pure builds); `cargo fmt --check` green; `cargo doc --no-deps` +> zero warnings (the gated doc build's pre-existing count 32 → 31 — +> nothing added; verified against the wave-5 base 93f9a93's +> identical-pre-existing class); shared-db schema residue 0. ## Summary -> To be filled on completion \ No newline at end of file +> Completed 2026-10-12 (wave 6). The fleet gate read the landed +> wave-6 implementation against the pinned ADR text line by line and +> found it conformant on every check: the exact-count fleet sweep +> outcomes green against live postgres (two-instance survival with +> exact counts, lease contention as report data, cross-instance +> arbitration, the race across the delay, the exact-set reap, the +> embedder-table liveness verb with its schema-ownership rule, the +> kv-only re-routing row), the joint entry+pin tx atomicity through +> the public put (both-or-neither over an independent connection; the +> pg-lo consolidation one-tx form; the local pin-first ordering), the +> sweep lease's ADR-013 §2 semantics with the pool-sizing guard, the +> composite fleet-validity predicate enforced at the constructor with +> the errors-closed same-instance probe, kv-only put-time rejection, +> the TTL/3 renewal lifecycle on the guard, the fleet liveness verb's +> named-table form, the one-window-host rule, and the non-fleet +> postures byte-unchanged. Four findings fixed inline: two uncovered +> A1 termination paths (the pin-row expiry mint's `?` in the kv +> driver; `fleet_joint_publish`'s host/row propagation now resolved +> pre- or terminal), a wave-6 pg-pure test-build clippy regression +> (unreachable patterns — helpers now ride `fleet_host()`), and the +> stale/missing allow-scope notes (five files' notes corrected against +> a measured remainder; a stale "fleet sweep not yet driven" paragraph +> rewritten to landed state). All gates re-run green after the fixes — +> test suites live, the seven clippy variants, fmt, and +> `cargo doc --no-deps` zero warnings. The operator's task-hash log +> matched `git log`. Wave 7 (the ops surface) decomposition is +> unblocked; its review gate is the ops-vs-alkcall conformance shape. \ No newline at end of file