review(store): the wave-6 fleet gate — every gate check green, four inline findings fixed

The wave-6 review gate (docs/plans/implementation.md §Review gates,
the fleet gate) read the landed implementation against the pinned
ADR text line by line: the exact-count fleet sweep outcomes vs live
postgres, the joint entry+pin tx atomicity, the sweep lease vs
ADR-013 §2, the composite fleet-validity predicate, kv-only put-time
rejection, the TTL/3 renewal lifecycle, the fleet liveness verb, the
one-window-host rule, and the non-fleet postures — all conformant,
the task-hash log matched, the wave-2..5 suites green untouched.

Fixed inline:

- the A1 termination discipline's two uncovered paths — the kv
  driver's pin-row expiry mint propagated between begin_joint_tx and
  pin_commit without terminating the held tx (the PG-2 hazard), and
  fleet_joint_publish could abandon an already-begun tx on its
  host/row paths; the drivers now resolve the row inside their
  caught drives and hand it precomputed to the publish tail
- a wave-6 pg-pure test-build clippy regression: the fleet test
  instruments' wildcard match arms went unreachable under
  --no-default-features (helpers now ride Store::fleet_host())
- the stale/missing allow(dead_code) scope notes: store.rs's landed-
  state paragraph (the fleet sweep "not yet driven" → landed),
  gc.rs's sharpened remainder, local/sqlite/backend notes corrected,
  the pg_lo/postgres allow-scope sentences added; a measure-then-
  note check across six feature shapes (no allow removed)
- a PGLO-1-class near-miss: the new notes de-linked the private
  items they name; cargo doc --no-deps zero warnings, the gated
  build's pre-existing count 32 → 31 (nothing added)

Verification (tests live against pglo-poc :15432): cargo test (73/
19/3 default; 131/52/3 postgres; 167/73/3 postgres+pg-lo; 226/125/4
all-features), the pg-pure builds, clippy --all-targets -D warnings
on all seven feature variants, fmt --check, doc clean, shared-db
schema residue 0. Wave 7 (the ops surface) decomposition unblocked.

src/backend.rs

@@ -31,13 +31,13 @@
 //! the crate-internal engine-state companion seam lives in [`crate::gc`].
 //!
 //! The `#![allow(dead_code)]` below still has real scope: `Backend`
-//! trait items with no in-tree caller yet (the engines' reporting
-//! names — the dispatch/conformance identity the reporting and fleet
-//! waves consume) plus the wave-1 seam tests' doubles. The kv engines'
-//! whole-value `put` gained its in-tree callers in wave 3 (sqlite is
-//! the default build's kv engine and the facade's put seam drives the
-//! kv tier through it); the allow shrinks as the remaining callers
-//! land.
+//! trait items with no in-tree lib caller (`Backend::name` — the
+//! engines' reporting identity, consumed today by the engines' and
+//! the seam tests) plus the wave-1 seam tests' doubles. The kv
+//! engines' whole-value `put` gained its in-tree callers in wave 3
+//! (sqlite is the default build's kv engine and the facade's put seam
+//! drives the kv tier through it); the allow shrinks as the remaining
+//! callers land.
 
 #![allow(dead_code)]
 

src/gc.rs

@@ -69,15 +69,24 @@
 //! `ensure_gc_schema` on the window's host — the kv engine when it is
 //! SQL-backed, pg-lo when the kv engine is not (the one-window-host
 //! rule, ADR-012 §5); the sweep's durable form drives
-//! `window_stage`/`window_take` on that same host), while the fleet
-//! family's consumers have landed: the joint-tx put driver
+//! `window_stage`/`window_take` on that same host), and the fleet
+//! family's consumers have all landed: the joint-tx put driver
 //! (`store-fleet-put`: the store core's `begin_joint_tx` → engine
 //! contribution → `pin_commit` flow, plus the pin guard's TTL/3
 //! renewal task minted there) and the fleet sweep (`store-fleet-sweep`
 //! — the sweep lease, `pin_reap`, and the SQL-level arbitration verbs
 //! are driven: the sweep runs under the lease, the delete paths fold
 //! the SQL arbitration behind the in-process domain, the maintenance
-//! step reaps expired pin rows).
+//! step reaps expired pin rows). What the allow still covers: the
+//! fleet trait and its registration bookkeeping in non-postgres
+//! builds (no implementer or consumer compiles without feature
+//! `postgres`), the seam's `pin_check` clause — the pins-only
+//! classifier, deliberately unconsumed (its remaining consumer is
+//! wave 7's ops renewal probe), and the ADR-005 conversion-ordering
+//! primitive (`GcHome::convert`/`RegistryCore::convert`) plus the
+//! `GcHome::pin_count` observation aid — test-consumed today, with
+//! the conversion's in-sweep consumer being wave 7's liveness edit
+//! flow.
 
 #![allow(dead_code)]
 

src/local.rs

@@ -42,10 +42,14 @@
 //! a key is never overwritten — a losing race or a re-put is dedup,
 //! landing as `Ok` with the stage discarded.
 //!
-//! The `#![allow(dead_code)]` below marks the narrow remaining scope:
-//! in default builds (no `mem`) nothing constructs the engine, so
-//! `LocalBackend::new`/the staged-put bodies have no caller until
-//! wave 3's facade constructors and `store-put-paths` name them.
+//! The engine is built by the store facade's local large-tier arms —
+//! `dual_tier_mem_local`, `dual_tier_sqlite_local`,
+//! `dual_tier_postgres_local` (+ the fleet twin's shared-media
+//! declaration) — which give every lib body an in-tree caller; the
+//! `#![allow(dead_code)]` below covers only the test-instrument
+//! remainder: the cfg(test) staged-commit failure injection, whose
+//! consumers are the store-core tests behind feature `mem`, so the
+//! knob's consumers do not compile in default builds.
 
 #![allow(dead_code)]
 

src/pg_lo.rs

@@ -228,7 +228,12 @@
 //! (`ALKBLOBS_PG_HOST/PORT/USER/PASSWORD/DB`); tests skip cleanly
 //! server-less; acceptance requires green against the harness server
 //! (dockerized `pglo-poc`, `postgres:16-alpine`, :15432, db `blobs`,
-//! user/password `postgres`/`poc` — verified live 2026-10-12).
+//! user/password `postgres`/`poc` — verified live 2026-10-12). The
+//! `#![allow(dead_code)]` below covers the crate-internal orphan-
+//! recovery sweep (`PgLoBackend::reap_orphans`/`reap_orphans_tx` —
+//! the maintenance verb whose consumer is the embedder's operator
+//! runbook, not the in-crate store paths) and the feature-subset
+//! shapes (the joint form compiles only with feature `postgres`).
 
 #![allow(dead_code)]
 

src/postgres.rs

@@ -201,7 +201,14 @@
 //! (`ALKBLOBS_PG_HOST/PORT/USER/PASSWORD/DB`); tests skip cleanly
 //! server-less; acceptance requires green against the harness server
 //! (dockerized `pglo-poc`, `postgres:16-alpine`, :15432, db `blobs`,
-//! user/password `postgres`/`poc` — verified live 2026-10-12).
+//! user/password `postgres`/`poc` — verified live 2026-10-12). The
+//! `#![allow(dead_code)]` below covers the crate-internal batch-delete
+//! helper (`PostgresBackend::delete_batch` — the sweep-batch shape
+//! remaining available to batch consumers; the store core's delete
+//! paths arbitrate and delete per key), the same-instance probe's
+//! engine read (`system_identifier` — consumed by the pg-lo fleet
+//! constructor, feature `pg-lo`), the i64-nanos decode helper
+//! (test-instrument callers), and the feature-subset shapes.
 
 #![allow(dead_code)]
 

src/sqlite.rs

@@ -48,11 +48,12 @@
 //! `dual_tier_sqlite_local` / `kv_only_sqlite` (the wave-3 constructor
 //! wiring, landed) — which also runs the GC schema's engine-neutral
 //! call (`ensure_gc_schema`, creating `gc_window`). The
-//! `#![allow(dead_code)]` below has real scope only through that
-//! wiring's cfg-gates: a build with the feature off never compiles this
-//! module, and the test-only instruments (the tableless constructor,
-//! the commit-failure injection, the probe helpers) sit behind
-//! `#[cfg(test)]`.
+//! `#![allow(dead_code)]` below still has real scope: the
+//! `nanos_to_time` i64-nanos decode helper (the row timestamps are
+//! metadata the lib surface never decodes — its only current callers
+//! are the test instruments that read `committed_at`-shaped columns),
+//! plus the feature-subset shapes the cfg-gates leave without
+//! consumers.
 
 #![allow(dead_code)]
 

src/store.rs

@@ -302,16 +302,22 @@
 //! either host; the mem/local constructors' inline form has no delay
 //! in effect.
 //!
-//! The `#![allow(dead_code)]` below marks the work still ahead, not
-//! the GC protocol (the window host's construction call and the
-//! durable form are driven below on either host). The fleet
-//! declaration and the fleet put path have landed (the constructors'
-//! predicate, parameters, and fleet state; the joint-tx put driver —
-//! `begin_joint_tx` → the engine's contribution → `pin_commit`, with
-//! the pin guard's TTL/3 renewal duty); the fleet sweep
-//! (`store-fleet-sweep`) holds the fleet mechanism's remaining
-//! store-core scope — the sweep lease and the SQL-level arbitration
-//! clauses are contract-tested but not yet driven.
+//! The `#![allow(dead_code)]` below marks the seam's remaining dead
+//! scope, not the GC protocol: the fleet machinery's full family and
+//! every clause consumer have landed — the fleet declaration (the
+//! constructors' predicate, parameters, and fleet state), the fleet
+//! put path (`begin_joint_tx` → the engine's contribution →
+//! `pin_commit`, with the pin guard's TTL/3 renewal duty), and the
+//! fleet sweep (the sweep lease composing the in-process single-
+//! flighter, `pin_reap` under it, the SQL-level delete arbitration
+//! behind the in-process domain, the fleet liveness verb). What the
+//! allow still covers: the fleet predicate/state items in
+//! non-postgres builds (their consumers compile only with feature
+//! `postgres`), the inline sweep form (mem builds' non-SQL posture —
+//! the default and pg builds run the durable forms), the
+//! `window_delay` introspection accessor (the construction tests'
+//! instrument), and the feature-subset shapes the engine enums carry
+//! for the constructor matrix.
 
 #![allow(dead_code)]
 
@@ -2360,8 +2366,12 @@ impl Store {
 /// a completed, warning-level no-op, so the blanket termination after
 /// any failure (including the clause bodies' own rollback paths) is
 /// always safe; `pin_commit`'s failure paths (the terminal step, which
-/// consumes the tx) roll back per the wave-4 clause contract. The
-/// zero-residue atomicity of the tx itself is the engine clause's
+/// consumes the tx) roll back per the wave-4 clause contract. The pin
+/// row's expiry mint (`fleet_pin_row`'s clock-overflow error) is a
+/// pre-`pin_commit` step like any other: the kv driver terminates the
+/// held tx on it, and the pg-lo drivers resolve the row inside their
+/// caught drives. The zero-residue atomicity of the tx itself is the
+/// engine clause's
 /// contract (wave 4); the driver's duty is only never abandoning the
 /// tx mid-flight — its row-only and one-LO drivers below each state
 /// their interior `?` surface.
@@ -2554,7 +2564,13 @@ impl Store {
                     return Err(e);
                 }
             }
-            let row = self.fleet_pin_row(fleet, &key)?;
+            let row = match self.fleet_pin_row(fleet, &key) {
+                Ok(row) => row,
+                Err(e) => {
+                    Self::terminate_joint_tx(&mut tx).await;
+                    return Err(e);
+                }
+            };
             match EngineFleetState::pin_commit(&**host, tx, std::slice::from_ref(&row)).await {
                 Ok(()) => {}
                 Err(e) => return Err(e),
@@ -2645,26 +2661,28 @@ impl Store {
     }
 
     /// The joint publish's tail (shared by both pg-lo drivers): the
-    /// in-process pin mint, the row's `pin_commit` (the entry + pin
-    /// row in one step — the CAS contribution, fresh or empty, is
-    /// already inside the tx), and the renewal's spawn onto the durable
-    /// row.
+    /// row's `pin_commit` (the entry + pin row in one step — the CAS
+    /// contribution, fresh or empty, is already inside the tx), then
+    /// the in-process pin mint and the renewal's spawn onto the durable
+    /// row. The publish-time protection is the row (durable with the
+    /// entry in the one committed tx — ADR-012 §4); the in-process
+    /// refcount is the instance-local bookkeeping minted after it.
+    ///
+    /// Every fallible step is resolved before the held tx can be
+    /// abandoned: the host and the pin row arrive precomputed (the
+    /// callers resolve both inside their caught drives — the row's
+    /// expiry-mint failure is a pre-`pin_commit` path terminating the
+    /// tx there), and `pin_commit` is the terminal-consume step whose
+    /// own failure paths roll back per the wave-4 clause contract.
     #[cfg(feature = "postgres")]
     async fn fleet_joint_publish(
         &self,
+        host: &Arc<PostgresBackend>,
         fleet: &FleetState,
         tx: PgJointTx,
         key: Key,
+        row: PinRow,
     ) -> Result<(Key, Pin), Error> {
-        let host = match self.fleet_host() {
-            Some(host) => host,
-            None => {
-                return Err(Error::Io(
-                    "fleet put without the postgres kv host".to_owned(),
-                ))
-            }
-        };
-        let row = self.fleet_pin_row(fleet, &key)?;
         match EngineFleetState::pin_commit(&**host, tx, std::slice::from_ref(&row)).await {
             Ok(()) => {}
             Err(e) => return Err(e),
@@ -2735,11 +2753,12 @@ impl Store {
             }
             let key = Key::from(hasher.finish());
             let _fresh = stage.publish(&key.as_bytes()).await?;
-            Ok(key)
+            let row = self.fleet_pin_row(fleet, &key)?;
+            Ok((key, row))
         }
         .await;
         match driven {
-            Ok(key) => self.fleet_joint_publish(fleet, tx, key).await,
+            Ok((key, row)) => self.fleet_joint_publish(host, fleet, tx, key, row).await,
             Err(e) => {
                 Self::terminate_joint_tx(&mut tx).await;
                 Err(e)
@@ -2845,11 +2864,12 @@ impl Store {
             derived?;
             let key = Key::from(hasher.finish());
             let _fresh = stage.publish(&key.as_bytes()).await?;
-            Ok(key)
+            let row = self.fleet_pin_row(fleet, &key)?;
+            Ok((key, row))
         }
         .await;
         match driven {
-            Ok(key) => self.fleet_joint_publish(fleet, tx, key).await,
+            Ok((key, row)) => self.fleet_joint_publish(host, fleet, tx, key, row).await,
             Err(e) => {
                 Self::terminate_joint_tx(&mut tx).await;
                 Err(e)
@@ -9853,20 +9873,21 @@ mod postgres_fleet_sweep_tests {
     /// bypassing the put seam — the dead-candidate instrument (no pin
     /// row, no pin guard: the entry is genuinely unprotected).
     async fn plant_kv(store: &Store, key: &[u8], value: &[u8]) {
-        match store.kv() {
-            KvEngine::Postgres(engine) => engine.put(key, value).await.expect("kv plant"),
-            _ => panic!("these tests construct postgres fleet stores"),
-        }
+        store
+            .fleet_host()
+            .expect("these tests construct postgres fleet stores")
+            .put(key, value)
+            .await
+            .expect("kv plant");
     }
 
     /// Mint a pin row with an arbitrary owner id and expiry (row-only
     /// joint tx, no `joint_put`) — the foreign-owner and expired-row
     /// instruments.
     async fn mint_pin_row(store: &Store, key: &[u8], owner: &[u8], expiry: SystemTime) {
-        let host = match store.kv() {
-            KvEngine::Postgres(engine) => engine,
-            _ => panic!("these tests construct postgres fleet stores"),
-        };
+        let host = store
+            .fleet_host()
+            .expect("these tests construct postgres fleet stores");
         let tx = EngineFleetState::begin_joint_tx(&**host).await.unwrap();
         EngineFleetState::pin_commit(
             &**host,

tasks/review-wave-6.md

@@ -1,7 +1,7 @@
 ---
 id: review-wave-6
 name: Wave 6 review gate — the fleet gate
-status: pending
+status: completed
 depends_on: [suite-column-fleet]
 scope: narrow
 risk: low
@@ -108,15 +108,15 @@ wave 7's decomposition.
 
 ## Acceptance Criteria
 
-- [ ] Every gate check above read and verified against the cited ADR
+- [x] Every gate check above read and verified against the cited ADR
       text (not from memory of it)
-- [ ] Named design points each decided, recorded, and consistent with
+- [x] Named design points each decided, recorded, and consistent with
       the specs
-- [ ] Findings fixed inline or recorded as wave-7 amendments with
+- [x] Findings fixed inline or recorded as wave-7 amendments with
       owners
-- [ ] All gates re-run green after any fixes — including
+- [x] All gates re-run green after any fixes — including
       `cargo doc --no-deps` explicitly (the PGLO-1 class)
-- [ ] Wave 7 decomposition unblocked (recorded in this task's Summary)
+- [x] Wave 7 decomposition unblocked (recorded in this task's Summary)
 
 ## References
 
@@ -138,8 +138,202 @@ wave 7's decomposition.
 
 ## Notes
 
-> To be filled by implementation agent
+> Gate completed 2026-10-12, the wave-1..5 method: every gate check read
+> against the pinned text (ADR-008 §2/§3, ADR-010 §2, ADR-012 §1–§6,
+> ADR-013 §2, store-api.md §Invariants 4's engine-gated fleet form,
+> backends-and-dispatch.md's composite fleet-validity rule, and the
+> engine-state seam trait in src/gc.rs), then verified against the
+> landed diffs (b6b3532 → 53b85dd; the operator's hash log matched
+> `git log` exactly) and re-run gates. The task hashes were confirmed:
+> store-fleet-construction b6b3532, engine-pg-lo-joint 76be7b0,
+> store-fleet-put 950af9a, store-fleet-sweep 3a51bb4,
+> suite-column-fleet 53b85dd.
+>
+> **Gate checks, each verdict:**
+>
+> - **Exact-count fleet sweep outcomes vs live postgres** — conformant.
+>   The fleet column green against the harness server (pglo-poc, :15432;
+>   a skip never substituted — the suite ran live): the two-instance
+>   exact-count shape (b marks all three, stages exactly 3, deletes
+>   exactly the two unpinned twins, cancels exactly the pinned entry
+>   via A's un-expired row; the byte-identical survivor read back from
+>   the other instance), the lease-contention abort as report data with
+>   nothing staged/deleted, the cross-instance arbitration refusal
+>   until expiry, the race across the window delay, the maintenance
+>   step's exact reap, the embedder-table liveness row with the
+>   schema-ownership rule, and the kv-only re-routing row — every row
+>   ADR-stamped; 16 stamps counted in the column file.
+> - **Joint entry+pin tx atomicity** — conformant through the public
+>   `put` (the both-or-neither row asserts over an independent
+>   connection), with two A1 termination-path findings fixed inline
+>   (below). The pg-lo consolidation one-tx form verified
+>   structurally (`put_joint_staged` borrows the held `PgJointTx`
+>   checkout it never owns; no Drop, no COMMIT/ROLLBACK on any path —
+>   transactional LO creation makes the pages die with the driver's
+>   termination) and live (the byte-exact consolidation round-trip
+>   row). The `large = local` ordering is pin-first/publish-second in
+>   code (`fleet_staged_commit`: row-only joint tx, then
+>   commit-rename), with the reverse ordering nowhere coded.
+> - **Sweep lease vs ADR-013 §2** — conformant: atomic test-and-set
+>   (`pg_try_advisory_lock`, session-scoped), one sweeper per pool
+>   across instances (the in-process flag composes — both domains,
+>   either domain's contention aborting as `SweeperLock` report data
+>   with nothing deleted), holdership ends at release / owner death /
+>   session loss (in-instance reaping of dead checkouts — the wave-4
+>   PG-1 fix present), and the pool-sizing composition enforced at
+>   every `_fleet` constructor's entry (`max_size >= 2`).
+> - **Composite fleet-validity predicate at the constructor** —
+>   conformant: the one-sentence predicate as code (`fleet_validity_error`
+>   over engine-representation-derived shapes, never a flag), the
+>   structural clauses enforced by the constructor set's shape with
+>   the predicate's rejection arms unit-tested per clause, the pg-lo
+>   same-instance probe design recorded and implemented
+>   (`pg_control_system().system_identifier` compared across one
+>   connection per engine; a mismatch **or any probe failure** errors
+>   closed), the declaration explicit and never inferred (a sealed
+>   `FleetSharedMedia` named type plus the `_fleet` twin constructors;
+>   the pre-existing constructors byte-unchanged, implicitly
+>   `fleet: false`), the TTL a fleet constructor parameter (zero
+>   rejected at entry before any I/O).
+> - **kv-only put-time rejection** — conformant: ADR-012 §6.2's
+>   machinery unchanged under fleet (known-length rejects at entry,
+>   unknown-length at mid-stream threshold overflow; the fleet column's
+>   re-routing row green).
+> - **The TTL/3 renewal on the guard** — conformant: per-guard tokio
+>   task on the TTL/3 cadence (the 1 ms floor named), spawned at the
+>   row's durability, aborted at every guard-life boundary (drop,
+>   `Batch::add` moving the duty into the batch, the ordered-step
+>   conversion's pre-stop), silent on `Err`, ended by the never-
+>   resurrect `Ok(false)` (`pin_renew`'s `expiry > now` predicate —
+>   live-tested); no leaked tasks; the TTL never API.
+> - **Fleet liveness verb vs ADR-012 §6.6 / ADR-008 §2** — conformant:
+>   the same verb with the fleet-shaped `LivenessRegistration` argument
+>   (the named table reference form; the verb fallible with the
+>   error surface decided and recorded; in-process sources
+>   allow-and-document — instance-local protection); the
+>   schema-ownership rule holds (the engine is handed a reference,
+>   never creates the table — live-asserted); the protect callback's
+>   single-node-only posture recorded in the verb docs; the two-domain
+>   arbitration composition decided and recorded (in-process first,
+>   SQL second, implemented once at `arbitrated_delete`, shared by the
+>   direct path and window execution).
+> - **One-window-host rule under fleet** — conformant: every
+>   fleet-valid configuration ensures both GC tables on the kv host;
+>   the pg-lo window clauses dormant (no `gc_window` in the pg-lo
+>   schema — constructor-tested); the form branch keys off the engine
+>   representation (the `sweep_window` match), never a flag.
+> - **Non-fleet postures unchanged** — conformant: the in-process
+>   protocol verbatim under `fleet: false`; the wave-2/3/4/5 suites
+>   green untouched alongside the fleet additions.
+> - **Hygiene sweep** — findings fixed inline (below); `cargo doc
+>   --no-deps` zero warnings (the new allow-scope notes initially
+>   linked private items — PGLO-1's shape — and were de-linked); the
+>   `#![allow(dead_code)]` scope notes audited against a measured
+>   remainder (allow-stripped `cargo check` across the default,
+>   postgres, sqlite-only, mem, postgres+pg-lo, and all-features
+>   shapes) and corrected where stale.
+> - **Task-description correctness** — the diffs read against the five
+>   task texts; the Summaries match what landed, with the one finding
+>   (the A1 coverage gap, below) fixed inline rather than amending the
+>   task texts.
+>
+> **Findings fixed inline:**
+>
+> - **W6-1 — two A1 termination paths were uncovered (fixed).** A1's
+>   discipline (catch-propagate-terminate: every path from
+>   `begin_joint_tx` onward terminates the held tx before
+>   propagating) was not complete: `fleet_put_kv`'s pin-row expiry
+>   mint propagated with `?` between `begin_joint_tx` and `pin_commit`
+>   without terminating (the exact PG-2 dirty-session hazard A1
+>   exists for), and `fleet_joint_publish` — invoked with an already-
+>   begun tx — propagated on its host-None and row-mint paths without
+>   termination. Fixed: the kv driver terminates the tx on the
+>   row-mint error; the pg-lo drivers resolve the pin row inside
+>   their caught drives and hand the precomputed host + row to
+>   `fleet_joint_publish`, whose only fallible step left is the
+>   terminal `pin_commit` (clause-owned rollback). The A1 design-point
+>   doc records the row-mint path; `fleet_joint_publish`'s doc
+>   ordering corrected (the code mints the in-process refcount after
+>   `pin_commit` — the row is the publish-time protection, the
+>   refcount the instance-local bookkeeping; the invariant is row-
+>   carried, so the ordering is safe as written).
+> - **W6-2 — the pg-pure test builds failed `clippy --all-targets`**
+>   (fixed). `--no-default-features --features postgres[,pg-lo]` with
+>   tests: the wave-6 test instruments' `_ => panic!` match arms went
+>   unreachable-pattern (single-variant KvEngine) and a let-else was
+>   irrefutable — a wave-6 regression invisible to the gate lists
+>   (those run only `cargo check` for the pure builds, and the clippy
+>   variants that are listed are default/postgres/all-features, which
+>   passed). Fixed: the test helpers ride `Store::fleet_host()`'s
+>   expect instead of matching the engine enum (in-crate private
+>   access, cfg-exact). All seven clippy feature variants now green,
+>   the four pure shapes among them.
+> - **W6-3 — stale/missing allow(dead_code) scope notes** (fixed).
+>   store.rs's module-doc paragraph still said the fleet sweep was
+>   "not yet driven" (landed 3a51bb4) — rewritten to the landed state
+>   plus the allow's true remainder; local.rs's note still pointed at
+>   wave 3 ("until wave 3's facade constructors... name them") —
+>   corrected to its true remainder (the cfg(test) commit-failure
+>   injection knob behind feature `mem`; an allow-stripped check
+>   confirmed the lib bodies live); sqlite.rs's note misclaimed the
+>   remainder (its real residue is the test-instrument nanos decode)
+>   — corrected; backend.rs's "the reporting and fleet waves consume"
+>   forward reference → the landed reading (`Backend::name`,
+>   test-consumed today); gc.rs's note sharpened to name the true
+>   remainder (`pin_check` deliberately unconsumed — wave 7's ops
+>   renewal probe; `convert`/`pin_count` test-consumed today); the
+>   postgres.rs and pg_lo.rs notes gained their missing allow-scope
+>   sentences (the batch-delete helper, `system_identifier`,
+>   `reap_orphans`, the feature-subset shapes). No allow was removed:
+>   every file still carries real dead scope.
+> - **W6-4 — harness schema residue from a stale parallel run** (not a
+>   code finding). Three `alkblobs_fleet_*` schemas belonged to
+>   earlier battery pids (their teardown raced a parallel run), not to
+>   the suite as landed: a fresh full conformance run left zero new
+>   schemas (A2's janitor discipline holds); the stale three were
+>   dropped manually — residue 0.
+>
+> **Verification (post-fixes; tests live against pglo-poc :15432 unless
+> noted):** `cargo test` 73/19/3 ok (default); `cargo test --features
+> postgres` 131/52/3 ok; `cargo test --features postgres,pg-lo`
+> 167/73/3 ok; `cargo test --all-features` 226/125/4 ok; pg-pure
+> test-builds green (`--no-default-features --features postgres` /
+> `postgres,pg-lo`; the suite skips cleanly server-less);
+> `cargo check --no-default-features --features postgres` and
+> `--features postgres,pg-lo` green (the pure builds); clippy
+> `--all-targets -D warnings` green on all seven feature variants
+> (default, mem, postgres, postgres+pg-lo(+mem), all-features, and the
+> pg-pure builds); `cargo fmt --check` green; `cargo doc --no-deps`
+> zero warnings (the gated doc build's pre-existing count 32 → 31 —
+> nothing added; verified against the wave-5 base 93f9a93's
+> identical-pre-existing class); shared-db schema residue 0.
 
 ## Summary
 
-> To be filled on completion
+> Completed 2026-10-12 (wave 6). The fleet gate read the landed
+> wave-6 implementation against the pinned ADR text line by line and
+> found it conformant on every check: the exact-count fleet sweep
+> outcomes green against live postgres (two-instance survival with
+> exact counts, lease contention as report data, cross-instance
+> arbitration, the race across the delay, the exact-set reap, the
+> embedder-table liveness verb with its schema-ownership rule, the
+> kv-only re-routing row), the joint entry+pin tx atomicity through
+> the public put (both-or-neither over an independent connection; the
+> pg-lo consolidation one-tx form; the local pin-first ordering), the
+> sweep lease's ADR-013 §2 semantics with the pool-sizing guard, the
+> composite fleet-validity predicate enforced at the constructor with
+> the errors-closed same-instance probe, kv-only put-time rejection,
+> the TTL/3 renewal lifecycle on the guard, the fleet liveness verb's
+> named-table form, the one-window-host rule, and the non-fleet
+> postures byte-unchanged. Four findings fixed inline: two uncovered
+> A1 termination paths (the pin-row expiry mint's `?` in the kv
+> driver; `fleet_joint_publish`'s host/row propagation now resolved
+> pre- or terminal), a wave-6 pg-pure test-build clippy regression
+> (unreachable patterns — helpers now ride `fleet_host()`), and the
+> stale/missing allow-scope notes (five files' notes corrected against
+> a measured remainder; a stale "fleet sweep not yet driven" paragraph
+> rewritten to landed state). All gates re-run green after the fixes —
+> test suites live, the seven clippy variants, fmt, and
+> `cargo doc --no-deps` zero warnings. The operator's task-hash log
+> matched `git log`. Wave 7 (the ops surface) decomposition is
+> unblocked; its review gate is the ops-vs-alkcall conformance shape.