- Three `_fleet` twin constructors slot the explicit `fleet: true`
declaration in without reshaping the fleet-capable constructors;
every pre-existing constructor stays implicitly `fleet: false` with
byte-unchanged behavior (the recorded non-event landed as recorded):
`kv_only_postgres_fleet` (the re-routing client posture, large =
none), `dual_tier_postgres_local_fleet` (the shared-media posture),
`dual_tier_postgres_pglo_fleet` (the consolidation posture).
- The composite fleet-validity predicate (`fleet_validity_error`) is
one function, one sentence, both tiers, run at the constructor keyed
off the engine representation: kv = postgres AND (pg-lo on the same
pg instance OR local on declared shared media OR none). The
structural clauses (mem never, sqlite never, local needs the
declaration) are enforced by the constructor set's shape and tested
per clause at the predicate level; the pg-lo same-instance clause is
the runtime arm: `pg_control_system().system_identifier` compared
across one pooled connection per engine — mismatch or failed probe
is a constructor error, never a silent pass.
- The named design points decided and recorded: the shared-media
assertion is a sealed dedicated type (`FleetSharedMedia::asserted()`,
never a bare flag); the pin TTL is a fleet constructor parameter
(default `DEFAULT_PIN_TTL` 60 s, `Duration::ZERO` rejected at entry)
wired through `PostgresBackend::new_with_pin_ttl` to the renewal
body (proven against the live server); the owner id mints 32 raw
bytes at construction (SHA-256 fold over pid/nanos/instance
counter/ASLR anchor), stable per instance, crate-internal.
- The store carries its fleet state (`FleetState`: the declaration
flag, the TTL, the owner id) — crate-internal (fleet parameters,
not API); the one-window-host posture verified intact under fleet
(kv host's both-tables GC schema, pg-lo window clauses dormant, the
form branch keyed off the engine representation), and the
declaration turns nothing else on yet (put/sweep run the non-fleet
machinery until the driver tasks).
- Constructor docs updated to the landed state (module doc's
fleet-declaration paragraph, the three non-fleet recordings, the
scope notes, gc.rs/postgres.rs/pg_lo.rs wave-6 notes); `cargo doc
--no-deps` clean in the default build.
Verification: cargo test (default) green; --features postgres and
--features "postgres,pg-lo" green server-less (skipping cleanly) and
against the harness server (pglo-poc, :15432 — verified live 2026-
10-12); --all-features green; clippy -D warnings green (default +
postgres + postgres,pg-lo + all-features); cargo fmt --check green;
cargo doc --no-deps clean.
- store-fleet-construction: the fleet: true declaration slotting into
the fleet-capable constructors (the recorded non-event), the
composite fleet-validity predicate enforced at the constructor
(kv=postgres AND pg-lo-same-instance OR local-on-declared-shared-
media OR kv-only re-routing), the TTL/owner-id fleet state, the
same-instance probe design point
- engine-pg-lo-joint: the pg-lo joint contribution — staged-put
mechanics (512 KiB knee, CAS, transactional LO creation) into the
store-held PgJointTx, the wave-5 deferred API-shape design point
- store-fleet-put: the joint entry+pin tx driver (amendment A1's
drop discipline lands here — its recorded owner), the pin guard's
TTL/3 renewal form, the dedup upsert-renewal, pin-first/
publish-second for large=local, the consolidation one-tx put
- store-fleet-sweep: the SQL sweep lease (ADR-013 §2 semantics),
SQL-level delete arbitration on the direct + window-execution
paths, the expired-pin reaping clause (the seam as the named home
for fleet-clause growth), the fleet liveness registration verb,
the two-domain arbitration composition
- suite-column-fleet: the fleet column — two-instance factories over
one schema, the exact-count fleet sweep rows (the wave's gate),
lease contention, cross-instance arbitration, TTL/renewal rows,
the fleet-validity predicate rows
- review-wave-6: the fleet gate per the plan, plus a standing
code-smell/hygiene block — cargo doc --no-deps asserted clean
(the twice-bitten PGLO-1 rustdoc private-link class), the
allow(dead_code) scope notes audited against their remainder,
stale wave-6 forward references, and task-Summary-vs-diff
correctness
Harness server cited in every server-touching task: dockerized
pglo-poc (postgres:16-alpine) on :15432, db blobs, postgres/poc
(verified live 2026-10-12); env-driven ALKBLOBS_PG_* settings, clean
server-less skips, acceptance requires green against the server.
Dependency graph validated: two parallel roots (construction, pg-lo
joint), put merging them, sweep parallel to put, the fleet column
merging, the review gate last; no cycles.
glm-5.3-flash