- Under fleet: true, puts route through the joint entry+pin tx
(store-fleet-put): kv tier via begin_joint_tx -> joint_put (CAS; a
dedup re-put commits the pin row alone, upsert-renewing
(key, owner)) -> pin_commit — entry + pin row in one step, verified
against an independent connection; large = pg-lo rides the one-tx
consolidation form (known- and unknown-length; the 512 KiB knee,
the empty-contribution re-put form, read-your-own-writes
derivation); large = local on declared shared media is
pin-first, publish-second (the row-only joint tx, then the staged
commit-rename; the orphan-pin crash window is the expiry
machinery's).
- Amendment A1 landed: catch-propagate-terminate — every error path
between begin_joint_tx and pin_commit terminates the held tx before
propagating (no mid-flight PgJointTx returns dirty to the pool,
PG-2); tested with a forced mid-driver failure (zero residue, the
pool's idle-in-transaction count zero, a follow-up put clean).
- The pin guard's fleet form: the returned guard carries the row's
TTL/3 renewal duty — a per-guard tokio task (spawned at the row's
durability), silent on Err, ended by the never-resurrect
Ok(false), aborted at every guard-life boundary (drop, batch
contribution, conversion); PinRenewal gated feature postgres.
- KvEngine::Postgres holds Arc<PostgresBackend> so detached renewal
tasks share the fleet host's engine; tokio gains the time feature
for the cadence.
- Non-fleet put paths byte-unchanged (all existing suites green); a
non-fleet test pins that no pin rows are ever committed.
- Tests: new postgres_fleet_put_tests (fresh schema + SchemaJanitor;
kv joint atomicity both-or-neither, forced pin_commit failure,
renewal cadence/drop/conversion stop, never-resurrect, batch
release ends renewals, dedup upsert-renewal + by-row composition,
local pin-first success + forced-failure forms, non-fleet
non-event) and postgres_pglo_fleet_put_tests (fresh db +
DatabaseJanitor; the A1 pg-lo failure form, the consolidation
round-trip through the public put). Env-driven, skipping cleanly
server-less.
Verified: cargo test (default) green; --features postgres and --features
"postgres,pg-lo" green server-less (skipping) and against the harness
server (pglo-poc, :15432); --all-features green live; pg-pure and
mem,pg-lo pure builds green; clippy -D warnings green (all combos);
cargo fmt --check green; cargo doc --no-deps clean (default; the gated
builds' pre-existing warnings unchanged). Schema/db residue 0.
- store-fleet-construction: the fleet: true declaration slotting into
the fleet-capable constructors (the recorded non-event), the
composite fleet-validity predicate enforced at the constructor
(kv=postgres AND pg-lo-same-instance OR local-on-declared-shared-
media OR kv-only re-routing), the TTL/owner-id fleet state, the
same-instance probe design point
- engine-pg-lo-joint: the pg-lo joint contribution — staged-put
mechanics (512 KiB knee, CAS, transactional LO creation) into the
store-held PgJointTx, the wave-5 deferred API-shape design point
- store-fleet-put: the joint entry+pin tx driver (amendment A1's
drop discipline lands here — its recorded owner), the pin guard's
TTL/3 renewal form, the dedup upsert-renewal, pin-first/
publish-second for large=local, the consolidation one-tx put
- store-fleet-sweep: the SQL sweep lease (ADR-013 §2 semantics),
SQL-level delete arbitration on the direct + window-execution
paths, the expired-pin reaping clause (the seam as the named home
for fleet-clause growth), the fleet liveness registration verb,
the two-domain arbitration composition
- suite-column-fleet: the fleet column — two-instance factories over
one schema, the exact-count fleet sweep rows (the wave's gate),
lease contention, cross-instance arbitration, TTL/renewal rows,
the fleet-validity predicate rows
- review-wave-6: the fleet gate per the plan, plus a standing
code-smell/hygiene block — cargo doc --no-deps asserted clean
(the twice-bitten PGLO-1 rustdoc private-link class), the
allow(dead_code) scope notes audited against their remainder,
stale wave-6 forward references, and task-Summary-vs-diff
correctness
Harness server cited in every server-touching task: dockerized
pglo-poc (postgres:16-alpine) on :15432, db blobs, postgres/poc
(verified live 2026-10-12); env-driven ALKBLOBS_PG_* settings, clean
server-less skips, acceptance requires green against the server.
Dependency graph validated: two parallel roots (construction, pg-lo
joint), put merging them, sweep parallel to put, the fleet column
merging, the review gate last; no cycles.
glm-5.3-flash