The wave-6 review gate (docs/plans/implementation.md §Review gates,
the fleet gate) read the landed implementation against the pinned
ADR text line by line: the exact-count fleet sweep outcomes vs live
postgres, the joint entry+pin tx atomicity, the sweep lease vs
ADR-013 §2, the composite fleet-validity predicate, kv-only put-time
rejection, the TTL/3 renewal lifecycle, the fleet liveness verb, the
one-window-host rule, and the non-fleet postures — all conformant,
the task-hash log matched, the wave-2..5 suites green untouched.
Fixed inline:
- the A1 termination discipline's two uncovered paths — the kv
driver's pin-row expiry mint propagated between begin_joint_tx and
pin_commit without terminating the held tx (the PG-2 hazard), and
fleet_joint_publish could abandon an already-begun tx on its
host/row paths; the drivers now resolve the row inside their
caught drives and hand it precomputed to the publish tail
- a wave-6 pg-pure test-build clippy regression: the fleet test
instruments' wildcard match arms went unreachable under
--no-default-features (helpers now ride Store::fleet_host())
- the stale/missing allow(dead_code) scope notes: store.rs's landed-
state paragraph (the fleet sweep "not yet driven" → landed),
gc.rs's sharpened remainder, local/sqlite/backend notes corrected,
the pg_lo/postgres allow-scope sentences added; a measure-then-
note check across six feature shapes (no allow removed)
- a PGLO-1-class near-miss: the new notes de-linked the private
items they name; cargo doc --no-deps zero warnings, the gated
build's pre-existing count 32 → 31 (nothing added)
Verification (tests live against pglo-poc :15432): cargo test (73/
19/3 default; 131/52/3 postgres; 167/73/3 postgres+pg-lo; 226/125/4
all-features), the pg-pure builds, clippy --all-targets -D warnings
on all seven feature variants, fmt --check, doc clean, shared-db
schema residue 0. Wave 7 (the ops surface) decomposition unblocked.
- resolve or unlink 25 preexisting rustdoc warnings: broken
intra-doc links (error variants), public-docs-linking-private-items
(crate-internal cursor/registry names), and one stale reference to a
`Store::window_host` that never existed (the form branch is
`sweep_window`'s engine-enum match)
- `clamped` runs its arithmetic in u64 and narrows to usize after
clamping, so a wide u64 offset can never wrap onto a small slice
position on narrow-pointer targets; the cursor contract tests pin
the overflowing-offset and overflowing-length forms
- zero rustdoc warnings under RUSTDOCFLAGS=-D warnings
Verification: cargo test (69+19+3 green), cargo test --all-features
(124+54+4 green), cargo clippy --all-targets -- -D warnings green,
cargo fmt --check green, RUSTDOCFLAGS=-D warnings cargo doc --no-deps
green.
- KvEngine::Sqlite slots in; all six kv ops dispatch; the kv cursor
body dispatches through a new KvCursor sub-enum behind AnyCursor's
one kv arm (the kv-arm-over-multiple-kv-engines design point,
recorded)
- dual_tier_sqlite_local (kv = sqlite + large = local, the
default-build production shape) and kv_only_sqlite constructors —
both feature-gated on sqlite (default-on), both taking the
threshold and the delete-window delay, fallible where I/O is
fallible (Err(Error::Io) per the dual_tier_mem_local pattern)
- ensure_gc_schema runs at construction via the engine-neutral
KvEngine call (sqlite's body creates gc_window only); the
window-delay shipped default is the pinned
DEFAULT_DELETE_WINDOW_DELAY (5 min, ADR-008 §2), constructor-
tunable, Duration::ZERO legal — the store carries the value for
the sweep's durable form to consume
- the one-window-host posture recorded in the module doc (the
durable window hosts on the kv engine when it is SQL-backed; wave
5's pg-lo dormancy slots in without reshaping)
- stale empty-set scaffolding updated to the landed state: the
#[allow(unused_variables)] attrs off the KvEngine methods; the
scope notes in store.rs, backend.rs, sqlite.rs, gc.rs
- constructor unit tests: mode/threshold/window-delay introspection,
the GC schema observed in the fresh database (window table present,
gc_pins never), kv-only rejection wiring unchanged, and the
dual-tier shape round-tripping end-to-end through both tiers
Verification: cargo test 62 passed (default; 5 new tests), cargo test
--all-features 117, cargo test --features mem 117, --no-default-
features --features mem 97; cargo clippy --all-targets -- -D warnings
clean (default + all-features); cargo fmt --check clean; cargo doc
--no-deps at the pre-existing warning baseline.
Read the wave-2 implementation against the pinned ADR text line by
line (ADR-003/005/006/010/011/012/013 §2, store-api.md): the three
numbered unknown-length rules each test-backed, the delete-window
ordering invariants (arbitrate-at-delete-time, pin-before-publish on
both put paths and both tiers, raced conversion ordering,
delete-then-recover), abort-as-data with all three causes, dispatch
purity + fall-through + constructor modes + kv-only's two put-time
rejection points, stage-hygiene exact counts on both engines (incl.
the Drop-cancellation story), both suite columns green/ADR-stamped/
traceable with the factory binding recorded, the dispatch-coverage
shape exercised, all eight named design points recorded and
consistent, and the staged-put key-at-commit amendment audited
accepted. No wave-3 amendments arise.
Inline fixes applied by the gate:
- facade.rs: stale Batch::add dead-code allow + stale task-pointer
comment removed (put_in_batch's call sites landed)
- dispatch.rs: module-level allow(dead_code) removed (route/Tier now
driven; clippy clean without it), scope note updated
- backend.rs: the allow kept but its scope note corrected to what is
actually dead (trait name, kv put until wave 3)
- mem.rs: stale constructor doc line updated to the landed state
- tasks/gc-protocol.md: stray placeholder lines removed
Verification: cargo test (42 lib + 2 conformance + 3 git-interop),
cargo test --features mem and --all-features (97 lib + 37 conformance
+ 4 git-interop), clippy --all-targets and --all-features --all-targets
(-D warnings), fmt --check — all green post-fix. Wave 3 decomposition
unblocked.
- `put(len: Option<u64>, stream: impl AsyncRead + Unpin + Send) -> (Key, Pin)`:
known-length one-pass flow; unknown-length buffer-to-threshold flow with
the mid-stream fresh-stage flush (ADR-003 option (d), three numbered rules:
flush-and-continue, derivation over the eventual stored artifact as a
whole via buffer form and StagingCursor read-back form, zero residue on
stream error)
- staged-put seam amended (operator sign-off): `put_staged()` keyless
handout, `StagingCursor::commit(self, key)` publishes under the
store-core-resolved key — the canonical key completes at stream end and
the wave-1 handout shape could not express the commit-rename flow
- pin-before-publish rides the arbitration lock on both paths and both
tiers; dedup re-puts refcount the existing entry
- Batch seam: `Store::batch()` + `put_in_batch()`, members publish pin-
before-publish, group pins drop together on `Batch::commit` (new public
verb) or drop
- kv-only rejection (ADR-012 §6.2): known-length over-threshold rejects
immediately (stream never read), unknown-length at mid-stream overflow;
zero residue; error carrier `Io(String)` (named design point)
- declared-len mismatch rejects `Verification` zero-residue (named design
point); stream shape generic-no-dyn (named design point)
- incremental BlobHasher (pinned byte-equal to Algorithm::derive);
AnyStaging cursor dispatch; git-interop put-path leg against
git hash-object; eleven put-path behavior tests
Verification: cargo test (default/--features mem/--all-features) green;
clippy --all-targets -D warnings green in all three feature shapes;
cargo fmt --check green; cargo doc --no-deps at the 24-warning baseline.
- src/mem.rs: MemBackend implements Backend (seven methods + put_staged,
name "mem") over Arc<parking_lot::Mutex<BTreeMap<..>>>; CAS
first-writer-wins puts, materializing MemCursor body, degenerate
in-memory MemStaging whose commit publishes via the same CAS clause
and self-discards on failure; discard leaves zero residue.
- CAS re-put is dedup for both put forms; reads are no-ops on the
virgin store; delete carries Missing; size is metadata-only.
- Eight in-module tests mirror the wave-1 double's assertions: method
contract, list well-formedness, cursor body read contract + ADR-006
range digest, empty-entry round-trip, staged happy path, and both
hygiene forms (fail_commit test hook stands in for media failure).
- backend.rs: clamped promoted pub(crate) — the shared EOF-clamping
arithmetic both mem cursor bodies compose (no per-engine duplicate).
Verification: cargo test --features mem (33+7 green); cargo test
(default) green; clippy --all-features --all-targets -D warnings green;
fmt --check green.
The wave-1 contract surface: everything engine-blind that waves 2-6
implement against. No engine bodies, no facade behavior logic.
- src/backend.rs: the pub(crate) Backend trait — seven methods +
put_staged, opaque byte keys/values, size metadata-only, list
complete-and-well-formed, virgin-store reads as no-ops (ADR-003,
ADR-008); the ReadCursor/StagingCursor I/O seams with the read_range
slice-digest convention (ADR-006) at one seam; unit tests against
both body-family doubles, a test-double engine, and the stage-hygiene
invariant's two forms (discard; commit failure self-discards).
- src/gc.rs: the engine-state companion seam as EngineWindowState /
EngineFleetState — ADR-012 §5's applicability table expressed
structurally (no dead machinery); JointTx ownership rule pinned in
the signature (store holds the tx; engine contributes mechanics).
- src/facade.rs: EntryMeta, Pin, Batch, SweepReport, GcAbortCause
(x3, #[non_exhaustive]), PinState with lifecycle contracts
(ADR-005, ADR-012 §1); re-exported from lib.rs.
- Design points pinned for the wave-1 review gate in
tasks/core-trait-and-types.md: pub(crate) trait visibility,
associated-type put-form shapes, AFIT + associated types (no dyn).
Verification: cargo test (26 lib + 3 git-interop), cargo test
--all-features, clippy --all-targets -D warnings (default and
--all-features), cargo fmt --check, cargo doc --no-deps — all green.
glm-5.3-flash