---
id: review-wave-6
name: Wave 6 review gate — the fleet gate
status: pending
depends_on: [suite-column-fleet]
scope: narrow
risk: low
impact: phase
level: review
tags: [wave-6, review]
---

## Description

The wave-6 review gate — **the fleet gate** (docs/plans/implementation.md
§Review gates: "exact-count sweep outcomes under concurrency vs live
postgres, the joint entry+pin tx atomicity, the sweep lease semantics
vs ADR-013 §2, the composite fleet-validity predicate enforced at the
constructor, kv-only put-time rejection"), before wave 7 decomposes.
The gate reads the implementation against the pinned ADR text line by
line (the wave-1..5 gates' method) — the documents, not memory.

Gate checks:

- **Exact-count fleet sweep outcomes under concurrency vs live
  postgres**: the fleet column green against the harness server
  (server-less runs skip cleanly — a skip never substitutes for
  acceptance); the two-instance survival shape, the lease-contention
  abort, the cross-instance arbitration refusal, the race across the
  window delay, and the maintenance-step reaping all exact-count
  asserted (INV-4's engine-gated fleet form).
- **The joint entry+pin tx atomicity**: through the public `put` (not
  only engine-level) — an independent connection never observes an
  entry without its pin row or the reverse; the A1 drop discipline
  audited as implemented (every path from `begin_joint_tx` onward
  terminates the tx — the wave-4 gate's amendment closed, its owner
  discharged); the pg-lo consolidation one-tx form (LO writes +
  companion row + pin row + commit in one tx; zero residue on
  failure); the large=local pin-first/publish-second ordering (the
  reverse ordering nowhere coded).
- **The sweep lease semantics vs ADR-013 §2**: one sweeper per pool
  across instances; atomic test-and-set; holdership ends at
  release/owner death/session loss; contention is the
  `GcAbortCause::SweeperLock` report abort (`Ok(SweepReport)`, nothing
  deleted — ADR-012 §1), never an error.
- **The composite fleet-validity predicate enforced at the
  constructor**: every fleet-valid configuration constructs; every
  non-fleet-valid configuration is a constructor error (kv ≠
  postgres, `mem` anywhere, `local` without the shared-media
  declaration, pg-lo cross-instance); the declaration is explicit,
  never inferred (ADR-012 §3); the same-instance probe's design
  audited (a failed probe errors closed).
- **kv-only put-time rejection** under the re-routing posture
  (ADR-012 §6.2's machinery, fleet edition).
- **The TTL/3 renewal on the guard**: the renewal lifecycle audited
  (no leaked tasks; drop/conversion/batch-contribution stops
  renewal; a failed renewal never resurrects an expired row —
  ADR-012 §2's expiry semantics verbatim); the TTL is a fleet
  constructor parameter (default 60 s), never API.
- **The fleet liveness verb vs ADR-012 §6.6 / ADR-008 §2**: the named
  table reference form; the schema-ownership rule (the store reads
  the embedder's table, never owns it); the protect callback's
  single-node-only posture recorded; the two-domain arbitration
  composition (in-process + SQL) decided and recorded.
- **The one-window-host rule under fleet**: every fleet-valid
  configuration's window hosts on the kv engine; the pg-lo window
  clauses dormant; the form branch keys off the engine
  representation, never a flag.
- **The non-fleet postures unchanged**: the in-process protocol
  verbatim under `fleet: false` regardless of engine — the wave-2/3/4/5
  suites green untouched.
- **Code-smell / hygiene sweep** (the gate's standing hygiene block —
  the twice-bitten lesson is now an explicit check, not a hope):
  - **`cargo doc --no-deps` zero warnings** — the PGLO-1 class
    (public-module doc links resolving to crate-internal items) has
    bitten waves 4 and 5; the gate runs rustdoc and asserts clean,
    and de-links rather than exports.
  - **The `#![allow(dead_code)]` scope notes match their remaining
    scope** — the fleet family's note in `src/gc.rs` (its consumers
    land this wave) must shrink to its true remainder or vanish; the
    postgres/pg-lo notes likewise audited.
  - **Stale forward references updated** — every "wave 6" note in the
    module docs (`store.rs`'s fleet-declaration paragraph, the
    constructors' "slots in without reshaping" recordings,
    `pg_lo.rs`'s scope boundary, `postgres.rs`'s scope note, the
    batch-delete helper's consumer note) reads the landed state.
  - **Family conventions**: no inline comments in code (doc comments
    on public API fine), thiserror, tokio-only async, no
    `unwrap`/`expect` outside tests, naming, one-module-per-file
    re-export shape, no blocking I/O on the async path.
  - **Task-description correctness**: each wave-6 task's Summary
    matches what actually landed (the gate reads the diffs against
    the task texts, not the Notes' claims alone).
- **Gates green**: `cargo test` (default), `cargo test --features
  postgres` (server-less: skipping), `cargo test --features
  "postgres,pg-lo"`, `cargo test --all-features` (against the
  server), the pure builds (`cargo check --no-default-features
  --features postgres` and `--features "postgres,pg-lo"`), `cargo
  clippy --all-targets -- -D warnings` (default + the postgres/pg-lo
  variants + `--all-features`), `cargo fmt --check`,
  `cargo doc --no-deps`.

Findings are fixed inline where cheap, or recorded as wave-7
amendments where they shape the next decomposition (the ops wave's
pin-token contract rides the fleet machinery — a renewal-surface
finding lands beside it). The gate's completion is what unblocks
wave 7's decomposition.

## Acceptance Criteria

- [ ] Every gate check above read and verified against the cited ADR
      text (not from memory of it)
- [ ] Named design points each decided, recorded, and consistent with
      the specs
- [ ] Findings fixed inline or recorded as wave-7 amendments with
      owners
- [ ] All gates re-run green after any fixes — including
      `cargo doc --no-deps` explicitly (the PGLO-1 class)
- [ ] Wave 7 decomposition unblocked (recorded in this task's Summary)

## References

- docs/plans/implementation.md (§Wave 6, §Review gates — the fleet
  gate)
- docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md
  §2/§3
- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md §2/§4
- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md §1–§6
- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §2
- docs/architecture/store-api.md (§Invariants 4 — the fleet form)
- docs/architecture/backends-and-dispatch.md (the composite
  fleet-validity rule)
- tasks/review-wave-4.md, tasks/review-wave-5.md (the gate method;
  the amendments A1/A2 this gate audits closed)
- tasks/store-fleet-construction.md, tasks/store-fleet-put.md,
  tasks/store-fleet-sweep.md, tasks/engine-pg-lo-joint.md,
  tasks/suite-column-fleet.md (the wave's tasks)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion