- EngineWindowState: the both-tables ensure_gc_schema (gc_pins with the
(key, owner) identity + gc_window), idempotent window_stage (the
upsert discipline per (key, deadline)), and window_take as one atomic
DELETE ... RETURNING with the <= boundary
- EngineFleetState: PgJointTx (the pooled checkout carrying a
session-level BEGIN), joint_put (the CAS clause inside the held tx),
pin_commit (pin-row upsert-renewals + commit, rollback-on-failure =>
zero residue), pin_renew (expiry = now + DEFAULT_PIN_TTL, never
resurrects), pin_check (the two-variant classification), arbitrate
(the FOR UPDATE finger-lock folding pins + registered liveness-table
references), and the engine-side register_liveness_source home
- The sweep lease: the session-scoped pg advisory lock with the
namespaced FNV lock key and the same-connection acquire/release
holding discipline (the lease's checkout stored until release)
- 13 contract tests (28 postgres tests total), env-driven, skipping
cleanly server-less; verified green against the live pglo-poc
harness server; clippy/fmt green default + --features postgres
Verification: cargo test (69/19/3 ok), cargo test --features postgres
server-less (97 ok, 28 skips) and live (97 ok), cargo test
--all-features (152/54/4 ok), cargo clippy -D warnings (both configs),
cargo fmt --check, cargo doc --no-deps.