Grow the sweep and delete paths into their fleet forms under fleet: true
(ADR-008 §2, ADR-010 §2, ADR-012 §1/§5/§6.6/§6.7, ADR-013 §2); the
non-fleet forms are byte-unchanged.
- the sweep lease: sweep() composes the in-process single-flight flag
with the SQL lease (sweep_lock_acquire on the fleet host), both held
for the whole sweep and released on every exit path; contention at
either domain aborts as SweeperLock report data, nothing deleted;
the pool-sizing composition enforced (max_size >= 2 at the fleet
constructors' entry — the lease holds one checkout; the body's
clauses ride further checkouts)
- SQL-level delete arbitration: arbitrated_delete composes the two
domains (in-process first — cheap, local; the engine's arbitrate
second — fleet-authoritative) on the direct path (GcRefuse) and the
window execution's re-arbitration; a foreign instance's un-expired
pin row or liveness-table row refuses cross-instance
- the maintenance step: EngineFleetState::pin_reap (the seam as the
named clause home) reaps exactly the expired pin rows, one statement
on the postgres host, contract-tested, driven under the lease before
the overdue execution
- the fleet liveness verb: register_liveness_source takes the
fleet-shaped LivenessRegistration argument (ADR-012 §6.6's same-verb
wording) — the named-table form registers the embedder's own table
(schema-ownership rule holds; idempotent; deregistration composes
via a new engine-side unregister), the in-process form stays legal
(instance-local protection, documented); Registration carries its
kind; the verb is fallible (the fleet form's error surface)
- the protect callback's fleet posture recorded: single-node-only,
instance-local consult remains, materialization is the embedder's
duty — no new machinery
- the fleet sweep body: protect consult → reap → execute overdue
(two-domain re-arbitration, fall-through delete across both tiers)
→ mark (pool + in-process sources; SQL liveness consulted at
arbitration time, never enumerated) → stage → release; counts exact
relative to the schedule
- tests: lease contention/reaping between two instances, the
foreign-row GcRefuse, the exact-set reap, the embedder-table
protection + correction flow + malformed and fleet:false
rejections, the two-instance exact-count shape, and the delay race
in its fleet form; the wave-6 inert-machinery construction test
rewritten to the now-live fleet semantics
Verification: cargo test (default) green; cargo test --features
postgres green server-less (skipping) and against pglo-poc :15432;
cargo test --all-features green; cargo clippy --all-targets -D
warnings green (default, postgres, all-features); cargo fmt --check
green; cargo doc --no-deps clean (postgres-feature warnings
unchanged at the pre-existing 21).
glm-5.3-flash
3a51bb43fc