glm-5.3-flash
009de420e1
- store-fleet-construction: the fleet: true declaration slotting into the fleet-capable constructors (the recorded non-event), the composite fleet-validity predicate enforced at the constructor (kv=postgres AND pg-lo-same-instance OR local-on-declared-shared- media OR kv-only re-routing), the TTL/owner-id fleet state, the same-instance probe design point - engine-pg-lo-joint: the pg-lo joint contribution — staged-put mechanics (512 KiB knee, CAS, transactional LO creation) into the store-held PgJointTx, the wave-5 deferred API-shape design point - store-fleet-put: the joint entry+pin tx driver (amendment A1's drop discipline lands here — its recorded owner), the pin guard's TTL/3 renewal form, the dedup upsert-renewal, pin-first/ publish-second for large=local, the consolidation one-tx put - store-fleet-sweep: the SQL sweep lease (ADR-013 §2 semantics), SQL-level delete arbitration on the direct + window-execution paths, the expired-pin reaping clause (the seam as the named home for fleet-clause growth), the fleet liveness registration verb, the two-domain arbitration composition - suite-column-fleet: the fleet column — two-instance factories over one schema, the exact-count fleet sweep rows (the wave's gate), lease contention, cross-instance arbitration, TTL/renewal rows, the fleet-validity predicate rows - review-wave-6: the fleet gate per the plan, plus a standing code-smell/hygiene block — cargo doc --no-deps asserted clean (the twice-bitten PGLO-1 rustdoc private-link class), the allow(dead_code) scope notes audited against their remainder, stale wave-6 forward references, and task-Summary-vs-diff correctness Harness server cited in every server-touching task: dockerized pglo-poc (postgres:16-alpine) on :15432, db blobs, postgres/poc (verified live 2026-10-12); env-driven ALKBLOBS_PG_* settings, clean server-less skips, acceptance requires green against the server. Dependency graph validated: two parallel roots (construction, pg-lo joint), put merging them, sweep parallel to put, the fleet column merging, the review gate last; no cycles.
145 lines
7.0 KiB
Markdown
145 lines
7.0 KiB
Markdown
---
|
|
id: review-wave-6
|
|
name: Wave 6 review gate — the fleet gate
|
|
status: pending
|
|
depends_on: [suite-column-fleet]
|
|
scope: narrow
|
|
risk: low
|
|
impact: phase
|
|
level: review
|
|
tags: [wave-6, review]
|
|
---
|
|
|
|
## Description
|
|
|
|
The wave-6 review gate — **the fleet gate** (docs/plans/implementation.md
|
|
§Review gates: "exact-count sweep outcomes under concurrency vs live
|
|
postgres, the joint entry+pin tx atomicity, the sweep lease semantics
|
|
vs ADR-013 §2, the composite fleet-validity predicate enforced at the
|
|
constructor, kv-only put-time rejection"), before wave 7 decomposes.
|
|
The gate reads the implementation against the pinned ADR text line by
|
|
line (the wave-1..5 gates' method) — the documents, not memory.
|
|
|
|
Gate checks:
|
|
|
|
- **Exact-count fleet sweep outcomes under concurrency vs live
|
|
postgres**: the fleet column green against the harness server
|
|
(server-less runs skip cleanly — a skip never substitutes for
|
|
acceptance); the two-instance survival shape, the lease-contention
|
|
abort, the cross-instance arbitration refusal, the race across the
|
|
window delay, and the maintenance-step reaping all exact-count
|
|
asserted (INV-4's engine-gated fleet form).
|
|
- **The joint entry+pin tx atomicity**: through the public `put` (not
|
|
only engine-level) — an independent connection never observes an
|
|
entry without its pin row or the reverse; the A1 drop discipline
|
|
audited as implemented (every path from `begin_joint_tx` onward
|
|
terminates the tx — the wave-4 gate's amendment closed, its owner
|
|
discharged); the pg-lo consolidation one-tx form (LO writes +
|
|
companion row + pin row + commit in one tx; zero residue on
|
|
failure); the large=local pin-first/publish-second ordering (the
|
|
reverse ordering nowhere coded).
|
|
- **The sweep lease semantics vs ADR-013 §2**: one sweeper per pool
|
|
across instances; atomic test-and-set; holdership ends at
|
|
release/owner death/session loss; contention is the
|
|
`GcAbortCause::SweeperLock` report abort (`Ok(SweepReport)`, nothing
|
|
deleted — ADR-012 §1), never an error.
|
|
- **The composite fleet-validity predicate enforced at the
|
|
constructor**: every fleet-valid configuration constructs; every
|
|
non-fleet-valid configuration is a constructor error (kv ≠
|
|
postgres, `mem` anywhere, `local` without the shared-media
|
|
declaration, pg-lo cross-instance); the declaration is explicit,
|
|
never inferred (ADR-012 §3); the same-instance probe's design
|
|
audited (a failed probe errors closed).
|
|
- **kv-only put-time rejection** under the re-routing posture
|
|
(ADR-012 §6.2's machinery, fleet edition).
|
|
- **The TTL/3 renewal on the guard**: the renewal lifecycle audited
|
|
(no leaked tasks; drop/conversion/batch-contribution stops
|
|
renewal; a failed renewal never resurrects an expired row —
|
|
ADR-012 §2's expiry semantics verbatim); the TTL is a fleet
|
|
constructor parameter (default 60 s), never API.
|
|
- **The fleet liveness verb vs ADR-012 §6.6 / ADR-008 §2**: the named
|
|
table reference form; the schema-ownership rule (the store reads
|
|
the embedder's table, never owns it); the protect callback's
|
|
single-node-only posture recorded; the two-domain arbitration
|
|
composition (in-process + SQL) decided and recorded.
|
|
- **The one-window-host rule under fleet**: every fleet-valid
|
|
configuration's window hosts on the kv engine; the pg-lo window
|
|
clauses dormant; the form branch keys off the engine
|
|
representation, never a flag.
|
|
- **The non-fleet postures unchanged**: the in-process protocol
|
|
verbatim under `fleet: false` regardless of engine — the wave-2/3/4/5
|
|
suites green untouched.
|
|
- **Code-smell / hygiene sweep** (the gate's standing hygiene block —
|
|
the twice-bitten lesson is now an explicit check, not a hope):
|
|
- **`cargo doc --no-deps` zero warnings** — the PGLO-1 class
|
|
(public-module doc links resolving to crate-internal items) has
|
|
bitten waves 4 and 5; the gate runs rustdoc and asserts clean,
|
|
and de-links rather than exports.
|
|
- **The `#![allow(dead_code)]` scope notes match their remaining
|
|
scope** — the fleet family's note in `src/gc.rs` (its consumers
|
|
land this wave) must shrink to its true remainder or vanish; the
|
|
postgres/pg-lo notes likewise audited.
|
|
- **Stale forward references updated** — every "wave 6" note in the
|
|
module docs (`store.rs`'s fleet-declaration paragraph, the
|
|
constructors' "slots in without reshaping" recordings,
|
|
`pg_lo.rs`'s scope boundary, `postgres.rs`'s scope note, the
|
|
batch-delete helper's consumer note) reads the landed state.
|
|
- **Family conventions**: no inline comments in code (doc comments
|
|
on public API fine), thiserror, tokio-only async, no
|
|
`unwrap`/`expect` outside tests, naming, one-module-per-file
|
|
re-export shape, no blocking I/O on the async path.
|
|
- **Task-description correctness**: each wave-6 task's Summary
|
|
matches what actually landed (the gate reads the diffs against
|
|
the task texts, not the Notes' claims alone).
|
|
- **Gates green**: `cargo test` (default), `cargo test --features
|
|
postgres` (server-less: skipping), `cargo test --features
|
|
"postgres,pg-lo"`, `cargo test --all-features` (against the
|
|
server), the pure builds (`cargo check --no-default-features
|
|
--features postgres` and `--features "postgres,pg-lo"`), `cargo
|
|
clippy --all-targets -- -D warnings` (default + the postgres/pg-lo
|
|
variants + `--all-features`), `cargo fmt --check`,
|
|
`cargo doc --no-deps`.
|
|
|
|
Findings are fixed inline where cheap, or recorded as wave-7
|
|
amendments where they shape the next decomposition (the ops wave's
|
|
pin-token contract rides the fleet machinery — a renewal-surface
|
|
finding lands beside it). The gate's completion is what unblocks
|
|
wave 7's decomposition.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Every gate check above read and verified against the cited ADR
|
|
text (not from memory of it)
|
|
- [ ] Named design points each decided, recorded, and consistent with
|
|
the specs
|
|
- [ ] Findings fixed inline or recorded as wave-7 amendments with
|
|
owners
|
|
- [ ] All gates re-run green after any fixes — including
|
|
`cargo doc --no-deps` explicitly (the PGLO-1 class)
|
|
- [ ] Wave 7 decomposition unblocked (recorded in this task's Summary)
|
|
|
|
## References
|
|
|
|
- docs/plans/implementation.md (§Wave 6, §Review gates — the fleet
|
|
gate)
|
|
- docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md
|
|
§2/§3
|
|
- docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md §2/§4
|
|
- docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md §1–§6
|
|
- docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §2
|
|
- docs/architecture/store-api.md (§Invariants 4 — the fleet form)
|
|
- docs/architecture/backends-and-dispatch.md (the composite
|
|
fleet-validity rule)
|
|
- tasks/review-wave-4.md, tasks/review-wave-5.md (the gate method;
|
|
the amendments A1/A2 this gate audits closed)
|
|
- tasks/store-fleet-construction.md, tasks/store-fleet-put.md,
|
|
tasks/store-fleet-sweep.md, tasks/engine-pg-lo-joint.md,
|
|
tasks/suite-column-fleet.md (the wave's tasks)
|
|
|
|
## Notes
|
|
|
|
> To be filled by implementation agent
|
|
|
|
## Summary
|
|
|
|
> To be filled on completion |