The wave-5 deferred design point, landed: under the consolidation
posture (kv = postgres + large = pg-lo, same pg instance), a large
entry's content reaches the store-held joint transaction the pin row
commits in (ADR-012 §4's one-tx ruling).
- The contribution's API home (the named design point) — decided: the
joint staging-cursor variant. `PgLoBackend::put_joint_staged(&mut
PgJointTx)` hands `PgLoJointStaging<'_>`, the staged put with
inverted ownership: it borrows the held checkout, owns no checkout,
opens no tx, never COMMITs, never ROLLBACKs (the driver owns
termination, amendment A1) — no Drop, by design. The deciding facts:
the large tier's put contract is the streaming cursor, the fleet put
driver routes to the joint form as the non-fleet path routes to the
staged form, and the unknown-length derivation pass reads back
through the cursor's `ReadCursor` seam — none servable by a
whole-value method.
- The mechanics are the landed bodies re-homed: the 512 KiB
`lowrite` knee (LOWRITE_CHUNK aggregation of the store core's 64 KiB
windows), read-your-own-writes `lo_get` windows, the publish-time
CAS (the key resolves at publish — the staged put's named design
point), the companion-row insert, transactional LO creation (C6:
the LO lives and dies with the store-held tx). The re-put form
publishes an empty contribution — the staged LO unlinked inside the
store-held tx, zero residue; a concurrent CAS miss surfaces the
companion key's unique violation (the landed puts' posture).
- Enabling affordance: `PgJointTx::client()` — the crate-internal
statement surface every joint contribution (and the store-fleet-put
driver's A1 termination design) rides through; deliberately not an
abort verb.
- Crate-internal seam: the public trait surface untouched, nothing of
`EngineFleetState` on pg-lo (ADR-010 §2's correction), the
engine-level held-tx staging cursor and the non-fleet put path
byte-unchanged. Gated `feature = "postgres"`; both pg-lo pure
builds compile.
- Contract tests (`src/pg_lo.rs` mod joint, both engines on one
dedicated database): one-tx publish (kv row + LO + companion row +
pin row, byte-exact round-trips after `pin_commit`); forced failure
mid-contribution → driver ROLLBACK → zero residue (no LO pages, no
companion row, no pin row, no kv row); the CAS re-put form (empty
contribution, upsert renewal); the 512 KiB knee (multi-chunk).
Verification: `cargo test` (default) green; `--features
"pg-lo,postgres"` green server-less (skipping) and against the harness
server (pglo-poc, :15432 — the four joint tests + full pg_lo +
conformance suites live); `--all-features` green; clippy `-D warnings`
green (default / postgres / pg-lo+postgres / all-features / the two
pg-lo pure builds); `cargo fmt --check` green; `cargo doc --no-deps`
clean.
The store-core driver that calls the contribution on the fleet put
path is store-fleet-put.
glm-5.3-flash
76be7b0273