alkblobs/tasks/review-wave-6.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-wave-6	Wave 6 review gate — the fleet gate	pending	suite-column-fleet	narrow	low	phase	review	wave-6 review

Description

The wave-6 review gate — the fleet gate (docs/plans/implementation.md §Review gates: "exact-count sweep outcomes under concurrency vs live postgres, the joint entry+pin tx atomicity, the sweep lease semantics vs ADR-013 §2, the composite fleet-validity predicate enforced at the constructor, kv-only put-time rejection"), before wave 7 decomposes. The gate reads the implementation against the pinned ADR text line by line (the wave-1..5 gates' method) — the documents, not memory.

Gate checks:

• Exact-count fleet sweep outcomes under concurrency vs live postgres: the fleet column green against the harness server (server-less runs skip cleanly — a skip never substitutes for acceptance); the two-instance survival shape, the lease-contention abort, the cross-instance arbitration refusal, the race across the window delay, and the maintenance-step reaping all exact-count asserted (INV-4's engine-gated fleet form).
• The joint entry+pin tx atomicity: through the public put (not only engine-level) — an independent connection never observes an entry without its pin row or the reverse; the A1 drop discipline audited as implemented (every path from begin_joint_tx onward terminates the tx — the wave-4 gate's amendment closed, its owner discharged); the pg-lo consolidation one-tx form (LO writes + companion row + pin row + commit in one tx; zero residue on failure); the large=local pin-first/publish-second ordering (the reverse ordering nowhere coded).
• The sweep lease semantics vs ADR-013 §2: one sweeper per pool across instances; atomic test-and-set; holdership ends at release/owner death/session loss; contention is the GcAbortCause::SweeperLock report abort (Ok(SweepReport), nothing deleted — ADR-012 §1), never an error.
• The composite fleet-validity predicate enforced at the constructor: every fleet-valid configuration constructs; every non-fleet-valid configuration is a constructor error (kv ≠ postgres, mem anywhere, local without the shared-media declaration, pg-lo cross-instance); the declaration is explicit, never inferred (ADR-012 §3); the same-instance probe's design audited (a failed probe errors closed).
• kv-only put-time rejection under the re-routing posture (ADR-012 §6.2's machinery, fleet edition).
• The TTL/3 renewal on the guard: the renewal lifecycle audited (no leaked tasks; drop/conversion/batch-contribution stops renewal; a failed renewal never resurrects an expired row — ADR-012 §2's expiry semantics verbatim); the TTL is a fleet constructor parameter (default 60 s), never API.
• The fleet liveness verb vs ADR-012 §6.6 / ADR-008 §2: the named table reference form; the schema-ownership rule (the store reads the embedder's table, never owns it); the protect callback's single-node-only posture recorded; the two-domain arbitration composition (in-process + SQL) decided and recorded.
• The one-window-host rule under fleet: every fleet-valid configuration's window hosts on the kv engine; the pg-lo window clauses dormant; the form branch keys off the engine representation, never a flag.
• The non-fleet postures unchanged: the in-process protocol verbatim under fleet: false regardless of engine — the wave-2/3/4/5 suites green untouched.
• Code-smell / hygiene sweep (the gate's standing hygiene block — the twice-bitten lesson is now an explicit check, not a hope):
  • cargo doc --no-deps zero warnings — the PGLO-1 class (public-module doc links resolving to crate-internal items) has bitten waves 4 and 5; the gate runs rustdoc and asserts clean, and de-links rather than exports.
  • The #![allow(dead_code)] scope notes match their remaining scope — the fleet family's note in src/gc.rs (its consumers land this wave) must shrink to its true remainder or vanish; the postgres/pg-lo notes likewise audited.
  • Stale forward references updated — every "wave 6" note in the module docs (store.rs's fleet-declaration paragraph, the constructors' "slots in without reshaping" recordings, pg_lo.rs's scope boundary, postgres.rs's scope note, the batch-delete helper's consumer note) reads the landed state.
  • Family conventions: no inline comments in code (doc comments on public API fine), thiserror, tokio-only async, no unwrap/expect outside tests, naming, one-module-per-file re-export shape, no blocking I/O on the async path.
  • Task-description correctness: each wave-6 task's Summary matches what actually landed (the gate reads the diffs against the task texts, not the Notes' claims alone).
• Gates green: cargo test (default), cargo test --features postgres (server-less: skipping), cargo test --features "postgres,pg-lo", cargo test --all-features (against the server), the pure builds (cargo check --no-default-features --features postgres and --features "postgres,pg-lo"), cargo clippy --all-targets -- -D warnings (default + the postgres/pg-lo variants + --all-features), cargo fmt --check, cargo doc --no-deps.

Findings are fixed inline where cheap, or recorded as wave-7 amendments where they shape the next decomposition (the ops wave's pin-token contract rides the fleet machinery — a renewal-surface finding lands beside it). The gate's completion is what unblocks wave 7's decomposition.

Acceptance Criteria

• Every gate check above read and verified against the cited ADR text (not from memory of it)
• Named design points each decided, recorded, and consistent with the specs
• Findings fixed inline or recorded as wave-7 amendments with owners
• All gates re-run green after any fixes — including cargo doc --no-deps explicitly (the PGLO-1 class)
• Wave 7 decomposition unblocked (recorded in this task's Summary)

References

• docs/plans/implementation.md (§Wave 6, §Review gates — the fleet gate)
• docs/architecture/decisions/008-trait-size-probe-fleet-gc-and-large-engines.md §2/§3
• docs/architecture/decisions/010-backend-io-seams-and-fleet-state-home.md §2/§4
• docs/architecture/decisions/012-pre-decomposition-consistency-rulings.md §1–§6
• docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §2
• docs/architecture/store-api.md (§Invariants 4 — the fleet form)
• docs/architecture/backends-and-dispatch.md (the composite fleet-validity rule)
• tasks/review-wave-4.md, tasks/review-wave-5.md (the gate method; the amendments A1/A2 this gate audits closed)
• tasks/store-fleet-construction.md, tasks/store-fleet-put.md, tasks/store-fleet-sweep.md, tasks/engine-pg-lo-joint.md, tasks/suite-column-fleet.md (the wave's tasks)

Notes

To be filled by implementation agent

Summary

To be filled on completion