- Under fleet: true, puts route through the joint entry+pin tx
(store-fleet-put): kv tier via begin_joint_tx -> joint_put (CAS; a
dedup re-put commits the pin row alone, upsert-renewing
(key, owner)) -> pin_commit — entry + pin row in one step, verified
against an independent connection; large = pg-lo rides the one-tx
consolidation form (known- and unknown-length; the 512 KiB knee,
the empty-contribution re-put form, read-your-own-writes
derivation); large = local on declared shared media is
pin-first, publish-second (the row-only joint tx, then the staged
commit-rename; the orphan-pin crash window is the expiry
machinery's).
- Amendment A1 landed: catch-propagate-terminate — every error path
between begin_joint_tx and pin_commit terminates the held tx before
propagating (no mid-flight PgJointTx returns dirty to the pool,
PG-2); tested with a forced mid-driver failure (zero residue, the
pool's idle-in-transaction count zero, a follow-up put clean).
- The pin guard's fleet form: the returned guard carries the row's
TTL/3 renewal duty — a per-guard tokio task (spawned at the row's
durability), silent on Err, ended by the never-resurrect
Ok(false), aborted at every guard-life boundary (drop, batch
contribution, conversion); PinRenewal gated feature postgres.
- KvEngine::Postgres holds Arc<PostgresBackend> so detached renewal
tasks share the fleet host's engine; tokio gains the time feature
for the cadence.
- Non-fleet put paths byte-unchanged (all existing suites green); a
non-fleet test pins that no pin rows are ever committed.
- Tests: new postgres_fleet_put_tests (fresh schema + SchemaJanitor;
kv joint atomicity both-or-neither, forced pin_commit failure,
renewal cadence/drop/conversion stop, never-resurrect, batch
release ends renewals, dedup upsert-renewal + by-row composition,
local pin-first success + forced-failure forms, non-fleet
non-event) and postgres_pglo_fleet_put_tests (fresh db +
DatabaseJanitor; the A1 pg-lo failure form, the consolidation
round-trip through the public put). Env-driven, skipping cleanly
server-less.
Verified: cargo test (default) green; --features postgres and --features
"postgres,pg-lo" green server-less (skipping) and against the harness
server (pglo-poc, :15432); --all-features green live; pg-pure and
mem,pg-lo pure builds green; clippy -D warnings green (all combos);
cargo fmt --check green; cargo doc --no-deps clean (default; the gated
builds' pre-existing warnings unchanged). Schema/db residue 0.
glm-5.3-flash
950af9ab0d