- Three `_fleet` twin constructors slot the explicit `fleet: true`
declaration in without reshaping the fleet-capable constructors;
every pre-existing constructor stays implicitly `fleet: false` with
byte-unchanged behavior (the recorded non-event landed as recorded):
`kv_only_postgres_fleet` (the re-routing client posture, large =
none), `dual_tier_postgres_local_fleet` (the shared-media posture),
`dual_tier_postgres_pglo_fleet` (the consolidation posture).
- The composite fleet-validity predicate (`fleet_validity_error`) is
one function, one sentence, both tiers, run at the constructor keyed
off the engine representation: kv = postgres AND (pg-lo on the same
pg instance OR local on declared shared media OR none). The
structural clauses (mem never, sqlite never, local needs the
declaration) are enforced by the constructor set's shape and tested
per clause at the predicate level; the pg-lo same-instance clause is
the runtime arm: `pg_control_system().system_identifier` compared
across one pooled connection per engine — mismatch or failed probe
is a constructor error, never a silent pass.
- The named design points decided and recorded: the shared-media
assertion is a sealed dedicated type (`FleetSharedMedia::asserted()`,
never a bare flag); the pin TTL is a fleet constructor parameter
(default `DEFAULT_PIN_TTL` 60 s, `Duration::ZERO` rejected at entry)
wired through `PostgresBackend::new_with_pin_ttl` to the renewal
body (proven against the live server); the owner id mints 32 raw
bytes at construction (SHA-256 fold over pid/nanos/instance
counter/ASLR anchor), stable per instance, crate-internal.
- The store carries its fleet state (`FleetState`: the declaration
flag, the TTL, the owner id) — crate-internal (fleet parameters,
not API); the one-window-host posture verified intact under fleet
(kv host's both-tables GC schema, pg-lo window clauses dormant, the
form branch keyed off the engine representation), and the
declaration turns nothing else on yet (put/sweep run the non-fleet
machinery until the driver tasks).
- Constructor docs updated to the landed state (module doc's
fleet-declaration paragraph, the three non-fleet recordings, the
scope notes, gc.rs/postgres.rs/pg_lo.rs wave-6 notes); `cargo doc
--no-deps` clean in the default build.
Verification: cargo test (default) green; --features postgres and
--features "postgres,pg-lo" green server-less (skipping cleanly) and
against the harness server (pglo-poc, :15432 — verified live 2026-
10-12); --all-features green; clippy -D warnings green (default +
postgres + postgres,pg-lo + all-features); cargo fmt --check green;
cargo doc --no-deps clean.
glm-5.3-flash
b6b353242b