alkblobs/tasks/review-wave-8.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-wave-8	Wave 8 review gate — the split gate	completed	mem-default-on split-store split-ops split-postgres-pg-lo review001-hygiene	narrow	low	phase	review	wave-8 review review-001

Description

The wave-8 review gate (docs/plans/implementation.md §Review gates — the split gate), before wave 9's correctness round decomposes. The wave's whole claim is pure moves plus named resolutions — the gate audits exactly that claim, then the standard matrix.

Gate checks:

• The pure-move audit — each split diff (store, ops, postgres, pg_lo) verified as moved code plus the task's named resolution(s) and nothing else: diff move-rename settings on, the moved regions spot-read against the old git blob, any non-move hunk traced to the D-3/dead-code/hygiene resolutions or noted as a violation.
• The public surface does not move — lib.rs's re-export set byte-identical; cargo doc public-item listing diffed (or the equivalent audit) pre/post split; no visibility widened or narrowed by the moves; crate-internal seams kept crate-internal (e.g. the ops-renewal seam's pub(crate) shape survives the split).
• Behavior neutral — no intended behavior change: the full matrices green (below); the conformance columns' row counts and stamps unchanged; the e2e tree green on the new module shapes.
• Feature integrity — the default build compiles the ops directory out and its dependency tree is unchanged; pg-lo without postgres compiles; the pg-pure builds (postgres-only; postgres+pg-lo) check clean; mem default-on per tasks/mem-default-on.md with the ADR-013 §4 amendment and the AGENTS matrix landed.
• D-3 verdict — resolved by route-through or delete, the surviving docs tell the truth, the chosen point recorded.
• Dead-code allow inventory — no blanket #![allow(dead_code)] remains in the split modules; and the inventory is crate-wide per the plan's clause: every allowance that remains anywhere (the non-split modules' — gc.rs, backend.rs, local.rs, sqlite.rs — and the conformance harness's) is scoped to named items with their consumer recorded, or flagged.
• D-5 hygiene landed — from_parts asserted, the tautological test gone; the hex clause retracted (a runtime dependency — the correction recorded on review-001 D-5 and the plan's wave-8 bullet; no dependency-graph change from the hygiene task).
• Review-001 stamped — docs/reviews/001-storage-surface-general- review.md's frontmatter gains the dated note: its file:line references predate the wave-8 split; findings are located in the review's quoted code, not the post-split tree.
• Statuses updated — the plan's wave table rows and the task files' statuses/summaries reflect what landed (the past gates' task-text hygiene discipline).
• Gates green: cargo test (default, now with the mem/local columns), cargo test --all-features server-less, cargo test --all-features against the live harness (the pg acceptance — the AGENTS matrix's shape), clippy --all-targets -- -D warnings across the feature variants (default, ops, all-features, pg-pure), cargo fmt --check, cargo doc --no-deps zero warnings on the default and ops builds.

Findings are fixed inline where cheap, or recorded as wave-9 amendments (the correctness round's decomposition reads them). The gate's completion unblocks wave 9's decomposition — which is gated additionally on OQ-12/OQ-13 resolving to ADRs.

Acceptance Criteria

• Every gate check above verified against the diffs (not from memory of the claims)
• The pure-move audit clean on all four splits; any exception noted and justified
• The public re-export + doc listing audit clean
• All gates re-run green after any fixes
• review-001 stamped; the plan table updated
• Wave 9 decomposition unblocked (recorded in this task's Summary; OQ-12/OQ-13 status named at that point)

References

• docs/plans/implementation.md (§Wave 8; §Review gates — the split gate; §Decided points 2026-10-14)
• docs/reviews/001-storage-surface-general-review.md (D-1/D-2/D-3/D-5 — the audited items; F-* untouched by design)
• docs/architecture/open-questions.md (OQ-12/13/14 — the decision track the next waves consume)
• docs/architecture/decisions/013-family-composition-reactive-boundary-and-feature-graph.md §4 (the amendment this gate verifies landed)
• tasks/split-store.md, tasks/split-ops.md, tasks/split-postgres-pg-lo.md, tasks/mem-default-on.md, tasks/review001-hygiene.md (the wave's tasks)
• tasks/review-wave-7.md (the gate method this follows)

Summary

Completed 2026-10-16. Every gate check was re-verified against the diffs and blobs (not from the tasks' claims). No violation of the split's charter was found; two findings were fixed inline, three pre-existing residuals are recorded as notes for the later waves' inventories.

The pure-move audit (all four splits, independently re-run) — script-based SequenceMatcher normalization audit of each old blob against the union of its new files (whitespace/visibility-normalized), plus targeted byte-diffs of every flagged region. Store: 61 unmatched old lines / ~345 insertions across 8 new files; ops: 86 / distributed; postgres: 96; pg_lo: 102. Every hunk resolved to the recorded classes: per-file import/cfg-gated import headers, module doc rewrites (the layout sections, the allow-paragraph rewrites, intra-doc-link qualification), the blanket #![allow(dead_code)] removals, the D-3 route-through hunks, block-boundary brace lines, the dedent for the top-level test files, and compiler-demanded visibility lifts (pub(crate)/pub(super) only — never pub). Two single-line oddities (StoreMode's enum, store_internal_error, the ops token-parse test lines) were byte-diffed against their new homes: identical — audit-tool alignment artifacts, not edits. Spot-verified byte-identical: PgLoStaging, put_joint_staged, PgJointTx::client, read_windows, new_schemaless/table_exists (the latter two with their recorded doc-trim + pub(crate) lift to the testing modules). The noted key_for deletion re-verified zero callers at baseline. D-3's route-through re-read behaviorally: the enums' methods forward to the old twin bodies verbatim (LargeEngine::Local → Ok(()) matches the old _ arm); the dispatch is one, the docs tell the truth, the point is recorded.

The public surface — lib.rs byte-unchanged across all four split commits (git diff empty 7aac940..HEAD on it); an item-declaration visibility diff of every new file against its old blob: no item that was not fully pub before is fully pub now (all four splits clean); the lifts are crate-internal only.

Behavior neutral — tests/ untouched by the whole wave (the conformance suite's rows/stamps unchanged by construction); src/'s non-split modules untouched except the hygiene task's two (error.rs/hashing.rs, verified). Gates re-run at the gate (see below).

D-5 hygiene — verified landed: the from_parts debug-assert is in src/hashing.rs (its doc tells the truth), the tautological test is gone from error.rs, hex untouched in [dependencies] (the retraction's consequence).

Dead-code allow inventory (crate-wide) — the split modules carry no blanket allow: every surviving allowance in store/, ops/, postgres/, pg_lo/ is a per-item #[allow(dead_code)] (16 + 5 + 2 + 3 respectively) with its consumer recorded in the adjacent doc/comment. The non-split file-level blankets (local.rs, sqlite.rs, gc.rs, backend.rs) and the conformance harness's are documented posture text naming their cover sets (pre-existing, outside wave 8; the two pg engines' rewritten paragraphs describe the new scoped inventory). Recorded for a later docs pass: these file-level allows could be narrowed per-item, but their scope is honestly written.

Inline findings fixed at the gate (2):

1. The recurring fleet-renewal e2e flake — ops::tests::the_paused_fleet_token_expires_reaps_and_the_reput_ backstop_never_loses_silently failed once in the gate's live --all-features run (observed twice more across the wave-8 task sessions — the "watch it at the wave gate" flag from split-postgres-pg-lo). Root class: the renewal outcome folds closed on any error by design (RenewalOutcome::Expired on Err(_) — ops/tokens.rs's decided composition), and under a parallel full-suite run against the shared harness server a transient pool error folded the fresh, just-asserted-live row's probe into present: false. The tail assert now re-asks within the TTL cadence (five attempts, 100 ms apart) before the closed answer counts — test-robustness only, zero shipped-behavior change; the closed-degradation posture itself is reviewed as correct and stays (wave 9's D-2 error-arm work reads this finding).
2. Three unresolved intra-doc links in the split module docs (ops/mod.rs x2, ops/specs.rs x1) — the split-ops session's "cargo doc zero warnings (ops build)" claim was inaccurate; the links resolved in the old flat file's scope and broke with the move (verified present at 8c186f8). Qualified to full paths; cargo doc --no-deps zero warnings on both the default and ops builds now.

Recorded residuals (pre-existing, not wave-8 regressions — for the inventories of the waves that own them):

• cargo clippy --no-default-features --features pg-lo (a large engine with no kv engine at all) fails with the empty engine-enum exhaustiveness errors (E0004 x11 lib / x6 more test targets) — byte-identical at the pre-wave-8 baseline (96146b6). The ADR-010 §1's named shape (--features pg-lo over defaults, and --no-default-features --features "postgres,pg-lo"/"mem,pg-lo") compiles clean under -D warnings; the no-kv shape joins wave 12's feature-graph verification inventory.
• cargo doc --no-deps --all-features carries ~38 pre-existing pg_lo doc-link warnings (noted 40 → 38 by the split tasks; wave 12 owns the crate-docs pass).
• The non-split file-level blankets above could be narrowed per-item (the standing hygiene block's discipline) — noted, not wave 8's charter.

Gates re-run green at the gate (final numbers) — cargo test default 127+54+4 (the mem reference + local columns run plain); the live-harness cargo test --all-features with ALKBLOBS_PG_* (pglo-poc, postgres:16-alpine :15432) 270+125+4 — the pg columns ran for real; cargo test --all-features server-less skips cleanly, green; cargo clippy --all-targets -- -D warnings green across default, ops, all-features, and the pg-pure shapes (postgres; postgres,pg-lo; mem,pg-lo; pg-lo over defaults); cargo fmt --check clean; cargo doc --no-deps zero warnings (default + ops). The mem-default-on dependency-tree invariant re-verified against the pre-flip baseline (80e5bd6): the cargo tree dependency set is unchanged (only fresh-lockfile version pins differ in the throwaway baseline worktree — an artifact of reproduction, not of the flip).

Statuses updated — review-001's frontmatter gains the dated split stamp (its file:line references predate the split; findings are located in the quoted code); the plan's wave-8 row reads completed; all five wave-8 task files are completed with summaries.

Wave 9 decomposition unblocked — its additional gate (OQ-12/OQ-13 resolving to ADRs) is satisfied: both are resolved since 2026-10-15 (ADR-015 fsync-durable publish; ADR-016 the orphan_reap_permitted constructor declaration; OQ-14's ADR-017 similarly, gating wave 10). The open-questions index carries no active OQs. Wave 9's decomposition reads this task's two inline fixes and the recorded residuals; the renewal fold's closed-on-error posture is the reviewed-correct backdrop for its D-2 error-arm work.