- sqlite scheduler tick: a failed COMMIT (or ROLLBACK) left the connection
released with a stuck-open transaction, wedging the writer slot forever —
the one commit site missing the drop-+-reopen-replenish arm; tick now
takes the conn by value with a poisoned disposition (drop + replenish),
the commit-fault seam reaches the tick, and
failed_tick_commit_replenishes_the_writer_slot pins the arm
- pg save_offset_tx stored GREATEST($3,0) where the wave-8 gate's
negative-seed fix (raw seed, ADR-023 §2 2026-10-11 annotation) covered
only the auto-commit form; mem's merged in-tx read clamped a staged
negative seed against a phantom zero; both fixed and the tx-form
totality pinned by a new stamped suite leg (in_tx_reads_see_own_writes)
green on all three columns vs the live harness server
- pg: a failed forwarder register leaked the channel refcount forever
(no receiver to drop it) — listen/spawn_bridge now unregister on the
register error, mirroring the subscribe-failure arm; register doc
corrected to put the failure disposition at the call site
- pg forwarder: nine poisoned-mutex expect() panics converted to the
mem crate's into_inner recovery idiom (no-expect-outside-tests rule)
- core encode_payload: a deeply-nested Value aborted the process in
serde_json's unguarded serializer recursion and the fuzz pin blessed
storing bytes no decoder could read back; encode now rejects nesting
past 127 containers (the empirically-verified decode limit) with typed
Codec — decode-aligned boundary pins added to the fuzz invariant and
value_type_tests, applied pre-publish within the open class-1 window
- scheduler sleep deadlines: Instant + Duration overflow caps (MAX_SLEEP_S,
tick-and-resleep) on all three engines for far-future boundaries;
sqlite tick claim stamp now saturating_add
- docs read true again: Error::Closed scope (stream try_recv arm),
validation whitespace wording, sqlite lib.rs phantom durability knobs,
pg lock.rs honest autocommit wording, mem tx/stream merge + wake-
granularity wording; wakes.rs stale allow(dead_code) removed
- tests: value_type_tests exercised its own map_err instead of the
function under test (fixed); unwrap_or_default reference encodes
panic with cause
- docs/reviews/004-pre-release-general-review.md records nine fixed +
sixteen parked findings (sqlite seam panic-safety armor, watcher
post-death-subscribe hang + initial-stat self-kill, pg forwarder
TOCTOU/hang/diagnosability, pg BIGINT server-side stamp overflow, mem
growth/outbox notes, pg identifier-truncation doc note, smaller) and
two false positives caught on verification; implementation.md
review-rounds entry + core-contract backlog rows updated
- gates: build, workspace tests (sqlite 194, core 27, suite legs new),
full live pg column 127+25+9, clippy -D warnings, fmt, fuzz replay
6/6, wasm32 check, doc gate -D warnings — all green
Sweep of docs/reviews/ and tasks/ per the plan's §Wave 8 historical
note: 'wave 7'-means-release-pass references annotated or reworded
per the review-wave-5.md renumber-annotation precedent; genuine
fuzzing-wave/review-7 references untouched. Out-of-scope
architecture-doc trail records documented in the task's Notes.
12 annotated, 1 reworded (live pointer); taskgraph validate green.
Row-first gate: consumer-inventory.md gains an engine-tier section — the mem-engine need recorded operator-authority, dated 2026-10-10 (wasm32 sandboxing across the alk protocol family + downstream ffi/napi/python-adapter economics; rusqlite/tokio-postgres structurally out on wasm, so mem is the only triad member the sandbox can carry).
ADR-024 (decisions/024-mem-engine.md) pins the decision set: (1) separate `alkstore-mem` crate — discharges and amends ADR-001 §4 (superseded in part: full contract-v1 engine, not an "implementation convenience"; annotation on ADR-001 §4 + Status, class-1 window still open); (2) honest-ephemeral posture — no durability, single-process, ephemeral by design, never fleet-valid (ADR-010 §3's shared-pool predicate fails structurally), riding ADR-016's carriers unchanged (identity + docs + matrix); (3) full contract v1 tier with the asymmetry classification — `PayloadTooLarge` never produced (SQLite arm), no reconnection concept (reconnect-wake/watcher rows absent from mem's per-engine column), receiver close at engine drop, wake coalescing N/A; (4) `MemStore::new()` engine-native constructor — the one documented exception to the open-prose, core-contract.md Store concept amended; shared-instance (two opens → one engine) rejected with the ADR-016 §4-style re-entry gate (consumer-inventory row), register stays closed; (5) wasm32 — compile-clean for wasm32-unknown-unknown plus the suite's mem column green on host under a current-thread runtime flavor are wave-6 acceptance items; on-target suite execution scoped out with a named collapse condition (wasm-bindgen-test adapter crate) — a scope decision, not a pending-client hedge; (6) mem is not a core dev-dependency — core's doc examples stay mock-based, ADR-001 §4's doctest posture declines.
engine-mem.md (draft): the in-process mapping — guarded per-mechanism state (no pool, no schema bootstrap, no forwarder, no spawn_blocking seam), the tx overlay (staged *_tx effects merged atomically at commit; read-your-own-writes easy, drop-=-rollback trivial; wake-at-commit structural — the seam pg needed pg-fix-tx-wake for, mem pins from birth via the existing tx-commit-atomicity rows), ADR-012 §2 third owner of the curve/opts/@every arithmetic (three-way equivalence, ADR-022's StoreFactory reused verbatim — born pinned).
deployment.md: host-semantics row (single-process, ephemeral, never fleet-valid, wasm32-clean), mem connection-budget subsection (none — nothing to budget), durability-knobs row (the honest row is the absence), toolchain row (wasm32 subset + current-thread-clean, acceptance-cited). README/overview: engine-mem.md row, ADR-024 row, family table entry (alkstore-mem, no driver deps), current-state updated to the implementation phase with engine specs' stable statuses reflected.
implementation.md: wave table gains wave 6 (mem engine, depends waves 1 + 5) and renumbers release readiness to wave 7 (fuzzing decision — the one remaining decided-at-implementation deferral — rides wave 7); wave-6 section records the born-pinned posture, acceptance items, the one suite-harness pre-task (past_stamp_sleep blocking sleep → async sleep, review 003's properties.rs:1683 note), and the window riders (review 003 Finding 1: the pg transient-fault seam, MEDIUM, rides wave 6; Findings 2–3 follow their park into wave 7's pre-release); wave-6 review gate defined; Decided points updated (mem discharged, fuzzing renumbered); stale wave-6 references swept across review docs and the landed tasks' notes (release-readiness items renumbered or annotated).
Docs-only change; verified by cross-reference audit (all ADR/OQ/anchor references resolve, residual wave-6 mentions are correct under the new numbering or carry dated annotations).
glm-5.3-flash