Review 004 item 15: the unsafe { ctx.get_connection() } UDF blocks
carried no SAFETY justification. Added the concrete soundness
invariant at all ten sites (the eight attach_alkstore_functions
registrations, the notify registration, the test-module savepoint
probe — same class) and registered the comment-only change as
PROVENANCE delta D-40 per ADR-012 §3's diff-fidelity posture.
Task: sqlite-substrate-safety-comments
with_writer/with_reader/blocking_read release their slot/pool
connection only on the normal return — a panic inside the closure
wedged the single writer slot forever (Writer::acquire waits on a
condvar) and permanently shrank the reader pool (outstanding never
decremented on abandonment). The seams now ride RAII drop-guards
(ConnLease's idiom): the normal arm defuses and releases unchanged;
the unwind arm drops the unknown-state connection and takes the
established abandonment dispositions — Writer::replenish() (the tick's
poisoned arm as a substrate method, the writer now holding its path)
and Readers::abandon() (outstanding decrement + pool-locked notify).
Three panic-injection tests pin the properties; no reachable panic
path exists in production — this is the defense-in-depth armor the
review scoped. Task: sqlite-fix-seam-panic-safety.
- sqlite scheduler tick: a failed COMMIT (or ROLLBACK) left the connection
released with a stuck-open transaction, wedging the writer slot forever —
the one commit site missing the drop-+-reopen-replenish arm; tick now
takes the conn by value with a poisoned disposition (drop + replenish),
the commit-fault seam reaches the tick, and
failed_tick_commit_replenishes_the_writer_slot pins the arm
- pg save_offset_tx stored GREATEST($3,0) where the wave-8 gate's
negative-seed fix (raw seed, ADR-023 §2 2026-10-11 annotation) covered
only the auto-commit form; mem's merged in-tx read clamped a staged
negative seed against a phantom zero; both fixed and the tx-form
totality pinned by a new stamped suite leg (in_tx_reads_see_own_writes)
green on all three columns vs the live harness server
- pg: a failed forwarder register leaked the channel refcount forever
(no receiver to drop it) — listen/spawn_bridge now unregister on the
register error, mirroring the subscribe-failure arm; register doc
corrected to put the failure disposition at the call site
- pg forwarder: nine poisoned-mutex expect() panics converted to the
mem crate's into_inner recovery idiom (no-expect-outside-tests rule)
- core encode_payload: a deeply-nested Value aborted the process in
serde_json's unguarded serializer recursion and the fuzz pin blessed
storing bytes no decoder could read back; encode now rejects nesting
past 127 containers (the empirically-verified decode limit) with typed
Codec — decode-aligned boundary pins added to the fuzz invariant and
value_type_tests, applied pre-publish within the open class-1 window
- scheduler sleep deadlines: Instant + Duration overflow caps (MAX_SLEEP_S,
tick-and-resleep) on all three engines for far-future boundaries;
sqlite tick claim stamp now saturating_add
- docs read true again: Error::Closed scope (stream try_recv arm),
validation whitespace wording, sqlite lib.rs phantom durability knobs,
pg lock.rs honest autocommit wording, mem tx/stream merge + wake-
granularity wording; wakes.rs stale allow(dead_code) removed
- tests: value_type_tests exercised its own map_err instead of the
function under test (fixed); unwrap_or_default reference encodes
panic with cause
- docs/reviews/004-pre-release-general-review.md records nine fixed +
sixteen parked findings (sqlite seam panic-safety armor, watcher
post-death-subscribe hang + initial-stat self-kill, pg forwarder
TOCTOU/hang/diagnosability, pg BIGINT server-side stamp overflow, mem
growth/outbox notes, pg identifier-truncation doc note, smaller) and
two false positives caught on verification; implementation.md
review-rounds entry + core-contract backlog rows updated
- gates: build, workspace tests (sqlite 194, core 27, suite legs new),
full live pg column 127+25+9, clippy -D warnings, fmt, fuzz replay
6/6, wasm32 check, doc gate -D warnings — all green
Finding 2(a) landed: a one-shot cfg(test) generation-top LISTEN-pause
seam on the pg forwarder (listen_pause in seam.rs) lets the LISTEN-window
death test kill the fresh reconnect generation's backend before its
snapshot LISTEN — the LISTEN then fails honestly (57P01 terminating) and
the production fall-through arm (listen_ok == false) runs unmodified.
The harness test pins the honest mid-reconnect transient, full recovery
(wake, re-issue recovery of the refused mid-gap registration), and the
exactly-one-wake differentiator; a server-less unit pin covers the flag.
Finding 2(b) + the defensive arms stay parked with the code-read as pin,
recorded in the task file with current line refs.
Finding 3 landed: the rollback_fault seam (commit-fault mechanics) feeds
SQLITE_FULL-shaped errors into both ROLLBACK failure drop paths —
SqliteTxHandle::drop and the cancelled op's ConnLease::drop — exercised
in one test (phases: open-handle drop; single-poll-then-drop mid-op
cancellation), pinning slot replenish via reopen, no ghosts, and the
store staying usable.
- Remove the wave-2 lint suppressions from substrate/mod.rs; the
six genuinely dead surfaces the removal exposed are cut, not
suppressed, and registered D-32..D-36 in PROVENANCE.md
(arg_opt_i64, ops::now_unix, queue_next_claim_at,
Writer::try_acquire, UpdateWatcher::spawn,
SharedUpdateWatcher::new); test-observation items
(subscriber_count, the poll-interval default re-export) are
honestly #[cfg(test)]-gated
- Contract suite: eight new version-stamped backlog rows
(extent-clamp + boundary totality, duration-refusal,
encode_payload round-trip, PayloadTooLarge-never-produced SQLite
arm, drop=rollback no-ghosts, in-tx read-your-own-writes,
enqueue-opts resolution, receiver close/save arms)
- Fix the exemplar row's real-engine sequencing defect: the held tx
handle across the with_tx leg deadlocked any single-writer factory
(mock-invisible; ADR-007's parking is the pinned behavior)
- SQLite factory: SqliteFactory in the new tests/contract_suite.rs
target; all nine rows green against it; the factory contract
(isolation + idempotent teardown) pinned
- Engine lib docs: the single-host and writer-parking posture
statements surfaced under # Posture
- Gates: build/test/clippy -D warnings/fmt green; coverage 93.6%
lines, misses confined to error arms
glm-5.3-flash