- sqlite scheduler tick: a failed COMMIT (or ROLLBACK) left the connection
released with a stuck-open transaction, wedging the writer slot forever —
the one commit site missing the drop-+-reopen-replenish arm; tick now
takes the conn by value with a poisoned disposition (drop + replenish),
the commit-fault seam reaches the tick, and
failed_tick_commit_replenishes_the_writer_slot pins the arm
- pg save_offset_tx stored GREATEST($3,0) where the wave-8 gate's
negative-seed fix (raw seed, ADR-023 §2 2026-10-11 annotation) covered
only the auto-commit form; mem's merged in-tx read clamped a staged
negative seed against a phantom zero; both fixed and the tx-form
totality pinned by a new stamped suite leg (in_tx_reads_see_own_writes)
green on all three columns vs the live harness server
- pg: a failed forwarder register leaked the channel refcount forever
(no receiver to drop it) — listen/spawn_bridge now unregister on the
register error, mirroring the subscribe-failure arm; register doc
corrected to put the failure disposition at the call site
- pg forwarder: nine poisoned-mutex expect() panics converted to the
mem crate's into_inner recovery idiom (no-expect-outside-tests rule)
- core encode_payload: a deeply-nested Value aborted the process in
serde_json's unguarded serializer recursion and the fuzz pin blessed
storing bytes no decoder could read back; encode now rejects nesting
past 127 containers (the empirically-verified decode limit) with typed
Codec — decode-aligned boundary pins added to the fuzz invariant and
value_type_tests, applied pre-publish within the open class-1 window
- scheduler sleep deadlines: Instant + Duration overflow caps (MAX_SLEEP_S,
tick-and-resleep) on all three engines for far-future boundaries;
sqlite tick claim stamp now saturating_add
- docs read true again: Error::Closed scope (stream try_recv arm),
validation whitespace wording, sqlite lib.rs phantom durability knobs,
pg lock.rs honest autocommit wording, mem tx/stream merge + wake-
granularity wording; wakes.rs stale allow(dead_code) removed
- tests: value_type_tests exercised its own map_err instead of the
function under test (fixed); unwrap_or_default reference encodes
panic with cause
- docs/reviews/004-pre-release-general-review.md records nine fixed +
sixteen parked findings (sqlite seam panic-safety armor, watcher
post-death-subscribe hang + initial-stat self-kill, pg forwarder
TOCTOU/hang/diagnosability, pg BIGINT server-side stamp overflow, mem
growth/outbox notes, pg identifier-truncation doc note, smaller) and
two false positives caught on verification; implementation.md
review-rounds entry + core-contract backlog rows updated
- gates: build, workspace tests (sqlite 194, core 27, suite legs new),
full live pg column 127+25+9, clippy -D warnings, fmt, fuzz replay
6/6, wasm32 check, doc gate -D warnings — all green
- forwarder.rs's ListenerConnection doc corrected: NoTls is hardwired on
every connection path (pooled, listener, reconnect) — the pooled path
never rode the consumer's Config sslmode (a sslmode=require DSN fails
at connect); grep-audited no other in-crate doc repeats the claim
- PgOpts doc carries the corrected one-line TLS pointer (engine-crate-
docs posture, ADR-016 §2)
- deployment.md: new 'TLS posture (v1)' subsection (NoTls everywhere,
sslmode=require DSN fails at connect, topology-level confidentiality
is the v1 substitute, TLS a post-v1 deployment concern) and a new
'Consumer-obligation notes on engine options' section carrying the
QueueOpts trusted-as-given note with code-verified per-field symptoms
(max_attempts <= 0: never claimed, dead-lettered at the next claim
call's pre-claim sweep; negative visibility: instantly-reclaimable
claims; negative retention: every dead row at the next sweep_expired)
plus the PgOpts::max_size 0-guard counter-case; frontmatter advanced
- alkstore/src/opts.rs: QueueOpts struct doc mirrors the
consumer-obligation note (ADR-023 §2 scoping: the domain table covers
trait-surface arguments, not consumer-constructed constants)
- cross-file doc sweep over the fix batch's touched files (forwarder,
tx, scheduler, store) found no further doc-behavior mismatch
- gates: cargo build / clippy --all-targets -D warnings / fmt --check
all green (doc-only, no test touched)
Task core-engine-value-constructors (wave-3 pre-work). All four value
types are #[non_exhaustive] (ADR-017 §3), so downstream engine crates
cannot struct-literal-construct them (E0639). Give engines a sanctioned
construction path without weakening the consumer posture: pub
#[doc(hidden)] full-field constructors (Job::from_row, StreamEvent::
from_row, Schedule::new, Wake::new), each doc-commented as engine-
construction-only — not contract surface, not covered by ADR-017's
semver-minor field-addition promise; a field addition changes the
signature and is a lockstep-duty event (ADR-017 §5). Core tests now
construct through the new constructors; no behavior change.
glm-5.3-flash