0 Fork 0

Files

T

glm-5.3-flash 22f25ffafd sqlite: panic-safety armor for the auto-commit seams (review 004 item 1)

with_writer/with_reader/blocking_read release their slot/pool
connection only on the normal return — a panic inside the closure
wedged the single writer slot forever (Writer::acquire waits on a
condvar) and permanently shrank the reader pool (outstanding never
decremented on abandonment). The seams now ride RAII drop-guards
(ConnLease's idiom): the normal arm defuses and releases unchanged;
the unwind arm drops the unknown-state connection and takes the
established abandonment dispositions — Writer::replenish() (the tick's
poisoned arm as a substrate method, the writer now holding its path)
and Readers::abandon() (outstanding decrement + pool-locked notify).
Three panic-injection tests pin the properties; no reachable panic
path exists in production — this is the defense-in-depth armor the
review scoped. Task: sqlite-fix-seam-panic-safety.

2026-10-11 09:55:45 +00:00

src

sqlite: panic-safety armor for the auto-commit seams (review 004 item 1)

2026-10-11 09:55:45 +00:00

tests

Contract-suite rows (task suite-opts-backoff-rows): the backoff-curve equivalence row and the deferred enqueue-opts clock legs. backoff_curve_equivalence — the equal-jitter exponential pinned as the range, not a jitter label (ADR-010 §3): claim → retry(err, None) cycles on a backoff_base_s = 2 queue land the ranges [1,2], [2,4], [4,8] across attempts 1–3, each computed delay read back through get_job's resolved run_at minus a clock read taken before the retry — the lower bound race-free (the retry's internal clock read cannot precede the suite's, so the observed value over-reads the delay, never under-reads) and the upper bound carrying a one-second straddle tolerance for the integer-second stamp crossing a wall second; identical bounds on both engines is the equivalence pin (ADR-012 §2, the row body shared). The explicit-delay override legs ride the same row: retry(err, Some(5)) honored verbatim ([5, 6] under the same straddle tolerance) and retry(err, Some(0)) resolving ready-now per the boundary-total rule (ADR-023 §2), claimed within a bounded wait. enqueue_opts_resolution extended in place with the wave-5 legs its deferral note named — the run_at-alone literal leg (a future run_at is the row's ready time verbatim, a deterministic equality with no clock read involved; a past run_at stores the literal too and is claimable now through the run_at <= now predicate within a bounded wait, the run_at-ASC ordering making the observation unambiguous among the row's other legs) and the neither-field leg (ready at the enqueue instant, abs_diff(now) <= 5 tolerance-bounded proximity, never a tight timing assert); the deferral note replaced by the completion statement, ADR-023 §2 stamp accumulated per the convention (ADR-020 §1 governs the resolutions). Cap-leg disposition recorded in Notes for the review gate: the 1-hour cap is not suite-pinnable (capped attempts need minute-scale waits) and stays pinned engine-side on both engines' unit tests per the wave-3/4 reviews. Ready-now waits are bounded claim_one poll loops (deadline asserts only, sequential single-store drive), with the one draft defect the finding surfaced (a re-claim after the bounded wait consumed nothing; the helper returns the claimed handle) noted. Wired into both engines' suite targets (SQLite tokio test, pg harness_row!), 25 rows per column up from 24. Verified: SQLite column green server-less (25/25 suite, 189 lib), pg column green vs harness (postgres/poc@:15432 — 25/25 suite, 121 lib + 9 schema), 3 solo re-runs of each new/extended row per engine (determinism), server-less pg skips cleanly via the reachability gate, cargo test -p alkstore-sqlite -p alkstore-postgres green, clippy -D warnings, fmt clean

2026-10-10 07:26:55 +00:00

Cargo.toml

release-publish-prep: license texts ride each package — LICENSE-MIT/LICENSE-APACHE copies in the four published crate dirs (cargo's auto-detect packages them; workspace-inherited license-files is a packaging no-op on cargo 1.99, reverted); the sqlite substrate's bundled in-src notice stays per ADR-018

2026-10-11 08:05:09 +00:00

LICENSE-APACHE

2026-10-11 08:05:09 +00:00

LICENSE-MIT

2026-10-11 08:05:09 +00:00

README.md

release-readme: the root README written last, honestly — crate family table with per-engine honest postures (ADR-016 compile-time identity, deployment.md as the boundary), mem-carried usage sketch compile-checked and executed against the real API, contract-suite pointer (three engines, one pinned contract), license note; LICENSE-MIT + LICENSE-APACHE per the family pattern (substrate notice untouched per ADR-018); CHANGELOG seeded with the 0.1.0 contract-v1 entry; per-crate readme wiring decided + landed (pointer-style per-crate readmes, readme fields wired on the four published crates); honesty trace list in task Notes; task -> completed

2026-10-11 01:32:33 +00:00

README.md

alkstore-sqlite

The SQLite engine of the alkstore family: the core contract implemented on rusqlite over the forked honker-core substrate carried in-tree.

let store = alkstore_sqlite::open("store.db", alkstore_sqlite::SqliteOpts::default())?;

Engine posture — single-host, file-backed. Cross-process on one host is verified territory; a .db on network storage (NFS two-writers) is not a supportable deployment posture. Durability knobs, pool sizing, and the watcher cadence are engine-configuration concerns on SqliteOpts — synchronous = NORMAL is hardwired at connection bootstrap; there is no consumer surface to raise the sync level.

See the family README for the interface and the deployment matrix, and the SQLite engine spec for the substrate's details. The substrate (forked third-party code) ships with its own bundled license notice in the crate tree — the root dual license files do not replace it.