audit: track PostgreSQL, SDK, WASIX, extension, and tooling follow-ups

[f0rr0]

Purpose and scope

Track the complete engineering audit and its65 prioritized implementation/qualification tasks across native PostgreSQL, the C ABI, native Rust/JavaScript/Swift/Kotlin/React Native SDKs, single WASIX bindings/storage, concurrent WASIX Postmaster, all39 public extension integrations, tools, packaging and qualification. This issue transfers the design rationale, findings, evidence, limitations and task dependencies into the repository so implementation does not depend on a local audit checkout.

Audited baseline: e8192180bec4494c83bfa3adecbaa9b228b8f05d, fetched September7,2026 and still remote main when this issue was prepared September8,2026. No production changes were made by this audit. Repository source links in the supporting reports are pinned to that baseline. This issue is an umbrella engineering backlog; use focused PRs or linked child issues for implementation.

Relationship to work already underway

Read PR #202 and issue #201 before starting overlapping tasks. PR #202 is currently OPEN, head 8e45be7e281b5a1173a71c91cc11aea180b23d63, against the audited main. Its description reports substantial runtime correctness work and fresh tests that were not part of this audit. Those reports must not be relabelled as checks run by this review or as merged-main fixes.

Master items	Reported overlap in PR #202 / issue #201	How to use it
01 native fsync	Unconditional -F removed in the PR, with Linux ICU direct/broker effective-setting checks reported	Verify the merged change meets01; avoid a duplicate implementation
03–04,14–15 native session/host boundary	Trusted-session reset, cwd/startup cleanup, signal/timer ownership and COPY/cancellation changes reported	Compare each specific audit trigger with the new implementation and acceptance result; coverage of the broad area does not close every item
16 LIKE and58 optional PG shortcuts	LIKE plus other rejected shortcuts retired	Prefer deleting/superseding the obsolete finding after merge; do not resurrect retired patches to satisfy an old optimization suggestion
20 recovery;23–24 artifact/output contracts	Guest-local recovery, matching host ABI, strict AOT identity and bounded output changes reported	Revalidate exact affected call paths; bounded output is not automatically bounded public queue admission
17 JSONB	JSONB retained; #201 separately tracks upstream cast-visibility work	Recheck the audit's expression-form fallback case; it is not automatically fixed by different JSONB work
43–50 qualification	Fresh Linux/Rust/Chrome cases and parent Postmaster CI reported; final-head and broader platform gates remain separately scoped	Credit exact commit/artifact/platform evidence only; do not repeat completed equivalent checks without a reason
59–60 organization	Wasmer/libc monoliths decomposed in the PR	Reconcile remaining first-party executor extraction separately; decomposition does not prove all runtime invariants

Additional high-priority context already owned by #201: inherited Postmaster POSIX signal-mask/pending-delivery semantics are reported unimplemented. The follow-up requires coordinated runtime/libc masks, pending signals, handler masking, nonlocal-return and lifecycle behavior; the separate sigsetjmp single-evaluation correction does not solve delivery masking. Keep its detailed acceptance work in #201 and coordinate with items14/43/46 here. This is source-supported inherited behavior, not a new observed-corruption claim from this audit.

Issue #201 also owns retained performance warnings/profiling and upstream follow-up. Preserve its completed work and explicitly conditional research; this umbrella issue does not turn discarded experiments into mandatory features. #90 (memory/concurrency use case) and #35 (custom WASIX extension/AOT support) are related product requests, not automatically defects or additional promised scope.

Design conclusions to preserve

• Native direct intentionally has one process-resident backend; compatible logical reopen is distinct from terminal shutdown. Broker isolates the same engine in a helper. Native server is ordinary PostgreSQL processes with independent external client sessions.
• Single WASIX and concurrent Postmaster are different products. Fresh EXEC_BACKEND guest instances, fixed shared mappings and real concurrent atomics serve essential Postmaster requirements.
• Keep the shared native C ABI and existing language query cores. Share contracts, data and fixtures where semantics agree, retaining platform-specific execution/storage ownership.
• Standard versus ICU data/catalog selection, native target versus Datum32 seed identities, descriptor-last initialization, private copies and create-only restore are intentional.
• Extensions are exact opt-in artifacts; applications own normal CREATE/ALTER EXTENSION SQL and migrations. Native dynamic modules, mobile static registration and WASIX side modules require distinct build adaptations.
• Ordinary PostgreSQL extensions can own SQL functions/types/indexes and existing hooks. They cannot replace startup/return, host process ownership, static loading, exec/shared-memory or WASIX platform semantics. Keep a small reviewed embedding/port seam, first-party host code, and independently removable optimizations.
• Delete demonstrated dead code; measure conditional optimizations before adding abstractions or dependencies.

Main findings and reassessments

The highest-impact findings concern native persistent defaults and restored-data publication; reset commands whose SQL errors are discarded; raw multi-exchange response ownership; OPFS namespace/WAL ordering; channel and RN acknowledgement lifetime; Kotlin initializer ownership; broker framing/startup/close; and extension evidence that claims unexecuted lifecycle stages. Additional supported issues cover Swift diagnostics, JNI Unicode/output sizes, SQL fast-path assumptions, VFS zero writes/shared mappings and measured restore/parameter allocation costs. Every actionable finding appears in the checklist and supporting reports.

Intent review changed several assessments: browser-default IndexedDB durability is withdrawn as a defect; ordinary close waiting for admitted SQL is intentional; Swift native-smoke evidence is a task-specific gap rather than proof all mobile qualification is absent; maintainer --force replacement is optional rebuild resilience; cwd ownership is partly declared but host compatibility/restoration still needs a precise contract; the static SQL parser fails valid custom metadata forms but no currently shipped pin was shown broken. The per-area reports contain the full disposition tables, trigger, impact and smallest repair.

Priorities, evidence and completion rules

P1: address before relying on the affected advertised behavior. P2: consequential correctness, maintainability or qualification work. P3: optional cleanup, measurement or documentation. Priority is not a blanket assertion that a full release is blocked.

The65 original task boxes remain unchecked because this audit did not implement them and overlapping PR #202 is unmerged. As changes land, close a task only with a linked fix/retirement decision and its exact acceptance evidence. Distinguish observed boundary behavior, source-supported concerns, explicit product decisions, qualification gaps and conditional performance ideas. Qualification tasks are not assertions of unobserved bugs. An equivalent completed test from #202 can satisfy a criterion when its scope/artifact/commit actually match.

No full product/platform/extension execution matrix was run in this audit. First-pass Rust/mobile/addon/source checks, second-pass seed/ICU/candidate checks, selected source-boundary observations and host algorithm comparisons are documented in supporting report G and the owning report. Some test environments lacked dependencies or the pinned Moon version. A transport success, source substring, valid receipt, patch-apply success or skipped runtime-dependent test does not prove the advertised behavior.

Supporting reports

• Report A: PostgreSQL core, design intent and complete patch inventory
• Report B: Native SDKs, C ABI, broker/server and native tools
• Report C: Swift, Kotlin, JNI and React Native
• Report D: WASIX bindings and concurrent runtime: revised assessment
• Report E: Retained WASIX and Postmaster evidence
• Report F: All39 extension integrations, tools and qualification
• Report G: Coverage, actual checks, limitations and checklist crosswalk

The master checklist is authoritative; task boxes in the reports expand its acceptance criteria rather than creating independent work. These comments contain the detailed findings, file/line permalinks, intent/history, observed results, measured costs, all-extension inventory, complete PostgreSQL patch dispositions, detailed task crosswalk and explicit gaps. Historical first-pass details are retained only as evidence; revised second-pass priorities and this master checklist govern implementation. Local scratch binaries and full runtime build caches are not release evidence or attached issue assets.

Complete prioritized checklist

First: persistence and session correctness

Evidence: PostgreSQL core (see report A), native desktop/C ABI (see report B), WASIX (see report D).

• 01 — P1 / native runtime: make persistent defaults durable. Preserve explicit GUC tuning; remove the unconditional -F default instead of adding another public profile enum. Done when: default direct and broker persistent opens report the intended fsync, full_page_writes and synchronous_commit; all native adapters agree; temporary-storage behavior is explicit; benchmark overrides are distinguished from product defaults. Ref: CORE-01, D-C02.

• 02 — P1 / C restore: finish the durable handoff. Preserve private staging and create-only restore. Sync restored data and directories before descriptor publication, then sync the destination parent after rename. Done when: the existing platform durability primitives cover the full tree and final publication; restore/reopen succeeds; publication uncertainty is reported without deleting possibly published data. Ref: ND-C03. Depends on: the durability contract in01.

• 03 — P1 / C detach: check PostgreSQL reset outcomes. Reuse the backup control-command confirmation helper for ROLLBACK and DISCARD ALL. Keep ownership until SQL success and idle ReadyForQuery are established. Done when: unsuccessful reset cannot report successful detach; a successful compatible reopen contains no old transaction, temporary object, prepared statement or session setting; the original SQL diagnostic survives. Ref: ND-C01.

• 04 — P1 / raw protocol: settle and enforce the exchange boundary. Prefer one complete exchange per call unless pipeline support is an actual requirement. Validate that contract before dispatch; if pipelines are supported, drain/count every expected completion. Done when: multiple Q/Sync boundaries and COPY/Flush cases have defined behavior, buffered and streaming paths agree, and the next query always receives its own response. Ref: ND-C02. Decision required during implementation: supported raw exchange forms, not a new API hierarchy.

• 05 — P1 / browser storage: repair OPFS namespace durability. Preserve same-worker exact-range I/O as the goal. Until its namespace publication is sound, use the existing portable COW provider for durable persistence. Implement the smallest synchronous namespace/journal solution before selecting direct persistence again. Done when: required WAL names become durable before dependent control/data updates, both spare-handle and staged-overflow paths preserve a recoverable generation, and ordinary persisted reopen/rotation/checkpoint checks pass. Ref: WA01–WA02. Depends on: browser storage contract; avoid introducing another provider abstraction.

• 06 — P1 / native maintenance: service ordinary checkpoint pressure. Reuse the single-WASIX deferred request design at the native safe-idle boundary; preserve PostgreSQL checkpoint ordering. Done when: sustained small transactions recycle WAL within the documented soft target, long transactions have a documented exception, and checkpoint work never recurses from XLogWrite. Include time-based maintenance only under an explicit policy. Ref: CORE-04, D-C03.

• 07 — P1 / PostgreSQL inputs: update the minor release. Move canonical 18.4 inputs and derived native/single/Postmaster identities to18.6 using the existing producers. Keep this independent of patch reorganization. Done when: all pins/receipts/licenses agree, actual product builds and affected extension/recovery tests pass, and applicable upstream migration steps are recorded. Patch application alone does not close this item. Ref: CORE-02.

Native desktop process and transport behavior

Evidence: native desktop report (see report B).

• 08 — P1 / shared JS child wrapper: handle launch errors. Make ChildProcess error settle startup through the existing owner. Done when: missing/unlaunchable executables reject open while the application stays alive and temporary process resources are released. Fix once for broker/server callers. Ref: ND-C05.

• 09 — P1 / broker protocol: carry large responses in bounded frames. Keep the128 MiB per-frame ceiling; chunk/reassemble larger backup and raw results instead of treating the frame ceiling as an accidental database-size limit. Done when: Rust and JS consume below/at/above-ceiling results, a256 MiB backup restores, the next request remains aligned, and peak memory is measured. Ref: ND-C04. **Depends on:**04 exchange semantics.

• 10 — P2 / broker close: bound the dispatched control exchange. Preserve intentional waiting for already admitted SQL. Start the close-control deadline before waiting for its acknowledgement and carry it through process reap. Done when: an unresponsive helper produces a finite, attributable outcome; child ownership is either confirmed released or retained as uncertain. Ref: ND-C06, D-C01. Decision: documented process termination policy after close-control expiry.

• 11 — P2 / Rust broker: preserve close failure. Decode Close replies and retain their error even if the helper subsequently exits zero; attach later cleanup errors without replacing the first. Done when: Rust and JS agree on unsuccessful close acknowledgements and EOF outcomes. Ref: ND-C07. **Depends on:**10.

• 12 — P2 / startup: carry one deadline through every stage. Cover ready-line, connection, broker authentication and JS PostgreSQL readiness handshake using the remaining time. Close the actual pending stream on expiry. Done when: a stalled stage cannot outlive the startup contract or publish a late owner; child/socket cleanup is complete. Ref: ND-C08. **Depends on:**08.

• 13 — P2 / cancellation: bound broker control I/O. Apply the same control policy to cancel authentication/replies while leaving ordinary SQL duration caller-controlled. Done when: a stalled cancel reports its own error and releases the admitted-cancel gate so close can proceed; ordinary query cancellation recovers through ReadyForQuery. Ref: ND-C09. **Depends on:**10–12.

PostgreSQL embedding and SQL semantics

Evidence: core report (see report A), all PostgreSQL patch dispositions (see report A).

• 14 — P1 / direct embedding: specify host-global ownership. State cwd, signals, environment and terminal-close restrictions at the public direct/mobile entry points; repair restoration to match them. Use existing broker/server for applications requiring independent process behavior. Done when: ordinary host callbacks, relative I/O and startup/close behavior are documented and checked; host chdir is either safely supported or explicitly excluded; signal restoration matches the stated contract. Ref: CORE-03, D-C04. Decision: unrestricted host behavior would require a real runtime adaptation.

• 15 — P2 / native entrypoint: unify startup cleanup. Route all returns after exit-guard registration through cleanup. Preserve post-setjmp state with the proper C lifetime, including have_original_cwd. Done when: normal failed initialization clears its guard and restores owned state, and assembled source has no relevant clobbered-local warning at release optimization. Ref: CORE-07. **Depends on:**14's ownership definition.

• 16 — P2 / LIKE: keep character boundaries correct. Remove or narrow0024 to proven-safe matcher/encoding cases and retain the upstream fallback. Done when: supported multibyte encodings and ordinary UTF8 produce upstream-equivalent results; escapes, wildcards, case-insensitive and nondeterministic collations remain on the correct path. Ref: CORE-05.

• 17 — P2 / JSONB cache: handle expression forms conservatively. Guard absent/non-FuncExpr constant metadata and fall back per call; retain correct Param and cast behavior. Done when: the supported expression helpers and cache agree on their domain, ordinary fixed/VARIADIC calls remain equivalent, and the compatible operator case no longer dereferences absent metadata. Ref: CORE-06.

• 18 — P2 / maintenance policy: assign VACUUM, freezing and ANALYZE ownership. Document ordinary SQL maintenance for long-lived single-backend stores; add safe-idle scheduling only if automatic maintenance is part of the product requirement. Done when: update churn, planner statistics and transaction-age behavior have a documented owner and representative checks; no claim assumes an absent autovacuum worker exists. Ref: CORE-04, D-C03. **Depends on:**06 for the shared maintenance seam.

WASIX bindings and concurrent runtime

Evidence: WASIX report (see report D).

• 19 — P1 / byte channel: make terminal wakeups durable in the wait state. Have close/failure change the word or generation on which readers/writers sleep. Keep the bounded ring. Done when: empty-reader/full-writer close and failure schedules settle in both synchronous and waitAsync paths without relying on a notification that can be missed. Ref: WA03.

• 20 — P1 / Wasm recovery: distinguish PostgreSQL ERROR from runtime failure. Share the same classification between buffered, streaming and drain paths. Recover only recognized PostgreSQL nonlocal error transfer; preserve and retire on unrelated runtime failure. Done when: normal SQL errors remain recoverable and runtime failure cannot be reported as a healthy PostgreSQL session with a substituted error. Ref: WA04.

• 21 — P2 / concurrent VFS: remove zero-write-to-truncate substitution. Retain the existing vectored zero-write implementation. Done when: independent writers preserve each other's higher-offset data, ordinary positioned writes cannot shrink files, and zero writes retain their synchronization and allocation semantics. Ref: WA06–WA07. No inode-lock framework is justified to rescue this shortcut.

• 22 — P2 / shared mappings: reuse owned unmapped intervals. Keep memory.grow for genuinely new pages and preserve disjointness from sbrk. Done when: repeated map/unmap with bounded live mappings does not exhaust the4096-page product budget, and partial unmap, padding and concurrent heap growth preserve ownership. Ref: WA08.

• 23 — P2 / single-runtime AOT cache: validate the loaded byte identity. Bind the first process's validation to the same opened bytes used for loading, then reuse the existing Module cache. Done when: an outdated or same-size changed artifact cannot pass solely on its adjacent receipt, and warm reuse avoids redundant work. Keep the separate sealed Postmaster loader's existing ownership model. Ref: WA09.

• 24 — P2 / public TypeScript admission: bound pending copied work. Account for pending requests/bytes before snapshots and encoding; include transactions/private reservations without adding another scheduler. Done when: accepted calls retain FIFO semantics, the documented backlog stays bounded, accounting is released on completion/rejection, and close/cancel retain their intended behavior. Ref: WA10–WA11; native D-C06 where the same policy applies.

Swift, Kotlin, JNI and React Native

Evidence: mobile report (see report C).

• 25 — P1 / RN: register acknowledgements atomically with invalidation. Use the existing owner lock/state on iOS and Android; keep one-chunk backpressure. Done when: invalidate-before-register and register-before-invalidate both unblock the producer exactly once, no callback is delivered to a retired runtime, and a subsequent module/open can acquire ownership. Ref: MOB-C01.

• 26 — P1 / Kotlin initialization: delete only owned staging. Remove whole process-root cleanup from a losing initializer's unowned preparation failure. Done when: two simultaneous default opens produce at most one successful owner and the loser leaves the winner's files and database intact. Ref: MOB-C02.

• 27 — P2 / JNI: use standard UTF8 for native strings. Centralize the conversion for paths, identities, GUCs and restore inputs. Done when: ordinary BMP and supplementary characters, including emoji in a directory name, survive the actual JNI boundary; invalid C-string input still receives a clear error. Ref: MOB-C03.

• 28 — P2 / Swift: enforce callback reentry across execution contexts. Read the existing callback-active state under its lock in addition to TaskLocal checks. Done when: prohibited detached-task/DispatchQueue reentry rejects promptly instead of waiting behind its own callback, while out-of-band cancel still works. Ref: MOB-C04. This enforces an existing restriction; it does not add async callbacks.

• 29 — P2 / Swift bridge: preserve each operation's diagnostic. Carry a bridge-owned operation snapshot to Swift instead of a shared mutable last-error slot. Done when: concurrent query/cancel and no-handle failures retain distinct messages; size/copy reads remain stable; long native and bridge-loading errors remain intact. Ref: MOB-C05.

• 30 — P2 / JNI: check output size before conversion. Apply checked size_t-to-jsize conversion to buffered responses, backups and chunks, always releasing native output. Done when: values beyond Java's array representation fail clearly without successful truncation or double release; ordinary output bytes are unchanged. Ref: MOB-C06.

Extensions, tools and truthful qualification

Evidence: extensions/tools report (see report F).

• 31 — P1 / extension smoke: inspect SQL outcomes. Use the existing checked execution path rather than discarding raw response bytes. Done when: activation and functional SQL failures fail the named extension smoke; normal cases for all 39 execute successfully. Keep raw APIs byte-oriented. Ref: ET-01.

• 32 — P1 / lifecycle receipts: record only executed cells. Collect actual extension/target/topology/stage results and bind those to the release candidate; remove synthesized all-passed dump/restore rows. Done when: every claimed round trip traces to its executed case, omitted cells fail required coverage, and native server physical backup is explicitly unsupported rather than passed. Ref: ET-02, ET-04. **Depends on:**31,33.

• 33 — P2 / extension fixtures: verify retained objects. Split seed/setup from verify; reopen and restore the same index/IMMV/table, query it, then modify it. Done when: verify performs no DROP/recreate that could hide lost state, and supported physical/logical round trips check actual retained behavior. Ref: ET-04. **Depends on:**31 for WASIX and02 for native durable restore.

• 34 — P1 / Postmaster launcher: fix documented default macOS start. Use Bash3-compatible optional array expansion. Done when: no-GUC start and configured start both work under maintained Bash3.2 and Bash5 with the shipped carrier layout. Ref: ET-03.

• 35 — P2 / launcher configuration: keep options and connection string consistent. Bracket IPv6 literals. Reject or consistently resolve GUCs owned by host/port/data/socket options before initialization. Done when: accepted host/port inputs produce a usable advertised URI and listener behavior matches the documented options. Ref: ET-05.

• 36 — P2 / mobile static extensions: replace incomplete SQL interpretation. Choose a small complete metadata mechanism: compiled PostgreSQL function metadata plus explicit aliases/lifecycle, or a real SQL parser. Preserve symbol prefixes and selected-module identity. Done when: comments, dollar quotes, folded/quoted names and aliases work for custom static extension packaging and a real mobile consumer loads the result. Ref: ET-06. Current shipped pins were not demonstrated broken.

• 37 — P2 / older regression runner: reuse bounded supervision. Route process ownership and cleanup through existing process-supervision.sh; bound each readiness call within the total deadline. Done when: startup/shutdown terminate with useful diagnostics within their stated limits and leave no owned children. Ref: ET-07.

Product validation to close known coverage gaps

These are ordinary implementation/release checks to run when implementing the work. They were not all executed during this audit. Reuse current suites and consumer apps.

• 38 — P1 qualification / native products: execute actual current carriers. Run the existing C/SDK regression lanes with real PostgreSQL plus reset, raw-boundary, restore and cancellation cases from03/04/02/13. Done when: results identify the exact artifact/SHA and distinguish executed from skipped tests. Refs: Q-C01; depends on affected fixes and07.

• 39 — P2 qualification / host adapters: complete the supported OS/runtime matrix. Run the relevant Node/Bun/Deno and Linux/macOS/Windows/ARM consumers. Done when: lifecycle and protocol results agree, filesystem publication behavior is qualified per platform, and addon worker/finalizer cases remain green. Refs: Q-C02, WA12; depends on19 and38.

• 40 — P2 qualification / Swift: make native-required smoke truthful. Add one separately selected Swift-to-C PostgreSQL consumer, or rename the task and remove the unconsumed requirement claim. Done when: required mode fails when runtime artifacts are unavailable and real mode proves open/typed query/close; unit mode remains independent. Ref: MOB-Q01.

• 41 — P2 qualification / mobile typed facades: execute them directly. Extend current Swift/Kotlin integration smoke for typed nulls, bytea, custom-OID raw values, duplicate fields, transactions and SQL recovery. Done when: reports prove facade-to-runtime execution, beyond RN raw-path tests and fixture parsing. Ref: MOB-Q02; depends on40 and actual Android artifacts.

• 42 — P1 qualification / mobile lifecycle and storage: run installed-app checks. Use the existing iOS/Android apps and durability/lifecycle lanes. Done when: lifecycle transitions during streaming complete, cancellation recovers, generations remain isolated, retained roots reopen, and successful persistent writes/restores meet the chosen contract. Refs: MOB-Q03–Q04; depends on01/02 and25–29.

• 43 — P1 qualification / Postmaster: execute its runtime capability suite. Use exact pinned builds to prove fresh exec, fixed shared reattachment, wait/join, signals, timers and packed-latch behavior on supported hosts. Done when: required cases execute, cross-instance state works under ordinary concurrent clients, and process-group resources return to baseline. Refs: WA05, WA15, WA22; depends on21/22 and07.

• 44 — P2 qualification / Wasmer compiler and tables: check semantic equivalence. Run compiled bulk-memory overlap/bounds/growth and indirect-table mutation/signature cases against a reference engine. Done when: bytes/results and defined runtime outcomes agree; shadow tables stay coherent through set/fill/copy/init/grow and side-module use. Refs: WA13–WA14; requires the pinned compiler, not just source-text checks.

• 45 — P2 qualification / artifacts and start images: verify lifecycle ownership. Run existing loader/activation/rollback and deterministic-start-image suites on supported mapping implementations. Extend missing supported expression/initialization shapes conservatively. Done when: admitted images match ordinary fresh initialization, rejected loads release resources, frame/code/metadata lifetimes agree, and one failed initialization cannot become a later success through stale state. Refs: WA16–WA19. Do not generalize the image analyzer before this evidence exists.

• 46 — P2 qualification / VFS and networking: exercise normal descriptor churn. Cover positioned/append I/O, growth, dup/renumber/close, queued accepts, repeated watches, multiple waiters and EOF. Done when: results match the supported POSIX contract and there are no stale-offset, stale-descriptor or lost-listener-progress outcomes. Refs: WA20–WA21; depends on21 and43.

• 47 — P1 qualification / persistence: run existing recovery lanes for each provider. Cover normal WAL rotation/recycling, checkpoints, clean reopen and the repository's established recovery checks under the selected durability contract. Done when: committed state and retained extension objects remain correct and host locks/processes are released. Refs: WA23, CORE-04; depends on01/02/05/06/21/22.

• 48 — P2 qualification / all extensions: deepen the useful behavioral subset. First cover pg_ivm updates/deletes/rollback, pgvector HNSW/IVFFlat lifecycle, retained pg_textsearch BM25 and persistent PostGIS GiST/transforms. Add dictionary-resource checks and topology-specific notifications/files/inspection cases for contrib. Done when: the supported native/mobile/WASIX ABI paths execute the relevant pinned cases and receipts distinguish target/topology. Ref: ET-08; depends on31–33. All39 integration families are enumerated in the area report.

• 49 — P2 qualification / public Postmaster carrier: test the shipped entry point. Pick/document its actual default settings and run a small packed start/connect/stop consumer on Linux/macOS. Done when: published instructions execute and resource measurements describe the same settings, rather than only a separate qualification profile. Ref: ET-09; depends on34/35.

• 50 — P2 qualification / seeds, ICU and tools: prove the final packaged closure. Reuse clean-consumer tests for each target's standard/ICU seed, locale probes, tool binaries and installed paths. Keep source/header receipts separate from actual execution. Done when: carrier versions/ABIs agree; ICU data and catalog expectations agree; ordinary psql/pg_dump options/output behave as the pinned tools specify. Refs: core seed review, D-C05, existing per-release seed checklist.

Performance work, ordered by existing evidence

• 51 — P2 / native restore: remove quadratic metadata work. Collect and sort canonical entries once; validate duplicates/ancestor collisions and extract from the existing validated plan. Done when: existing archive semantics stay intact,10k→20k file metadata time is substantially below the observed3.95× growth, and full restore time/RSS are measured separately. Ref: ND-C10; depends on02's final restore flow.

• 52 — P2 / Kotlin parameter encoding: use a presized byte buffer. Replace boxed byte-list construction while preserving public ownership copies and protocol bytes. Done when: the8 MiB parameter case allocates substantially less than the measured227.3 MiB, linear space is bounded, and small-query/device latency does not regress. Ref: MOB-P01.

• 53 — P3 conditional / Node dispatch: measure thread-per-operation cost. Compare the existing path with one persistent addon worker using current lifecycle fixtures. Done when: implement only a demonstrated median/tail/thread-count improvement that preserves cancel and cleanup. Do not assume libuv's shared pool is automatically suitable. Ref: ND-C11.

• 54 — P3 conditional / parameters and parsing: remove redundant work where measured. Benchmark typed/untyped JS inference and mobile frame/scalar copies. Reuse inferred prepared state or frame spans only where ownership is clear. Done when: null/custom codec/array/error behavior is unchanged and realistic allocation/latency improves. Refs: ND-C12, MOB-P02; depends on52 baseline.

• 55 — P3 conditional / backup and logical tools: measure full-buffer costs. Measure peak RSS/throughput across direct, broker and language boundaries. Add a streaming/file output route only for a real large-database requirement. Done when: complete output and cancellation/recovery semantics remain correct, with measured benefit. Refs: ND-C13, ET-13; depends on09.

• 56 — P3 conditional / warm startup and extension registration: remove redundant materialization. Measure immutable carrier hashing/file reads and Swift base64 registration working set. Reuse existing receipts or incremental fingerprints where justified. Done when: exact artifact identity and conflicting-file detection remain enforced and cold/warm startup/RSS improve. Refs: ND-C14, MOB-P03.

• 57 — P3 conditional / Wasmer optimizations: require per-change evidence. Measure detached metadata, shared tables, sparse globals and start images with the same build/storage policy, including PSS/cgroup memory and tail latency. Done when: each retained optimization has a useful gain and its semantic checks; required exec/shared-memory fixes remain even if they are not speedups. Ref: WA28; depends on44/45.

• 58 — P3 conditional / SQL and PostGIS build optimizations: keep only justified delta. Compare removal builds for optional PG micro-optimizations and measure PostGIS whole-archive/export-all cost. Done when: equivalent SQL/extension lookup/constructors and matched durability are proven; carrier size/AOT/startup or query improvement justifies the change. Do not delete exports from appearance alone. Refs: core patch strategy, ET-13.

Cohesion, duplication and documentation

• 59 — P2 / Wasmer organization: extract the first-party executor. Move product-owned executor/proof tooling into ordinary repository sources, retaining narrow required runtime APIs. Done when: sealed CLI/manifest/features/dependencies and behavior remain the same, while code can be navigated, linted and tested directly. Ref: WA24. Preserve fresh-exec design.

• 60 — P2 / patch ownership: organize by responsibility and upgrade risk. Split core embedding, platform correctness, process/mapping lifetime and optional optimization deltas. Record base, invariant, owner, relevant test and upstream/removal status for each logical change. Done when: the same current postimage is reproducible and a PostgreSQL/Wasmer/libc upgrade requires semantic review as well as patch application. Refs: WA25–WA26, core complete patch inventory. Do not merely concatenate patches or introduce an embedding framework before a real seam is defined.

• 61 — P2 / shared semantics: reuse contracts and transition fixtures. Extend existing language query cores and common fixtures for reset outcomes, acknowledgement retirement, diagnostic precedence and ownership cleanup. Keep platform-specific schedulers and topology adapters. Done when: one expectation changes in one shared fixture, with every relevant SDK exercising it and no hidden topology fallback. Refs: MOB-O01–O02, WA29; depends on settled correctness behavior above.

• 62 — P3 / delete verified dead code and move local adapters. Remove unused native JS tar/zip/readiness helpers, obsolete AGE branches and stale PGXS columns. Move Windows extension-specific transformations next to their recipes while retaining common build helpers and layout assertions. Done when: import/package checks pass, generated inventories are equivalent, and current extension arguments are not lost. Refs: ND-C15, ET-10–ET-11. Separate deletion from behavior changes for review.

• 63 — P2 / public behavior docs: state the actual limits. Document one physical session, logical detach versus terminal close, queued cancellation versus admitted teardown, raw exchange scope, Java output ceiling, current32767 parameter cap, pending-work/mapping limits and buffered tools. Done when: examples and errors match tested semantics; no universal startup/close timeout is claimed for an uninterruptible direct backend. Refs: D-C01, MOB-D01–D02, WA30; depends on04/10/14/22/24/30.

• 64 — P3 / preserve explicit product policy. Keep browser-default IndexedDB durability unless the product deliberately chooses otherwise; describe it accurately in matched benchmarks. Resolve opt-in pgrx experiment wording separately from the public39 catalog, and document Postmaster's current core-only support. Done when: one support inventory is unambiguous and no cleanup silently changes an accepted API/storage policy. Refs: WA27, ET-12.

• 65 — P3 optional / maintainer rebuild resilience. If useful, stage replacement resources fully before promoting them under --force. Done when: a failed replacement can retain prior generated output while successful force rebuild remains simple. Ref: ET-14. This is build convenience, not a customer-data defect or release blocker.

Suggested implementation order

Start with the shared causes:01–04,08–09,19–20,25–26 and31–32. Resolve14 and18 as product contracts while smaller fixes proceed. Update07 without waiting for organization work. Follow with the remaining P2 correctness items and the relevant actual-carrier checks. Do51/52 next because their costs were measured. Finish conditional optimizations and cleanup after correctness and verification are credible.

Each completed item should link its focused change and actual verification result. Do not mark a box complete because a source checker finds a symbol, a transport call returned successfully, a receipt contains a hash, or an artifact-dependent test skipped. Existing checked-in implementation checklists and release gates should be updated from this list once fixes land; this report itself makes no release-ready claim.

[f0rr0]

Supporting report A: PostgreSQL core, design intent and complete patch inventory

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

PostgreSQL core, product intent and patch strategy — second pass

Reviewed origin/main at e8192180bec4494c83bfa3adecbaa9b228b8f05d. Fetching main again produced no source change. This is an engineering review of our product and its changes to PostgreSQL. Production code is unchanged. The first-pass complete PostgreSQL patch inventory (supporting report A — PostgreSQL core and complete patch inventory) remains applicable; the assessments below refine its priorities and add source findings.

What the product is trying to achieve

The repository has five execution paths, backed by three materially different engine designs. Native direct runs a PostgreSQL backend on a C-owned pthread. Native broker wraps that same backend in a helper process. Native server starts an ordinary PostgreSQL process and gives clients its connection string. Single WASIX gives each database one isolated guest backend. WASIX Postmaster uses a real postmaster, fresh EXEC_BACKEND guest instances and genuine shared memory.

These differences are intentional. The native contract, Postmaster guide, API architecture and seed architecture explain why a uniform query vocabulary does not imply identical process, filesystem or cleanup ownership. Keep one C native boundary and language query cores. Do not replace the five adapters with a generic runtime framework merely to reduce file count.

History supports that reading. The native implementation was imported in a4f438c3; fae2bd7b (#129) established runtime/product boundaries; 4384d1bd (#153) aligned APIs while preserving explicit worker and lifecycle ownership; 31bb5e19 (#164) added the JSONB optimization. Many earlier implementation changes are bundled into large consolidation commits, so the review distinguishes explicit current contracts from inferred motivation.

Revised core findings

CORE-01 — P1: native default durability must match persistent storage. The C argument defaults include -F. The desire to reduce tiny-query and initialization costs is understandable, especially for temporary storage. Applying the same setting to application-owned persistent directories silently gives them fsync=off. No ordinary SDK override was found. The smallest repair is to remove the fixed -F default and let explicit, validated PostgreSQL GUCs select weaker durability when a caller actually wants it. Avoid another public profile enum. Verify effective settings from real default opens in every native adapter.

A correction to any broad performance criticism: the native benchmark tuning explicitly applies its chosen durability settings, and its default Safe mapping uses fsync=on. Therefore the audit does not establish that the existing safe benchmark results relied on the production -F setting. The problem is a mismatch between the ordinary product default and the benchmarked configuration. Benchmark labels, effective GUCs and actual storage barriers must agree.

CORE-02 — P1 maintenance: update the PostgreSQL minor release independently of redesign. Canonical and runtime pins select 18.4. PostgreSQL 18.6 is available and carries relevant upstream fixes. All current native, single-WASIX and Postmaster stacks applied to the official 18.6 source during the first pass; this lowers textual rebase uncertainty but says nothing about executed behavior. Update the existing canonical pins and derived identities together, build actual carriers, and follow applicable migration guidance. Do not postpone the minor update until an embedding API or fork reorganization exists. PostgreSQL 18.6 release notes.

CORE-03 — P1 product boundary: direct embedding needs a precise process-global ownership contract. The first report described cwd and signal effects too broadly as unexpected. Native architecture explicitly says the runtime temporarily owns process-global PostgreSQL environment and restores it at terminal close. Cwd remains changed throughout logical detach because the physical backend remains resident; this follows that declared model. The important gaps remain: application chdir redirects PostgreSQL's relative file opens, ordinary application relative I/O targets PGDATA, and PostgreSQL installs process-wide signal handlers beyond the deliberately protected SIGUSR1. There is no demonstrated complete handler restoration.

Make the supported host behavior explicit at the SDK entry points, restore owned state on terminal and startup-error paths, and add normal embedding-consumer checks. Process-isolated desktop applications should use the existing broker/server product. If unrestricted host cwd/signals are a requirement for direct/mobile, it needs a real path/signal adaptation at the runtime boundary; simply restoring cwd after startup or disabling all handlers breaks PostgreSQL assumptions. This is a substantive product constraint, not evidence that one resident backend or a pthread is itself a bad design.

CORE-04 — P1 maintenance ownership: long-lived single-backend databases need a complete maintenance policy. Native direct/broker has no ordinary WAL-volume or time-based checkpoint scheduler. Some DDL, explicit maintenance, backup and shutdown can still checkpoint. Single WASIX already records WAL-volume pressure and services it outside transactions at ReadyForQuery; reuse the idea at the appropriate native seam. Do not checkpoint recursively inside XLogWrite. A volume threshold is a soft target, especially during a long transaction.

Both single-backend designs also need an explicit answer for VACUUM, freezing and ANALYZE with no autovacuum process. Absence of autovacuum is an intended topology choice; the missing piece is who maintains long-lived stores and when. Start by documenting supported SQL maintenance and testing representative update churn, statistics and age progression. Add scheduling only for an agreed product requirement, through the existing serialized owner and safe idle boundary. No background-worker framework is needed merely to run ordinary maintenance SQL. PostgreSQL documents vacuuming's space, statistics and transaction-age responsibilities in its routine maintenance guide.

CORE-05 — P2 correctness: constrain or remove LIKE's bytewise shortcut. The intent of patch 0024 is sound: avoid costly matcher steps for deterministic %literal% patterns. Its guards exclude several real semantic hazards, but omit non-UTF8 multibyte character boundaries. The retained first-pass differential check found a wrong EUC_JP match. It is shared with Postmaster, whose supported encoding domain is wider than the default UTF8 seed. Remove it or restrict it to the proven-safe matcher/encoding cases; preserve generic fallback. Do not substitute a differently named SQL extension function and call that equivalent behavior.

CORE-06 — P2 correctness: JSONB metadata caching assumes every expression is FuncExpr. Patch 0043 checks stable UNKNOWN arguments through PostgreSQL's general expression helpers, but then handles only FuncExpr. The alternative sets arg=NULL, followed by IsA(arg, Const), whose PostgreSQL macro dereferences its argument. A compatible internal alias used as a custom operator reaches this OpExpr case. Ordinary calls to jsonb_build_object(...) use FuncExpr and are not shown to fail.

The metadata-cache intent is reasonable and the patch already protects Param values and user-defined cast changes. Preserve those decisions. The minimal repair is a null/type guard and per-call fallback when constant metadata cannot be established; no new cache system is needed. An isolated PostgreSQL 18.4 host build was compared with the same build replacing only jsonb.c by this patch's postimage. Upstream returned the expected object for the operator case; the modified build terminated. This is a local algorithm comparison, not execution of the full WASIX product or a claim about ordinary query workloads. Existing SQL/log artifacts are retained under checks (audit-local evidence: checks; observation and scope recorded in this report).

CORE-07 — P2 lifecycle cleanup: make startup-error state valid across nonlocal return. Native patch 0010 initializes have_original_cwd, which fixes one earlier issue, but the flag remains a nonvolatile automatic modified after sigsetjmp and read after siglongjmp. Compiling the complete assembled native postgres.c at GCC -O2 -Wclobbered reports that exact variable. This is a C lifetime-rule concern; no actual failed cwd restoration was reproduced, and the inspected compiler currently stores the flag on the stack. Preserve the state with the appropriate nonlocal-return lifetime rather than relying on current code generation.

There is also an early SelectConfigFiles return after the exit guard has been registered. It bypasses the cleanup label introduced later in the series. Centralize post-registration exits through that label. Do not infer that every existing public error path reaches this return, or claim a demonstrated host crash. This is narrowly scoped cleanup work with normal failed-initialization acceptance checks. The source substring checker verifies that a cleanup label exists; it cannot establish all control flow reaches it.

Patch versus extension: where each responsibility belongs

Responsibility	Best owner	Can an ordinary extension replace the existing change?
SQL functions, types, operators, indexes, access methods, planner/executor behavior with existing hooks	PostgreSQL extension + normal SQL migrations	Often yes; the catalog's extensions already do this
Desktop process startup, resource staging, listener, connection lifecycle	SDK plus ordinary PostgreSQL/libpq tooling	No extension needed; keep normal server build close to upstream
Embedded backend startup/return, transport and host process ownership	Small opt-in PostgreSQL embedding seam + C/runtime host implementation	No existing general extension API supplies this lifetime
Static mobile module resolution	Narrow loader seam + build-generated selected symbol registry	Cannot bootstrap its own loader through a module it cannot yet load
WASIX exec, shared memory, fd I/O, timers and signals	PostgreSQL port, libc or runtime at the layer owning the operation	No; these are platform semantics below extension execution
Postmaster supervisor and product executable/proof tooling	Normal first-party repository sources	Move out of the upstream patch, not into a PostgreSQL SQL extension
LIKE, JSONB, btree, hash and WAL-loop optimizations	Independent optional upstreamable changes	Usually no transparent equivalent extension; remove if gains do not justify maintenance
Seed catalog suppression and optional ICU readiness	Controlled producer plus small initdb/platform seam	Ordinary application migrations must not pretend to recreate an ICU-initialized seed

SPI executes SQL inside backend functions; it is not an external process/thread embedding API. Background workers require the server's process supervision. These upstream interfaces help extension functionality but cannot replace the embedding or WASIX operating-system port. SPI documentation, background worker documentation.

Reduce semantic delta, not just patch count. Retain patch format for small upstream changes, with pinned base, purpose, relevant invariant, owning test and removal/upstream status. Extract first-party executor code from the 44,475-line Wasmer patch and divide the remaining fork by responsibility. Keep native and WASIX implementations separate where runtime semantics differ; share contracts, data and test cases where they agree. The prior report's patch-by-patch disposition accounts for all 20 native patches, all 43 single-WASIX patches, all 5 local Postmaster patches, 7 reused patches and six guest overlays.

Cluster seeds, ICU and small support libraries

The standard/ICU separation and target-qualified native/Datum32 seeds solve real correctness and startup concerns. The fixed bootstrap postgres role, descriptor-last initialization, private copies, no hidden catalog migration, and native-server initdb for unique system identifiers are sound. Cross-target ABI receipts are necessary but deliberately not execution proof.

This pass read the canonical contract/fixtures, controlled native producer/stager, native manifest/tree validator, WASIX cluster-seed runner/profile probe, native/WASIX collation patches, optional ICU data wrapper and portable UUID implementation. The UUID shim uses PostgreSQL's entropy source and explicitly sets version/variant bits; it was not judged against an invented monotonic-v1 guarantee. No additional normal-input defect was established in these components. Twelve existing native seed/ICU/cross-family tests passed under Bun. Target-specific runtime execution, Unicode collation results and actual seed recovery remain release qualification, not inferred from manifest checks.

Performance and organization conclusions

The performance patches usually have specific motivations: expensive WASIX indirect calls, dynamic 64-bit division, allocator traffic or host entropy crossings. Preserve this knowledge in their ownership records. Separate the platform getrandom fix from its single-backend random reservoir; enforce one guest execution owner before non-atomic specialization; preserve table/index/extension ABI when changing representations. Historical three-run or diagnostic measurements are useful design context, not current carrier qualification.

Prioritize demonstrated cost: Kotlin large-parameter allocation and native restore's quadratic metadata work. Measure thread-per-Node-operation, repeated untyped parameter inference, backup copies, warm resource scans and PostGIS export closure before rewriting them. Use equal durability, effective GUCs, source, compiler and workload, reporting tails as well as medians. Do not select an optimization solely because it improves one synthetic benchmark.

Verification and limits

New root work included source/history review, twelve existing seed/ICU tests, an isolated host PostgreSQL algorithm comparison, and compilation of the complete native traffic-cop source for its nonlocal-return warning. Earlier patch application and LIKE results were retained instead of rerun needlessly. Initial invocation of Bun-specific tests with Node was corrected to their declared Bun runner; all 12 then passed.

Complete patch inventory retained from the first pass

What actually differs from PostgreSQL

Product	Real execution model	Main maintenance constraint
Native server/libpq	Packaged ordinary PostgreSQL processes and normal independent client sessions	Keep this path as close to upstream as possible; SDK process supervision is the customization
Native direct	One process-resident embedded backend pthread and one serialized physical session	PostgreSQL global state, cwd, signals, lifecycle, portable module loading
Native broker	The same embedded C runtime inside a helper process	Better host isolation, but inherits direct engine durability/checkpoint semantics plus RPC limits
Single WASIX	One isolated guest backend, driven through host-callable PostgreSQL protocol/recovery exports	Host filesystem, exceptions, no concurrent observer, safe maintenance boundaries
WASIX Postmaster	A real postmaster with EXEC_BACKEND and separate WASIX backend instances sharing mapped PostgreSQL memory	Guest process/IPC port and patched Wasmer/libc semantics

The existing @oliphaunt/wasix-ts/server is a server adapter for the single-backend family; it should not be mistaken for the concurrent Postmaster carrier. Preserve these distinctions in APIs and tests even when query/result types are shared.

Patch measurements below count actual added/deleted unified-diff lines, excluding diff headers. They are maintenance surface, not runtime code size or a performance measurement. The Postmaster also owns six overlay files, and native C runtime sources are outside its patches.

Stack	Patch files	Upstream paths touched	Added / deleted lines
Native PostgreSQL	20	27	+1,191 / -77
Single WASIX PostgreSQL	43	52	+2,339 / -790
Postmaster-local PostgreSQL	5	17	+924 / -18
Postmaster Wasmer	1	141	+33,652 / -3,371
Postmaster WASIX libc	1	45	+947 / -129

Postmaster additionally reuses seven canonical WASIX patches; those are not seven more independent implementations. Its Wasmer patch has 44,475 total lines and contains 6,261 additions under the new product-owned executor crate. Keeping that application crate inside an upstream patch makes ordinary product work look like a runtime fork change. Move it into a normal repository crate once the required Wasmer APIs are isolated; keep unavoidable VM/compiler/syscall changes as a small ordered upstream-facing series or a clean maintained fork.

Patch-by-patch disposition

Every PostgreSQL patch is accounted for below. Grouping related patches shows where one cohesive seam can replace layered corrective edits; it does not mean blindly concatenating everything into a monolithic patch.

Native IDs	Purpose	Recommendation
0001	Backend host I/O vtable and standalone wait-set guard	Keep a narrow opt-in transport seam; candidate for an upstream embedding interface
0002, 0003, 0004, 0009, 0013	Entry point, returning backend, exit callbacks, FATAL guard and return annotations	Consolidate into one reviewed lifecycle change; move implementation out of the traffic cop where possible; preserve PostgreSQL cleanup order
0005, 0010	cwd and installed-resource paths	Paths belong in host configuration, but cwd requires the real architectural fix above; environment mutation is not a complete context API
0006	Static extension resolution	Keep mobile static loading support behind a narrow resolver; use ordinary dynamic modules on supported desktops
0007	Apple mobile shell restrictions	Platform adaptation; continue rejecting unavailable operations explicitly
0008, 0017	Symbol namespace/collision cleanup	Prefer visibility/export lists or narrowly generated symbol names where possible; preserve dynamic-extension symbol identity
0011, 0014	Mobile shared memory/semaphores and portable socket pair	Platform source files/build selection are appropriate; these cannot be SQL extensions
0012	Event triggers in embedded protocol sessions	Keep the actual session-mode predicate explicit; do not fake postmaster identity for unrelated behavior
0015, 0019	Meson embedding option and Windows module-provider linking	Build configuration belongs in platform/build files; retain separate ordinary-server and embedded link products
0016	Controlled collation discovery for seed production	Share the canonical seed rule with WASIX; restrict special behavior to seed production and verified optional ICU data
0018, 0020	Embedded signal containment	Good intent, incomplete host isolation; combine with an actual signal/timer ownership contract

Single-WASIX IDs	Purpose	Recommendation
0001, 0007, 0022	WASIX build port, PGXS side modules and backend linker	Keep as platform/build support; seek upstreamable port files, not SQL extension hooks
0002, 0003, 0004	I/O, startup parsing and lifecycle exports	Share the conceptual native embedding contract where semantics agree; keep transport implementations separate
0005, 0006, 0008, 0012, 0013, 0019, 0020	Host-driven loop, COPY state, startup errors and error recovery	Highest semantic rebase risk; factoring nearly the whole traffic-cop loop makes textual patch size misleading. Test nested errors, repeated errors, COPY, portal suspension, transaction recovery and fatal traps against upstream
0009, 0010, 0011, 0021, 0023	Identity, shared-memory/semaphore adaptation, fork declaration, ownership checks	Move OS facts into the port/host; enforce that identities are sandbox identities and unsupported fork/thread behavior fails
0018, 0025, 0034, 0039, 0040, 0041	Tool symbol collision, unsupported parallel dump, hybrid COPY transport, side-module setjmp, nonblocking libpq and psql behavior	Prefer fixing libc/build primitives at their owner, especially setjmp and socket flags; retain focused tool behavior tests until upstream catches up
0027, 0028, 0029, 0031	Deferred checkpoints, semaphore/GUC shortcuts, postmaster flags and statistics shortcuts	Share safe maintenance policy with native. Reconsider 0028's one-try semaphore reset and omitted GUC state: no-concurrency does not itself prove every state shortcut. Keep postmaster flag changes paired with all affected invariants
0032, 0033, 0038, 0042	Directory sync, collation seed controls, writeback hints and explicit WAL sync	Preserve durability. An unsupported syscall is not proof that the corresponding persistence operation is unnecessary; host tests must prove it. Prefer host/libc fixes where semantics can be supplied
0035, 0036	Single-backend spinlocks and atomics	Only valid with enforced no-concurrent-guest execution. Keep excluded from Postmaster, preserve extension ABI layout, and test reentry/worker rejection
0014, 0015, 0016, 0017, 0024, 0026, 0030, 0037, 0043	Hash, XID, btree, stack scratch, LIKE, WAL loop, random and JSONB optimizations	Treat as independently removable performance changes, not embedding requirements. Fix/remove LIKE. Keep getrandom's platform correction distinct from its optional reservoir. Require workload-specific gains plus differential semantics tests before carrying each across upgrades

Postmaster-local change	Purpose	Recommendation
0001	POSIX DSM instead of unavailable SysV DSM	Port/configure capability selection; keep ordinary PostgreSQL DSM semantics
0003	Static encoding shim for libpq tools	Keep encoding symbols owned once; simplify producer/link ownership before adding more aliases
0004	EXEC_BACKEND/vfork handoff, initdb and platform/tool behavior	Split process handoff from unrelated platform policy; preserve fresh-instance isolation and child failure cleanup
0006	Retry interrupted child joins	Correctness belongs as low as practical in libc/process wait semantics; no general need for an extension
0008	Packed atomic latch state	Real concurrency seam, not optional single-backend optimization. Keep the atomic state-machine and emitted-opcode checks; test separate Wasm instances and failure/churn
Overlays	Configure/header/makefile, fork wrapper, POSIX shmem and encoding shim	Appropriate platform organization, but full-file replacements such as shmem need explicit upstream diff review on upgrades
Reused 0014, 0015, 0016, 0018, 0024, 0026, 0037	Shared canonical patch decisions	Reuse is good. 0016/0026 are guarded by OLIPHAUNT_WASM_SINGLE_USER and therefore do not enable their btree shortcut in Postmaster; do not count mere inclusion as a Postmaster speedup

Could extensions replace the patches?

Partly. Extensions are a good home for SQL functions/types/operators, access methods, planner/executor hooks where suitable hooks already exist, and background work in a real server. PGXS builds such modules, SPI executes SQL inside a backend, and background workers are created and supervised by a running PostgreSQL postmaster. None is an existing general-purpose API for instantiating Postgres inside an arbitrary host thread or supplying a WASIX operating system. PGXS, SPI, background workers.

The implementation-based conclusion is:

1. Native server can carry almost no embedding-related core delta. Put process lifecycle/resource staging in the SDK, use libpq/protocol clients and ordinary extensions. Keep the server's build separate from OLIPHAUNT_EMBEDDED.
2. Native direct still needs a core embedding seam. Startup, global lifetime, return from exit, host transport, resource paths, signals and static mobile loading occur below/before a normal extension can solve them. A small upstreamable embedding interface would help; calling today's SPI from a foreign app thread would not.
3. WASIX needs a platform/runtime port. Shared memory, exec, filesystem durability, socket flags and Wasm exception handling belong to PostgreSQL's port, WASIX libc or Wasmer, respectively. Moving a workaround to the wrong layer can merely hide it.
4. Optional SQL engine micro-optimizations can often be deleted. An extension implementing a differently named JSONB/LIKE function would change the public SQL contract; it is not an equivalent transparent replacement. Upstream a generally valid optimization or carry it separately with evidence.

Aim for fewer semantic changes, not a zero-patch number. Existing process separation, shared C ABI, generated extension model and query cores are useful foundations. Avoid a generic pluggable-runtime framework solely to make all three topologies look identical.

Correctness and performance acceptance

Before optimizing throughput, make durability comparable: native currently starts with fsync=off; IDB uses its documented browser-default durability; direct OPFS has an ordering defect identified in the bindings report. A faster result under a weaker persistence policy does not establish a faster implementation of the same contract.

Use normal server PostgreSQL as a semantic oracle for SQL results, errors, transaction state and wire frames. Extend the shared fixtures with nested savepoints/errors, COPY cancellation, suspended portals, non-UTF8 LIKE, event triggers, extension index persistence, checkpoint/recovery, large results/backup and failed cleanup. Test all extension SQL error responses rather than merely transport success. For every single-backend shortcut, write down which concurrent observer is absent and ensure hosts cannot introduce it.

For maintained performance patches, compare the same source/compiler/GUCs and storage policy, retain per-patch removal builds, and measure realistic query mixes and p95/p99 latency as well as throughput. Deferred checkpoints move work into request latency; allocating fewer Wasm atomics does not eliminate host scheduling costs. No new real-database performance claims were measured in this root review.

Verification performed and limits

• Downloaded official PostgreSQL 18.4 and 18.6 archives; verified 18.4 against the repository SHA-256 and 18.6 against the official checksum (555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f).
• Native: all 20 patches applied with the producer's git apply --whitespace=error-all to both versions. Postmaster: overlay plus five local and seven reused patches applied with git apply to both. Single WASIX: all 43 applied with its GNU patch method to both; some hunks use fuzz/context offsets. Logs accompany this report. These are source-application checks, not qualified upgrades.
• Compiled and ran the upstream-versus-patched LIKE oracle; reproduced the multibyte wrong result.
• Native generation lifecycle, error attribution, static extension registry and module-dir/descriptor tests all passed.
• Postmaster packed-latch static checks, five guest provenance tests, process supervision and server lifecycle checks all passed. The latch check is not an executed multi-instance stress test.
• Inspected the complete PostgreSQL patch inventories, assembled high-risk lifecycle/recovery/storage functions, C runtime boundaries and Postmaster guest overlays. The 44,475-line Wasmer fork received targeted architecture/memory/process review, not a line-by-line proof or independent compiler audit.
• No full native/WASIX producer build, PostgreSQL regression replay, real power-loss campaign, full platform consumer matrix or exact-SHA GitHub qualification was run. There were no prebuilt runtime artifacts in this checkout. Separate SDK/tool reports record their tests and additional environment limits.

The successful 18.6 application experiment is useful: patch reduction can proceed separately from the urgent minor upgrade. Regenerate pins/receipts and run the real product build, extension lifecycle and recovery gates before shipping it.

[f0rr0]

Supporting report B: Native SDKs, C ABI, broker/server and native tools

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

Native desktop, C ABI and tools — second audit pass

Reviewed origin/main at e8192180bec4494c83bfa3adecbaa9b228b8f05d, unchanged after the second fetch. This is an engineering audit of normal product contracts, recoverable failures and maintainability. Production source was not edited. The first-pass desktop report (supporting report B — Native SDKs, C ABI, broker/server and tools) remains the detailed record of ND1–ND5; this report revises its conclusions, adds deeper findings, and supplies an implementation checklist. It does not claim every supported platform or every PostgreSQL extension has been executed.

The largest new correctness gap is the distinction between a successful transport exchange and a successful PostgreSQL command. The C detach path loses that distinction when resetting a resident session. A second gap is accepting multiple raw exchanges while returning after only one. The archive implementation also omits durable publication on restore and does quadratic work in the number of files.

Intent and history that changed the review

Read native architecture, storage contract, native runtime README, SDK READMEs, parity policy and relevant implementation comments. Read scoped history and blame, including:

• a4f438c3b initial imported implementation: current unchecked reset-command responses and restore-file writes originate here.
• fae2bd7bd / feat!: unify native and WASIX runtimes and SDKs #129: one native physical archive, exact managed roots, explicit native/WASIX format domains, tightened restore metadata/topology, poisoning if backup-mode exit cannot be proven. These restrictions are coherent; removing them for cosmetic simplicity would weaken the product.
• 4384d1bdf / feat(sdk)!: unify embedded PostgreSQL public APIs #153: aligned public APIs, terminal versus retryable teardown, retained cleanup ownership, _with_error captures. This is the intended behavior against which the remaining errors should be judged. It also contains the Rust close acknowledgements that are still ignored.
• b8cab0be / fix(ci): preserve native lifecycle server sessions #165: native server lifecycle preservation. Current server ownership of child/pg_ctl/socket paths has deliberate uncertainty handling; a generic “simplify all close state” change would discard fixes.
• 5eaf05b8 / perf(js): streamline exec response handling #158: JS execution-path optimization. Performance recommendations must preserve this path and avoid restoring redundant structured decoding.

Important distinctions:

1. Direct mode intentionally has one process-resident backend, and ordinary close is a logical detach. Compatible reopen and retained temporary roots are features, not leaks. Terminal close spends the process's direct runtime.
2. The architecture explicitly says direct embedding temporarily owns PostgreSQL process-global environment and restores caller state at terminal close. That makes cwd/environment ownership a declared restriction, but the precise supported host behavior, signal restoration and failure-path cleanup still need to match it. Do not turn this into a request to silently create multiple independent in-process PostgreSQL instances.
3. Normal queries and streaming intentionally have no synthetic timeout. Ordinary close waits for admitted work and does not silently cancel SQL. A deadline for the broker's already-dispatched control exchange is a different concern.
4. Native server handles intentionally expose lifecycle and a connection string only; the external driver owns SQL, pooling and cancellation. Native server backup is explicitly deferred. The remaining generic readiness wire-client execution method can be removed because it has no production caller.
5. Archives are intentionally buffered today and native/WASIX physical formats intentionally separate. The 128 MiB broker transport ceiling is still an accidental product limit, because the public native backup contract does not establish that total-size limit.
6. Rust and JS already share their language query cores with WASIX. Keep these boundaries. The shared invariant, not one universal filesystem/FFI abstraction, is the appropriate unit of reuse.

Reassessment of the first pass

ID	Second-pass assessment	Action
ND1, P1	Confirmed. spawnManagedChild has no ChildProcess error listener. Its async startup callers cannot catch an emitted spawn error. Existence-only path checks do not cover executable permission, missing interpreter or removal races.	Preserve finding and process-level reproduction. Fix the shared wrapper once.
ND2, P1	Confirmed. Per-frame bound is intentional defensive framing; sending the entire backup in one frame is the wrong mechanism. It also affects large buffered raw results.	Keep per-frame bound; chunk/reassemble buffered responses, or explicitly decide and expose a total-size limit before SQL/backup dispatch.
ND3, P1 originally	Narrowed to P2 control-plane shutdown correctness. Waiting for earlier SQL is intentional. After Close is dispatched, both clients can wait forever for acknowledgement before their 5 s reap policy begins. A hard end-to-end shutdown bound requires an explicit policy for killing a hung helper.	Separate ordinary-work waiting from bounded Close exchange/reap. Preserve uncertainty reporting and exact resources.
ND4, P2	Confirmed independently of ND3. Rust swallows an explicit Error response and may return Ok(()); JS does report it.	Preserve command error even when later process exit is zero; aggregate later cleanup errors.
ND5, P2	Confirmed and expanded. JS server readiness handshake is unbounded inside its startup loop. Both JS and Rust broker authentication also occurs after the ready-line deadline with no socket I/O deadline.	Carry a single startup deadline through ready line, connection and authentication; abort/close the actual pending socket.
-F default	Source confirmed. No default Rust/JS override was found. Temporary default storage makes throughput-oriented defaults understandable; explicit persistent storage currently inherits the same fsync=off. Public durability expectations and measured profiles must be reconciled.	Parent owns core finding. Do not describe it as a hidden override by an SDK.
Missing automatic checkpoint	Source confirmed for ordinary sustained native writes; no SDK timer/checkpoint fallback found. Manual CHECKPOINT is documented, but missing a maintenance policy is a product issue for long-lived direct/broker instances.	Parent owns patch finding. Include native automatic maintenance policy in acceptance. Some DDL also requests checkpoints, so do not claim only explicit SQL/backup/exit ever checkpoint.
Signals/cwd	Source confirmed; no hidden SDK mitigation. Declared global-environment ownership qualifies the criticism. A host chdir() can still redirect later PostgreSQL relative opens. Signal installation/restoration is a separate implementation obligation from saved environment strings.	Parent owns source/compiler findings. Specify restricted direct embedding contract and test restoration on every terminal path; offer broker/server for independent process behavior.

New broker startup references: Rust launch:277, Rust authentication:598, JS launch:476. These findings concern stalled/crashed/mismatched helpers during routine startup, not an adversarial transport audit.

New findings

ND6 — P1: native detach reports success when PostgreSQL session reset failed

Location: liboliphaunt_native.c:648, specifically freeing ROLLBACK/DISCARD responses at 653 and 662 before examining their SQL outcome, then setting logical_active=false at 669. The byte exchange returns success at liboliphaunt_protocol.c:725 once ReadyForQuery is received, including ErrorResponse exchanges.

Intended behavior: a compatible logical reopen receives a reset session. A failed reset leaves the previous owner retryable, or terminally closes/poisons the runtime if safety cannot be established. JS direct.ts:45 explicitly explains retrying an interrupted DISCARD/ROLLBACK boundary.

Trigger and impact: a reset statement fails at SQL level, for example a statement timeout/SIGINT or an extension utility-hook error during DISCARD. The protocol operation can return 0 with ErrorResponse followed by ReadyForQuery. Detach treats that as successful cleanup and retires the owner. Prepared statements, temporary objects, session settings or even an aborted transaction can survive into the next logical generation. This affects every native adapter reaching this C boundary. It is distinct from ND4, which drops an already-reported C error in Rust broker transport.

Bounded reproduction: compiled unchanged production native.c, protocol.c, process.c, error.c, fs.c, trace.c; only the backend IO was simulated. The simulation supplies correctly framed ErrorResponse with severity ERROR, SQLSTATE 57014 and message, followed by ReadyForQuery. Output:

query=DISCARD ALL
detach_rc=0 logical_active=0 ready_status=I queries=1
query=ROLLBACK
query=DISCARD ALL
detach_rc=0 logical_active=0 ready_status=E queries=2

The second case starts with transaction status T, proving that failed reset can be acknowledged while the session remains E. This proves C handling of a SQL failure; it does not claim a live PostgreSQL timeout was reproduced. Source: detach harness (audit-local evidence: oliphaunt-audit-detach-harness.c; observation and scope recorded in this report).

Minimal action: validate no ErrorResponse, expected command tag and idle readiness before advancing through each reset step or changing logical ownership. Reuse/extract the existing command-confirmation helper used for backup control SQL; do not build another full query decoder. Preserve captured SQL error text. Return a retryable error while still owning the session, unless terminal shutdown is required to establish safety.

ND7 — P1: successful native restore does not durably publish the restored database

Location: liboliphaunt_archive_tar.c:1230 writes extracted files and closes them at 1252 without fsync; liboliphaunt_archive.c:835 renames the staging root without syncing the destination parent. liboliphaunt_fs.c:1039 syncs only descriptor creation and the staging root directory.

Intended behavior: static restore into a persistent destination either leaves no published database or returns a complete published root. Native new-root hydration already syncs its full tree before descriptor publication: initialize.ts:37. The restored root should get the same durability boundary.

Trigger and impact: restore returns success; power is lost before buffered restored data reaches durable storage. The descriptor may survive while relation/WAL/control files do not, or the final root name may not survive. An application that discards its input archive after a successful restore has no durable handoff guarantee. Atomic rename alone does not flush file contents or directory entries. Ordinary process termination is not a power-loss simulation.

Bounded evidence: compiled actual archive/filesystem implementations and intercepted fsync during a successful restore of a small structurally valid fixture. The only syncs were:

fsync: <stage>/.oliphaunt.json.tmp-...
fsync: <stage>
restore_rc=0

No restored PG file or destination parent was synced. The harness substitutes SHA functions solely to isolate the temporary advisory-lock filename; parsing, extraction, validation, descriptor writing and rename are actual source. It does not simulate recovery of a real pg_control or claim a power-loss reproduction. Source: restore harness (audit-local evidence: oliphaunt-audit-restore-harness.c; observation and scope recorded in this report).

Minimal action: sync restored files and directories while private, publish the descriptor only after those syncs, then rename and sync the destination parent. Define how a sync failure after rename reports an uncertain publication; do not delete a destination whose publication may already have occurred. Use the platform-specific existing durability primitives and qualification expectations, rather than a new archive framework.

ND8 — P2 measured performance: archive validation is quadratic in the number of files

Location: liboliphaunt_archive_tar.c:334 scans every prior canonical path; additional full scans at 362 and 395 handle strings and file ancestors. line 1465 runs the entire metadata pass again during extraction.

Intended behavior: validate the entire archive before writing, reject duplicate/colliding paths regardless of entry order. That intent is correct. Repeated unsorted arrays make ordinary partition-heavy schemas, many relations/indexes, and large catalogs expensive independently of bytes copied.

Measurement: exact source parser, cc -O2, Linux x64, three sequential samples per size. Fixture: zero-byte regular relation files in pgdata/base/1/, valid headers produced by the actual writer. Timed only process_physical_archive(..., write_entries=false), excluding archive construction and disk writes.

File entries	Archive bytes	Median validation seconds
2,500	1,281,024	0.066613
5,000	2,561,024	0.209691
10,000	5,121,024	0.743706
20,000	10,241,024	2.936796

Doubling from 10k to 20k is 3.95×. Actual restore performs two metadata passes plus writes; these numbers are not full restore latency. Harness (audit-local evidence: oliphaunt-audit-archive-harness.c; observation and scope recorded in this report).

Minimal action: collect canonical entries once, sort them, validate duplicate and file/descendant collisions using the sorted index, then extract the already-validated entry descriptors. A simple sorted index is sufficient; no generic filesystem tree framework or dependency is required. Preserve all existing rejected archive shapes. Measure file count separately from byte count.

ND9 — P1: accepted multiple raw exchanges can return another request's response

Location: liboliphaunt_protocol.c:17 checks frame lengths only and accepts multiple complete frontend messages; line 287 declares the response ready at the first Z; line 550 clears output state for the next operation. JS client.ts:204 and Rust ProtocolRequest admit raw bytes without an exchange-count contract.

Trigger and impact: submit two simple-query frames in one raw request, or multiple extended-protocol synchronization boundaries. If the second completion arrives later, the first call returns after the first ReadyForQuery. A following operation can consume the still-outstanding second response. This silently associates results with the wrong public call. Timing can also discard output. No malformed frame or hostile peer is needed.

Bounded reproduction: actual C protocol/lifecycle implementations with a backend IO fixture that delays the second completion 200 ms. One request contains two well-framed Query messages; the next contains a third. Distinct synthetic command tags identify completions:

first_request_two_queries_rc=0 returned_tag=Q1
next_request_query3_rc=0 returned_tag=Q2

This proves response miscorrelation in the C exchange boundary. It is a protocol scheduling harness, not a full PostgreSQL SQL execution. Source (audit-local evidence: oliphaunt-audit-raw-boundary-harness.c; observation and scope recorded in this report).

Minimal action: decide and enforce the raw contract. The smallest cohesive product is one complete request/response exchange per call: reject additional Q/Sync completion boundaries before dispatch and reject incomplete requests that cannot reach readiness. If pipeline support is intended, count/drain all expected readiness boundaries and retain undispatched output instead. Define COPY IN/OUT and Flush/Sync support explicitly before broadening validation. Mirror the same rule in streaming and all native adapters. Do not merely add a timeout to the desynchronized connection.

Other decisions and measured-work candidates

• Direct startup timeout cleanup: native.c:568 calls unpublished-handle close after startup wait failure, and physical close joins the backend thread at 755. A backend stuck inside initialization or a preload cannot be safely killed as a thread, so the startup wait setting is not a guaranteed total init-call bound. Clarify the direct contract; broker/server can supply process-level deadlines. This is a process-model limitation, not a recommendation for pthread_cancel.
• Cancellation control plane: broker auth/cancel reads have no deadline. The JS public close gate waits for admitted cancellations. A stalled helper can therefore block cancellation and subsequent cleanup. Reuse the bounded control-exchange mechanism from ND3/ND5; keep ordinary query execution unbounded.
• Node dispatch: each addon operation starts a detached OS thread and a new thread-safe completion callback, even though C already has a resident backend thread. Benchmark a permanent addon worker/queue against this before rewriting. A blind switch to libuv's global worker pool can regress isolation or worker termination.
• Parameter inference: ordinary untyped JS parameters cause Describe then execution, hence two C/broker exchanges and repeated Parse. Explicitly typed parameters can avoid inference. Measure typed/untyped short queries; consider reusing the inferred prepared statement only if ownership and custom codecs remain sound.
• Buffered copies: backup and large raw results cross C allocation → language allocation → broker frame → client allocation. ND2 must be fixed regardless; after that, measure peak RSS and throughput before deciding whether to add a streaming backup ABI.
• Rust runtime resolution: new helper processes hash tools/share/modules before cache lookup. Immutable packaged identities could support a receipt-validated warm path, while mutable local overrides keep content hashing. Measure cold install, fresh-process warm open and resident direct reopen separately.
• JS admission: the promise tail has no queued-byte bound and snapshots input before admission. Rust has a 256-command ordinary queue. This is a workload/product decision, not a confirmed memory leak; measure an intentional many-request backlog before choosing backpressure.
• Deletion opportunities remain valid: native JS tar.ts, zip.ts, unused readiness PostgresWireClient.execProtocolRaw, and node-adapter.canonicalPath have no production callers. The unused tar PAX Unicode bug should disappear with deletion, not get a new maintained implementation. Package/native install logic should stay outside hot query code; avoid adding a shared global framework to unify different host APIs.
• Tools facade: native psql correctly sets --file=-, disables rc/password prompting, applies ON_ERROR_STOP, and drains output while a separate thread writes a large script. Its allow/block list duplicates getopt semantics and must stay aligned to the pinned PostgreSQL version. No additional confirmed bug was found. Plain UTF-8 buffered stdout is its intentional contract; large dump streaming is a product decision.

Actionable checklist

Priorities separate required correctness (R), measured performance (M), and explicit product decisions/qualification (D). Dependencies refer to this table. Acceptance criteria are concrete outcomes, not instructions to build a generic framework.

ID	Kind / priority	Intended behavior	Minimal action	Acceptance criteria	Dependencies
ND-C01	R / P1	Logical reopen receives reset state	Validate ROLLBACK and DISCARD SQL success and idle Z before retiring owner	SQL ErrorResponse for either reset never returns successful detach; temp objects/prepared statements/settings cannot carry into successful reopen; error capture remains original	ND6
ND-C02	R / P1	Raw calls cannot steal later responses	Define/enforce one complete exchange, or implement counted pipeline drain	Two Q, two Sync, delayed second Z, incomplete Flush/Parse, COPY and ordinary single-exchange fixtures; next SELECT returns its own result	ND9; raw contract decision
ND-C03	R / P1	Successful restore hands off durable persistent data	Sync private data/tree; descriptor last; rename then parent sync	Syscall-order test plus crash/restart fixture; injected data/dir/parent-sync failures never report clean success or delete possibly-published data	ND7; core platform sync contract
ND-C04	R / P1	Native broker can carry ordinary large backups/results	Chunk bounded frames and reassemble without losing stream completion kinds	Both Rust/JS read below/exactly/above128 MiB responses; 256 MiB backup restores and next query works; peak RSS recorded	ND2
ND-C05	R / P1	Failed Node child launch rejects open	Handle spawn error in shared ManagedChild and complete ownership consistently	Non-executable existing file and missing interpreter reject open, process survives, temporary root/socket cleanup verified	ND1
ND-C06	R / P2	Dispatched Close has a finite control/reap policy	Apply control deadline before acknowledgement read; retain uncertain resources	Helper accepts Close then stalls; no query cancellation before teardown; configured close result settles; exact child reaped or ownership retained	ND3; D-C01
ND-C07	R / P2	Rust preserves native close errors	Decode and retain Close response, aggregate cleanup failure	Error then zero exit returns Err; malformed/EOF response not silently successful; JS/Rust shared fixture outcomes agree	ND4; ND-C06
ND-C08	R / P2	Startup deadline includes readiness authentication	Carry remaining deadline through ready/connect/auth; close pending stream	Ready-line then silent auth and accept-then-silent PG startup both time out; no late handshake publishes owner; no orphan child/socket	ND5; ND-C05
ND-C09	R / P2	Cancel control failure cannot prevent cleanup forever	Apply finite auth/cancel control I/O policy	Stalled helper rejects cancellation with attributable error; already-admitted cancel gate eventually lets close proceed; normal pg_sleep cancel recovers	ND-C06, ND-C08
ND-C10	M / P2	Restore metadata work scales with files	Sort/index canonical entries once; reuse validation plan	Preserve archive malformed/topology corpus; 10k→20k metadata time substantially below observed3.95×; record complete restore/RSS too	ND8; ND-C03
ND-C11	M / P2	Tiny Node queries avoid unnecessary thread creation	Benchmark persistent addon worker; implement only with gain	Compare median/p95 and thread count; all 57+5+1 cleanup cases remain green; out-of-band cancel unaffected	Existing addon lifecycle suite
ND-C12	M / P2	Parameter inference does minimum necessary work	Benchmark typed vs untyped; remove repeated Parse only where safe	Null, arrays, custom encoders, encoder throw, PostgreSQL inferred OIDs, transaction error boundaries preserved	Shared query-core owner
ND-C13	M / P2	Large backup/result memory is bounded where promised	Measure copies; consider streaming backup after transport repair	Peak RSS vs payload size measured direct/broker/JS/Rust; stream callback abort drains or poisons correctly	ND-C04
ND-C14	M / P2	Warm carrier lookup avoids redundant full hashing	Benchmark receipt identity for immutable packages	Fresh-process warm open fewer file reads; mutable override modification still invalidates; receipt mismatches reject	Parent packaging/identity work
ND-C15	R / P3	Only used archive/parser code remains maintained	Delete unreachable tar/zip and readiness helpers plus obsolete tests	Repository import/export scan and package typecheck pass; current artifact installer unchanged	No dependency
D-C01	D / P1	Shutdown and startup meanings are honest by mode	Document direct wait limitation; define broker control kill/unknown policy	Documentation distinguishes waiting for active SQL, logical detach, physical close, startup waiting and process deadlines; examples use cancel explicitly	Core lifecycle owner
D-C02	D / P1	Persistent storage has an explicit durability policy	Resolve native -F default versus persistent roots, align SDK docs and benchmark settings	Effective SHOW fsync/full_page_writes/synchronous_commit verified for default temporary, explicit directory, direct/broker/server	Parent core finding
D-C03	D / P1	Long-lived embedded stores stay healthy	Define native checkpoint/vacuum/ANALYZE maintenance ownership	Sustained writes stay within documented WAL target; reopen/recovery and table bloat/statistics workload quantified	Parent native/Postgres patch owner
D-C04	D / P1	Direct process-global ownership is explicit and correctly released	Specify signals/cwd/env restrictions; repair terminal/error cleanup	Host handlers/env/cwd verified before/open/detach/terminal close/init error; host chdir restriction enforced or safely supported	Parent core/compiler findings
D-C05	D / P2	Tools remain aligned to pinned PostgreSQL	Use shared option fixtures/generated metadata only where worthwhile	Accepted/rejected long abbreviations, short bundles, next-token values, UTF8/output behavior checked on pinned psql/pg_dump; large script cannot pipe-deadlock	Tools/package owner
D-C06	D / P2	JS queued memory behavior is documented and measured	Stress queue snapshots and choose backpressure only with evidence	Cancel/close still admissible, queued-byte/RSS measurement, defined behavior when caller queues thousands of large queries	ND-C11, product workload
Q-C01	Qualification / P1	Source fixes work against real current PostgreSQL	Run existing exact-artifact native smoke/regression plus targeted new reset/raw/restore cases	Current SHA artifact, real PG, fresh-process restore/reopen and query cancel; no silent artifact skip counted as live coverage	ND-C01–ND-C09
Q-C02	Qualification / P2	Adapter parity survives host differences	Run supported Node/Bun/Deno, Windows/macOS/Linux/ARM lanes	Same transport/reset/close outcomes; directory sync behavior qualified per OS; worker/finalizer lifecycle still proven	Q-C01

Coverage and explicit limits

Area / files	Flows traced this pass and retained first-pass coverage	Evidence / limit
C native, process, protocol, error, runtime, config, internal, trace, platform	Init validation → native owner thread; handle leases/retirement; retryable detach → reopen; terminal join; operation-local errors; cancel race; buffered/raw stream queues; callback rejection → drain → readiness	Actual C harnesses for reset and raw response ownership; generation/error suites pass. No live PostgreSQL library loaded.
C archive, archive_tar, backup_state, fs	pg_backup_start → data tree → control → pg_backup_stop → exact WAL range → manifest; cleanup/poison state; static restore lock → private validation/extract → descriptor → rename; topology and ownership	Actual parser timings and restore fsync observation. No real restore recovery/power-loss run. Static-extension registry inspected for boundary; extension bodies owned by sibling audit.
Rust database, direct, session, executor, cancellation, reply, query, protocol, engine, liboliphaunt/mod, ffi	Blocking/async ownership, capacity/admission, transaction pin/rollback/COMMIT uncertainty, parameter encoding, callback panic recovery, raw status poisoning, cancel/close gate, archive buffers	First-pass199 library tests passed, some runtime tests self-skip. Second pass traced code and C consequences; no blanket re-run without source changes.
Rust broker, ipc, broker_support, child_process, server, pgwire	Process launch → ready/auth → framed requests/stream/cancel → close/reap; startup guard, temporary roots; server listener/readiness/pg_ctl cleanup	Public fake-broker first-pass repros confirmed ND3/ND4. Source verified expanded auth deadline gap. No real server startup.
Rust root, descriptor/files/cluster_seed/runtime/cache_key/fingerprint/install/extensions	Prepare/root lease → hydration → descriptor → C external-root-lock; immutable cache identity versus mutable sources	Source traces. Parent owns cluster-seed/catalog/ICU compatibility. No full cache-content benchmark.
JS client, config/types/root-descriptor; runtime direct/broker/server/node-adapter/pgwire/frames/byte-stream/close/forgotten-handle	Query/execute/exec/describe; params snapshot/custom codec; managed transaction boundary; raw stream synchronous callback constraints; session poisoning; cancel gate; backup/static restore; process startup/cleanup	First-pass live Node wrapper/socket repros. Vitest unavailable because workspace node_modules absent. No packages installed during audit.
JS native node/node-addon/default/deno/ffi-layout/types/common/initialize/filesystem-durability; assets-node/assets-deno/cluster-seed/runtime-profile/extension contracts	Node/Bun addon choice, Deno nonblocking captures/pointer lifetimes, seed publication, extension input resolution, generation finalizers, cleanup ownership	Node addon exact source compiled in first pass and lifecycle suite57 single-image+5 copied-image+1 stale-acquisition passed. Deno/Bun source-only. Parent covers package/extension identities.
node-direct/native/node-addon/oliphaunt_node.cc and fixture/test script	All public dispatch paths: open, buffered/simple/raw stream, backup, restore, cancel, detach; TSFN and OS-thread completion, worker environment cleanup, stale owner tokens	Exact-source addon fixture suite passed first pass. No real PostgreSQL in addon.
Broker helper src/runtimes/broker/src/main.rs	CLI/open, primary/auth, all opcode dispatch, stream callback error classification, cancel endpoint, Error/close response, process exit	Full source read. No helper against real runtime.
Native tools crate src/lib.rs, arguments.rs, package-facing build inputs	psql command/script, pg_dump, managed flags, subprocess stdin/stdout/stderr, UTF8/error capture, runtime library environment	Compiled actual crate source directly with rustc --test; sole unit test passed. No packaged psql/pg_dump execution. Native tooling/release packaging and WASIX tools belong to sibling scope.

Artifacts are out-of-tree or under ignored target/audit. No production fix was applied. Current-source executable evidence is limited to the stated fixtures and Linux x64 host; a comprehensive checklist does not substitute for real PostgreSQL, platform or crash qualification.

Retained first-pass evidence and analysis (revised findings above take precedence)

Native desktop SDK and transport audit

Reviewed origin/main at e8192180bec4494c83bfa3adecbaa9b228b8f05d on 2026-09-07. No repository code changed. This is an audit, not an assertion that every line or supported operating system has been executed.

The Rust and JavaScript SDKs have substantial, useful protection around transaction ownership, uncertain COMMIT outcomes, cancellation versus close, callback panics, native handle generations, and cleanup. The clearest remaining defects sit below those state machines: process launch errors, broker frame sizing, and transport shutdown. The duplicated transport implementations already disagree on whether a failed native close is an error.

Prioritized findings

ND1 — P1: failed broker/server spawn can terminate the JavaScript application

Location: node-adapter.ts:146, especially the exit-only promise at lines 150–152. Production callers are openServer() in server.ts and launchBroker() in broker.ts.

Trigger: the selected broker or PostgreSQL executable exists but lacks execute permission, has an unavailable interpreter, is invalid for the host, or disappears between validation and spawn. File resolution generally checks isFile, which does not prove executable launchability. ChildProcess emits its asynchronous error event on spawn failure; this helper installs no error listener. The surrounding async try/catch cannot catch an unhandled event.

Impact: Node exits rather than rejecting open()/openServer(). The exited promise is also never settled for a failed spawn, since such a process has no normal exit event. Bun/Deno behavior was not executed; Node is confirmed.

Evidence: directly imported the current node-adapter.ts using Node 24.18.0 and called spawnManagedChild({executable:'/does-not-exist-oliphaunt-audit',args:[]}). Process exited 1 with Unhandled 'error' event / spawn ... ENOENT. The missing path is the minimal shared-helper reproduction; the public resolver's existence check does not protect the EACCES/race cases.

Smallest remediation: have the shared child wrapper capture spawn errors immediately and propagate them through its lifecycle result; make failed-spawn cleanup recognize that no process needs reaping. Fixing this once covers broker and server. Add one child-spawn failure test using a regular file without execute permission.

ND2 — P1: broker backup and buffered results fail above 128 MiB

Locations: ipc.rs:203, broker-frames.ts:141, broker main.rs:129, ipc.rs:175.

Trigger: backup() produces more than 134,217,728 bytes, or a buffered query has a larger aggregate protocol response. The helper writes an entire successful result or physical backup in one Ok frame. Both clients cap the payload of a single frame at 128 MiB. Rust's writer does not enforce the corresponding cap before sending, so it actually starts transmitting a response its clients cannot accept.

Impact: a legitimate database loses its broker backup path as its backup grows. The reader rejects the header and marks the broker transport failed, making the current handle unusable. A large query has the same behavior. The public Rust/JS physical backup documentation states direct/broker support without this limit. The threshold is serialized backup bytes, not necessarily exactly 128 MiB of logical table data.

Evidence: source trace from public backup -> helper session.backup() -> one write_broker_response() -> ResponseFrame::Ok -> bounded reader. A 13-byte response header advertising 134,217,729 bytes is rejected immediately by the actual JS reader: broker frame payload length 134217729 exceeds limit 134217728. No large allocation was necessary for this proof. No physical PostgreSQL backup was generated in this audit.

Smallest remediation: preserve a bounded per-frame limit and allow large buffered responses/backups to cross the IPC boundary in bounded chunks, reassembling for the current byte-returning API. The protocol already has chunk frames for raw streaming; use a compatible explicit framing rule instead of raising the limit indefinitely. Apply symmetric write validation and add a boundary test above 128 MiB. Document any intentional total-size ceiling.

ND3 — P1: broker close can wait forever before reaching its shutdown timeout

Locations: Rust broker.rs:405, JS broker.ts:225.

Trigger: the helper remains alive but does not finish native detach or return a Close acknowledgement; examples include a stopped helper process or a hung native lifecycle operation. Both implementations first synchronously/async-await write Close and read a response on a transport with no deadline. Only afterward do they enter their bounded wait/kill/reap code.

Impact: public close and async disposal never settle. The advertised bounded process cleanup cannot run. Rust synchronous close also blocks its caller; async Rust blocks its owner thread. This is distinct from the intentional policy that close waits for an admitted query: it happens after Close reaches the broker transport.

Evidence: instantiated the actual JS BrokerHandle with a 10 ms teardown timeout and a transport whose Close response remains pending. At 100 ms, detach was still pending and neither socket close nor child kill had been attempted. A small Rust public client opened an authenticated fake broker, then called close; the helper consumed Close without replying. The client remained blocked after six seconds despite BROKER_SHUTDOWN_TIMEOUT = 5 seconds and was externally terminated with its process group.

Smallest remediation: apply a deadline to the Close exchange itself, then close the socket and enter the existing kill/reap path. A JS Promise.race alone is insufficient if it leaves a live background read; its timeout must also retire the stream. Preserve the terminal error and exact ownership retention rules. One fake-helper test that withholds Close acknowledgement can exercise both SDKs.

ND4 — P2: Rust broker close reports success after an explicit native close error

Location: broker.rs:405 and the unconditional ignored read on line 406; helper error production at main.rs:138.

Trigger: the helper sends an Error frame for session.close() and exits normally. Rust explicitly discards both the Close write result and all reply content. It only reports later reap/filesystem failures.

Impact: Oliphaunt::close() and AsyncOliphaunt::close() can return success after a native teardown error. Transport failure or an invalid response can likewise disappear when the process subsequently reaps. This contradicts the retained exact-close-outcome contract. JS correctly checks and reports the Error frame, so this is actual SDK drift, not an intentional shared policy.

Evidence: compiled a small public Rust client against the exact reviewed crate. An authenticated fake broker returned Error("injected native detach failure") to Close, then exited 0. Output: opened followed by close result: Ok(()). Reproduction source remains in target/audit/2026-09-07/checks/oliphaunt-audit-rust-client.rs and target/audit/2026-09-07/checks/oliphaunt-audit-fake-broker.py.

Smallest remediation: decode and validate Close's terminal reply, collect its error, and still reap/delete only after safety conditions are met. Memoize that error through the existing public close machinery. Reuse the existing frame variants; no new state abstraction is needed.

ND5 — P2: JavaScript server startup timeout does not bound the handshake

Locations: server.ts:415, pgwire.ts:21, node-adapter.ts:234.

Trigger: the server accepts the readiness socket but never completes PostgreSQL startup/ReadyForQuery. waitForServer() checks its deadline only between attempts, then awaits an unbounded connect/write/read exchange. Process exit is checked only before starting that exchange. There is no socket timeout or AbortSignal propagated into it.

Impact: OLIPHAUNT_SERVER_STARTUP_TIMEOUT_MS can be exceeded indefinitely; no public server handle exists to close. Startup cleanup is never reached. Rust's PostgreSQL readiness client does set connect and I/O timeouts, showing another cross-SDK implementation difference.

Evidence: an actual local Node TCP server accepted a connection and deliberately withheld a PostgreSQL response. The current PostgresWireClient.connect() remained pending until the test destroyed the accepted socket. The independent source trace proves the surrounding deadline cannot interrupt that pending await. This was a transport test, not a hung real PostgreSQL process.

Smallest remediation: pass the remaining startup deadline into connection and readiness reads, destroy the exact socket when the deadline or child-exit signal fires, and let existing startup cleanup reap the child. Test a server that accepts but never sends ReadyForQuery.

Related edge cases worth including with the transport fixes

• Broker authentication and cancellation also use unbounded blocking socket reads in Rust and JS. The helper's cancellation listener handles accepted clients serially (main.rs:158); a client that connects without completing authentication stalls all later cancellations. On TCP fallback, another local process can do this without knowing the authentication token. Restrict authentication/control frame size and time, and make cancellation clients finite. This is source-confirmed; no adversarial live-broker test was run.
• The Rust broker accepts only one primary connection before authenticating it; failed first authentication ends the helper. Unix IPC is normally inside a private temporary directory, reducing exposure. The TCP fallback still deserves an authentication-phase test rather than assuming the token alone prevents denial of service.
• Rust's per-frame writer/reader size mismatch also means a too-large request may be transmitted before rejection. Shared framing fixtures currently emphasize ordinary frames; include symmetric oversized read/write cases.

Performance assessment

These are implementation costs established by source inspection, not measured PostgreSQL throughput regressions. Do not assign percentage savings without a real-runtime benchmark.

1. Each Node direct operation creates a new OS thread. oliphaunt_node.cc:405 constructs/detaches std::thread for open, query, stream, archive, and detach, with a fresh thread-safe callback completion object. The C runtime already has a resident PostgreSQL owner thread. This adds thread creation and two ownership handoffs to very small SQL calls. Compare a permanent addon worker/queue against this implementation before changing it; preserve out-of-band cancellation and all worker-termination tests. A blind move to the shared libuv worker pool could change contention and teardown behavior.
2. Ordinary JS parameters take two exchanges and two Parses. js-core/query.ts:453 assigns zero OIDs to ordinary values, performs Parse/Describe/Sync, then line 476 builds Parse/Bind/Execute/Sync again. Even a one-number parameter normally takes this path. With Node direct this also means two background threads; broker adds two IPC request/reply exchanges. Typed helpers with concrete OIDs already avoid inference. Benchmark reusing the unnamed prepared statement after Describe, under the existing exclusive operation boundary, before introducing a statement cache. Custom encoder reentrancy and parse-response shape must remain correct.
3. Buffered results/backup incur multiple full copies. Rust native response conversion copies C allocation into Vec<u8> before freeing it (liboliphaunt/mod.rs:505); broker framing adds transport-owned vectors; JS snapshots input and materializes raw rows before decoded rows. Raw streaming exists and is the appropriate present escape hatch for large results. If large backups are a requirement, a streaming backup boundary is more useful than tuning tiny string allocations. The 128 MiB cap above is correctness, independent of this performance recommendation.
4. Rust warm runtime resolution hashes source runtime content. runtime/cache_key.rs:79 fingerprints tools/share/modules before checking the cache; fingerprint.rs:88 reads every selected file. Broker helpers repeat this in fresh processes. Released immutable carriers already carry identity/receipts; using a verified release identity for the warm path could reduce open-time I/O. Keep full content hashing for mutable development overrides. Measure fresh-process open separately from resident direct reopen, which reuses its prepared root.
5. JS admission is unbounded while Rust async admission is bounded. withSessionOperation() builds an unrestricted promise chain (client.ts:620); calls snapshot/encode inputs before queuing. Promise.all over a large batch can therefore retain every query payload. This is a documented contract/performance design question, not a demonstrated leak. A bounded producer or clearly documented single-session queue is sufficient until workload measurements justify an API-level admission limit.

Quality, cohesion, and deletion opportunities

• Delete unused archive implementations first. src/sdks/js/src/native/tar.ts (158 lines) and zip.ts (139 lines) have no production callers anywhere in src or tools; only asset-resolver.test.ts imports them. They are outside the public export map. The tar parser additionally misinterprets PAX UTF-8 byte lengths as JS string indices when a Unicode record precedes another record; this was reproduced, but it is not a current product-path bug because nothing calls it. Delete both parsers and their now-obsolete tests instead of repairing unused infrastructure.
• Trim the readiness-only wire client. The JS PostgresWireClient.execProtocolRaw() path has no production caller after the server public surface became lifecycle-only. Its generic result-collection branches can be removed while retaining startup authentication and termination. canonicalPath() in runtime/node-adapter.ts also has no caller in the repository. These are small concrete cuts.
• Keep already-shared query cores. JS native and WASIX consume shared/js-core; Rust query logic wraps shared/rust-query-core. This is useful reuse. Do not merge host filesystem/FFI implementations merely to make file counts smaller.
• Share lifecycle conformance traces across SDKs. ND4 is exactly the failure generated golden scenarios can catch: close error, pending close response, spawn failure, response over frame limit, cancellation during close, and incomplete startup handshake. Reuse one fake broker and one sequence format instead of reimplementing unrelated per-SDK mocks that all return friendly replies.
• Place lifecycle rules once per language and test at the boundary. Rust already shares session.rs transaction logic between synchronous and asynchronous APIs, and cancellation.rs holds a focused gate. JS already routes queue/poison/close through OliphauntDatabaseBase. Preserve these sensible boundaries. NAPI lifecycle logic is large because it owns actual Node environment teardown and cross-thread callbacks; the passing hostile lifecycle tests are evidence that deleting guards indiscriminately would be risky.
• Separate packaging from hot-path work where a real boundary exists. The largest JS native file is the 1,765-line assets-node.ts; Rust root/runtime materialization also spans many modules. Content receipts, target catalog generation, archive installation, and user-session behavior have different change rates. Existing release resources should be consumed through one narrow verified install contract; avoid multiplying runtime profile vocabulary in each SDK. No new generic plugin/factory hierarchy is needed.

Scope and verification inventory

Area	Paths and flows inspected	Verification and limits
Rust blocking SDK	direct.rs, builder.rs, session.rs, query.rs, protocol.rs, cancellation.rs, liboliphaunt/mod.rs + ffi.rs; direct/broker/server ownership	199 library tests passed, crate built, public fake-broker reproduction compiled and executed. No full native PostgreSQL runtime built.
Rust async SDK	database.rs, executor.rs, reply.rs, engine.rs; admission, transaction pins, abandoned futures, panic/cancel/close paths	Existing unit suite includes bounded FIFO, close cutoff, callback panic, transaction failure and owner-thread tests. No new independent executor bug confirmed.
JS native SDK	client.ts/config.ts/types.ts; query/execute/exec/describe, parameter snapshots, managed transactions, poisoning, close/cancel/backup/restore	Direct source traces and bounded executable transport checks. Full Vitest suite could not start: workspace node_modules absent and vitest: not found.
Node/Bun direct bridge	native/node.ts, node-addon.ts, common.ts; complete C++ addon lifecycle, operation dispatch, streaming, finalizer generation and environment cleanup	Exact current production + instrumented addons compiled on Linux x64. Existing cleanup suite passed 57 single-image + 5 copied-image + 1 stale-acquisition cases using the fake C library. Bun and actual PostgreSQL execution not tested.
Deno direct	native/deno.ts, ffi-layout.ts, assets-deno.ts; nonblocking FFI, packed-pointer lifetimes, captured errors, stream callbacks, generation finalizers	Source review only; no Deno runtime installed/executed. Explicit extension-materialization limits are documented and intentional.
Broker shared product	runtimes/broker/main.rs, SDK broker transports, IPC codecs; spawn/auth, query/stream, cancel, backup, terminal close	Current Rust public client + authenticated fake broker; JS actual handle and frame decoder tests. Normal physical runtime unavailable.
Native local server	Rust server.rs/pgwire.rs/child_process.rs; JS server.ts/pgwire.ts/node-adapter.ts; startup probe, listener, pg_ctl, forced reap	Source review, JS accepted-socket stalled-handshake test. No live native PostgreSQL server, Windows, macOS, or ARM execution.
Runtime roots/assets	Rust liboliphaunt/root tree; JS initialize/root-descriptor/runtime-profile/cluster-seed/assets/extension contracts	Existing Rust tests cover root locks, descriptor publication, filtered install, extension identity and fingerprinting. This was a boundary-focused review; extension source/build correctness belongs to the extension audit.
Shared query behavior	shared/js-core query/protocol; native Rust wrapper around shared/rust-query-core; shared protocol/SQL fixtures	Existing Rust malformed-protocol corpus and deterministic parser tests passed. JS codecs reviewed for nulls, binary/text, type inference, arrays, duplicate names, notices and encoder exceptions; no additional confirmed product bug.

Tests that require an actual native artifact may self-skip when the library is unavailable; the 199-pass result must not be described as 199 live-PostgreSQL tests. <local-workspace> did not exist. The test addon was built from this exact source, but its C library was the repository's fake lifecycle fixture.

Cross-cutting parent-audit confirmation: neither Rust OpenConfig::default (config.rs:138) nor JavaScript normalizeOpenConfig (config.ts:48) adds fsync=on. The C runtime's default durability settings therefore reach both SDKs unchanged. Core PostgreSQL patch/cwd/durability findings are owned by the separate runtime audit and should not be double-counted here.

Recommended order: fix ND1–ND4, make startup/cancel handshakes finite, add the shared hostile-transport scenarios, delete dead parsers, then benchmark the Node thread-per-operation and double-Parse costs. Keep the working transaction and generation protections while simplifying around them.

[f0rr0]

Supporting report C: Swift, Kotlin, JNI and React Native

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

Mobile SDK second pass: intent, correctness, and implementation checklist

Reviewed commit: e8192180bec4494c83bfa3adecbaa9b228b8f05d.

This is a second review of Swift, Kotlin/Android JNI, and React Native. It challenges the first pass against the current product contracts, rechecks boundary ownership, and adds two reproduced correctness findings. Production sources were not edited. Findings here distinguish runtime correctness, API policy, qualification evidence, and workload-dependent performance. The original evidence is in <audit-scratch>/oliphaunt-audit-mobile.md; the supported first-pass findings and all actionable follow-up work are restated here.

Intent and history evidence

Primary local design sources reviewed:

• docs/maintainers/mobile-stability-model.md: one process-resident native backend; platform-owned serial execution; cancellation is out of band; FIFO admission; callback recovery and failure precedence; invalidation retires callback delivery and asynchronously schedules close; operation-local error snapshots; installed-app E2E is the final mobile execution gate.
• docs/architecture/ios.md: a different native-direct root requires a fresh process; close is logical detach; applications own foreground/background policy; no independent mobile sessions, server mode, crash isolation, or replacement restore.
• docs/architecture/database-storage.md: native temporary storage lasts for the physical backend lifetime; directory selectors name managed roots; descriptors are published last; persistent roots are never deleted by close.
• docs/architecture/stable-database-api.md: typed/one-statement operations, raw escape hatches, OID-aware getters, strict encoding, callback transactions, close-only poisoning, exact rollback/commit outcomes, and deliberate omission of prepared-statement caches/pools/COPY objects/global parsers.
• docs/maintainers/native-runtime-contract.md and docs/maintainers/sdk-products-policy.md: Swift/Kotlin own mobile behavior; React Native delegates to them; native C validates a complete root and does not initialize it; exact extension packaging does not automatically execute CREATE EXTENSION.

History checked:

• fae2bd7b (feat!: unify native and WASIX runtimes and SDKs, feat!: unify native and WASIX runtimes and SDKs #129) removed the old Swift nativeDirectEngineExecutesAgainstLinkedLiboliphauntWhenAvailable test, including the env-backed real query/cancel/backup path.
• 4384d1bd (feat(sdk)!: unify embedded PostgreSQL public APIs, feat(sdk)!: unify embedded PostgreSQL public APIs #153) introduced the current platform transaction/admission layers, callback guard, Kotlin cleanup guard, and mutex-protected Swift bridge diagnostic storage. Its clear intent is stronger lifecycle safety, not a general multi-session mobile engine.
• 2d5f90c8 (refactor(ci): model independent product dependencies, refactor(ci): model independent product dependencies #173) establishes the present Swift smoke task, which supplies a native-required environment flag to the current test suite.
• Current .github/workflows/ci.yml has distinct Android/iOS installed-app E2E jobs, and examples/react-native-expo/src/mobile-smoke.ts exercises real raw bytes, streaming callback abort/recovery, cancellation, and backup through React Native. This is real intended runtime coverage; the Swift smoke defect does not mean that the repository has no mobile E2E design.

Prior findings: disposition after considering intent

First-pass item	Second-pass disposition	Reason
M1: React Native lost acknowledgement during invalidation	Retain, P1 correctness	Retiring the JS runtime is supported lifecycle behavior. Cleanup must not depend on a callback that retirement can discard. Both platforms have a check/register race.
M2: concurrent Kotlin temporary opens can delete another initializer's root	Retain, P1 correctness	Only one successful direct open is supported, but the losing open must reject without deleting a winner's state. nativeOpenAttempted is not ownership of the process-shared directory.
M3: JNI modified UTF-8 used as native UTF-8	Retain, P2 correctness	No ASCII-only restriction exists for user directory paths, role/database names, or GUC values. Valid supplementary Unicode is corrupted.
M4: Swift detached callback reentry bypass	Retain, P2 contract enforcement	The attempted reentry is prohibited caller behavior; the defect is a promised rejection becoming an indefinite wait. This is not a normal single-query failure. Kotlin already enforces a database-wide callback-active guard.
M5: Kotlin packet allocation amplification	Reclassify as conditional performance, P2 optimization	The allocation was measured, but it is not a universal workload regression or evidence that all ordinary small queries are slow. The caller-thread effect matters primarily for large parameters.
M6: Swift native smoke never uses native runtime	Retain, downgrade to P2 qualification-truth defect	The named task and env-backed docs are misleading, but installed-app E2E is separately intended to provide final mobile runtime qualification. Direct Swift/Kotlin typed API execution still deserves its own honest smoke.
Missing Kotlin pgdata-root symlink preflight	Do not classify as runtime acceptance	Final C managed-root validation rejects the symlink, before the managed-root open path mutates it. This is redundant-validation drift only.
Swift serial queue is not a fixed pthread	Reject as a finding	Native C owns PostgreSQL's backend pthread. Host serial queue migration is compatible with the documented scheduling contract.

Correction to first-pass performance wording: QueryRow construction copies its list (values.toList()), not all cell byte arrays. Public accessors do copy cell bytes intentionally to retain ownership. The frame-copy and byte-list allocation observations remain valid.

Correctness findings and supported triggers

MOB-C01 — P1 — Make React Native acknowledgement registration atomic with invalidation

Locations: Android src/sdks/react-native/android/src/main/cpp/OliphauntJsiBindings.cpp:96-100, :110-120, :464-507; iOS src/sdks/react-native/ios/Oliphaunt.mm:906-916, :954, :1297-1309.

Android's native producer can retain its PendingStream, lose a race to invalidation while its acknowledgement is null, and then register a new acknowledgement through acknowledgeWith, which never inspects invalidated. It subsequently waits on that acknowledgement. If the retiring runtime drops the queued JS invocation, close cannot drain the owner. iOS checks _invalidated under a lock, releases it, and registers the acknowledgement afterward, leaving the equivalent race with OliphauntAbortChunkAcknowledgements().

A C++ reproduction uses the actual Android state-class definitions with an inert callback type: abort(); acknowledgeWith(ack); ack.wait() remains blocked after a bounded wait. Output: invalidation before acknowledgement leaves native owner waiting: true. This proves the missing state transition; no React Native device was used. A check inside the queued callback cannot prove safety when the callback itself may never execute.

Intent-preserving fix: make registration fail/reject immediately once its owner is invalidated; make that decision under the same owner lock as invalidation. Preserve synchronous backpressure during normal operation and asynchronous module cleanup. A timeout is not a substitute for fixing the lost registration.

MOB-C02 — P1 — Delete only staging that the failed Kotlin initializer owns

Location: src/sdks/kotlin/oliphaunt/src/androidMain/kotlin/dev/oliphaunt/AndroidNativeDirectEngine.kt:137-144; process-shared temporary root :518-526; independent per-open dispatcher :30-35; descriptorless nonempty rejection :218-221.

Two default opens receive the same process temporary root but prepare it independently. Once the first creates seed staging, the second can reject the descriptorless nonempty root and then call storageDirectory.deleteRecursively() because its own nativeOpenAttempted is false. The first call's staging/PGDATA is deleted. If the losing cleanup is delayed, it can run after the winner has published or opened. This schedule follows directly from the source; it has not been run against Android PostgreSQL.

The intended one-open limit does not justify deleting another caller's physical state. React Native has an earlier process-open claim and serializes this path, so the confirmed API exposure is direct Kotlin.

Intent-preserving fix: remove broad process-root deletion and retain cleanup of unique staging paths; if process-open admission is added, it must precede preparation, not just JNI. Swift's selective publication cleanup is an existing reference behavior.

MOB-C03 — P2 — Standard UTF-8 at the Android JNI boundary

Location: src/sdks/kotlin/oliphaunt/src/androidMain/cpp/oliphaunt_android_bridge.cpp:66-76; open identity/path/config :350-363; array conversion :79-90; restore destination :582.

GetStringUTFChars returns JNI modified UTF-8, which is passed directly to native file paths and PostgreSQL UTF-8 strings. The supplementary character in db-😀 becomes two encoded surrogate halves. Kotlin/Java creates one path and C opens another. React Native Android inherits this conversion.

Actual helper reproduction:

UTF-8: 64622df09f9880
JNI:   64622deda0bdedb880
Java path exists: true; native SDK conversion path exists: false

Fix one shared conversion boundary, either standard UTF-8 bytes supplied from Kotlin or correct UTF-16-to-UTF-8 conversion. Keep NUL validation. Do not change SQL parameter bytes, which already use Kotlin's explicit UTF-8 encoder, to JNI string encoding.

MOB-C04 — P2 — Enforce Swift stream callback reentry across task/queue boundaries

Location: src/sdks/swift/Sources/Oliphaunt/Oliphaunt.swift:315-316, active flag :290-308, admission guard :1124-1128.

The TaskLocal-only guard rejects inheriting Task {} work but not Task.detached or other queue work. A synchronous callback that waits for such prohibited database work deadlocks behind its own stream. The existing active flag is locked but never read by isReentry.

The compiled unchanged Swift SDK, exercised through its fake-session seam, produced:

callback wait timed out: true
detached callback work unexpectedly succeeded
native calls: 2, expected 1 when reentry is rejected

Fix by consulting the existing lock-protected active state as well as TaskLocal scope. Keep cancellation as the documented exception. This improves deterministic handling of contract misuse; it does not add supported callback reentrancy.

MOB-C05 — P2 — NEW: Swift bridge overwrites operation-local diagnostics during cancellation

Locations: src/sdks/swift/Sources/COliphaunt/bridge.c:69-94, :136-149, :432-451; caller reads at src/sdks/swift/Sources/Oliphaunt/OliphauntNativeDirect.swift:760-761, :863-865.

The native core already maintains a completed-operation error snapshot on the calling thread (src/runtimes/liboliphaunt/native/src/liboliphaunt_error.c:17-19). The Swift bridge copies that snapshot into shared session->last_error or shared global_last_error. Swift then makes a separate oliphaunt_swift_copy_last_error call. Between the return code and that call, an out-of-band failing cancellation can replace the session message. Concurrent failing opens/restores can likewise replace the global message. Mutexes prevent a memory race but do not preserve which operation an error describes.

This contradicts the operation-local diagnostic promise in mobile-stability-model.md. It can replace the authoritative transport failure with a cancellation failure, obscuring the cause of a poisoned database. Kotlin JNI keeps error capture on the calling thread and constructs the Java exception immediately, so it does not share this extra storage race.

New deterministic repro: compile the actual Swift bridge.c with fake native symbol callbacks whose errors are thread-local. Thread A completes a failed protocol call, thread B completes a failed cancel, then thread A requests its bridge error:

query caller expected QUERY_A error; received: CANCEL_B error

Fix the bridge's completed-operation snapshot semantics, ideally mirroring the native C thread-local snapshot or returning owned error data with the operation result. A handle-wide fallback may remain for genuine cross-thread diagnostic requests; it must not override the completed calling-thread result. Also preserve bridge-originated open/symbol-loading errors.

MOB-C06 — P2 — NEW: Oversized Android native responses wrap into successful truncated Java arrays

Locations: src/sdks/kotlin/oliphaunt/src/androidMain/cpp/oliphaunt_android_bridge.cpp:422-429, :551-558; defensive stream counterpart :263-272.

Buffered query and backup responses expose native size_t lengths. JNI allocation and copying cast those lengths to signed 32-bit jsize without checking representability. Lengths over the Java limit must be rejected. A length of 4 GiB + 16 wraps to 16, and the backup function returns success with a truncated archive. The byte-array public API inherently has a size limit; this finding does not propose a new archive API.

New JNI boundary reproduction calls the actual backupNative function with a mocked native response whose advertised length is 4 GiB + 16:

native backup length = 4294967312; Java success length = 16

The mock allocates only the 16-byte prefix that the buggy wrapper reads. This proves the length-conversion defect without allocating a 4 GiB archive; it is not a device-scale backup test. A real triggering backup requires a sufficiently large native archive and device memory.

Fix: reject response.len > numeric_limits<jsize>::max() before any cast or copy, and free the native response on the error path. Apply the same conversion policy to buffered protocol and streaming bridge boundaries. Existing React Native makeByteArray already checks the reverse direction; reuse that rule, not a new dependency.

Qualification and performance findings

MOB-Q01 — P2 — Restore truthful Swift native smoke evidence

src/sdks/swift/moon.yml:53-64 sets OLIPHAUNT_SWIFT_REQUIRE_NATIVE=1 and real native paths, but the variable has no other repository consumer. Current swift test passes all 94 tests even when both native paths point to nonexistent directories. The old env-backed test was removed in #129. The C smoke dependency proves C independently; React Native installed-app E2E proves its own platform route, which uses raw protocol in Swift/Kotlin and TypeScript-side typed decoding. Neither makes this named direct Swift typed smoke truthful.

Fix the command/test and corresponding documentation. Native-required mode must fail when its native inputs are unusable. Keep ordinary unit tests artifact-free, and keep installed-app E2E as the separate platform release requirement.

MOB-P01 — P2 conditional optimization — Replace Kotlin byte-list packet construction

src/sdks/kotlin/oliphaunt/src/commonMain/kotlin/dev/oliphaunt/Query.kt:640-646, :1622-1634, :1650-1668 build each message as MutableList<Byte>, convert it to bytes, append it into another reference-backed byte list, and convert again. The public query/execute functions build the packet before owner dispatch (:563, :573).

One Linux JVM run around actual compiled extendedQueryProtocol after a small warmup, excluding initial parameter construction, measured an 8 MiB parameter producing an 8,388,673-byte packet while allocating 227.3 MiB, taking 269.2 ms. This is an allocation finding for large payloads, not a mobile latency benchmark or evidence of a regression against a prior implementation.

Use one pre-sized ByteArray with offset writes, or an already available byte-oriented writer. Keep byte ownership at public boundaries. Additional candidates that require their own measurements are the repeated frame scans/copies (:1003, :1057-1119) and one-byte arrays used for scalar reads (:1574). The list-only copy in QueryRow construction is not an additional cell-data copy.

MOB-P03 — P3 investigation, not an asserted regression — Swift extension registration working set

src/sdks/swift/Sources/Oliphaunt/OliphauntExtensionResources.swift:383-398 loads each resource file, base64-encodes its contents into strings, retains those strings, then fingerprints their concatenation. Generated extension register() is synchronous. Large selected resource closures could therefore create a substantial startup working set on the caller thread. No mobile measurement was performed; the cache is based on trusted packaged bytes, so this is not a claim that the fingerprint is a security boundary. Measure a representative PostGIS closure before changing it; if meaningful, hash bytes incrementally and avoid base64 materialization while preserving deterministic cache identity.

Area-by-area coverage and choices to retain

Area	Second-pass review	Result / intended constraint
Parameters	Swift/Kotlin parameter ownership, nullable bytes, explicit OID zero rejection, text/binary formats, big-endian packet construction, JS query-plan/describe-bind handoff	Scalar factories carry OIDs; raw typed bytes remain available. Fix JNI config strings separately from parameter encoding. Kotlin packet allocation and JNI output length are supported issues.
Result decoding	OID/format checks for booleans, fixed integers, floats, UUID, bytea text/escape/binary; strict UTF-8; duplicate column names; diagnostic fields; raw fallback	No additional normal PostgreSQL scalar-value defect found. Native APIs intentionally do not manufacture JS-style decoded object maps or automatic custom/array codecs.
Query parser	Parse/Bind/Describe/Execute ordering, single statement enforcement, simple multi-results, notices, command tags, terminal ReadyForQuery, error precedence	Existing shared fixtures and mock parser tests are substantial. Keep canonical PostgreSQL metadata; do not introduce another React Native parser.
Bind counts	Swift/Kotlin and shared JS explicitly cap at 32767 and parse signed 16-bit counts	Explicit API limit/policy. Document and test it; do not raise it independently in one mobile SDK. A wider PostgreSQL limit is not automatically a mobile correctness defect.
Transactions	BEGIN recovery; callback throw; concurrent queued operations; explicit rollback settlement; COMMIT uncertainty; caught statement errors; ownership escape	Manual outer transaction control and AND CHAIN are deliberately unsupported; savepoints remain supported. Do not interpret poison-on-escape as an accidental restriction.
Cancellation	Separate native owner; cancellation drain before teardown; Kotlin NonCancellable phase; Swift task cancellation checks	Cancel targets the runtime's active operation, not an operation ID. Kotlin queued cancellation can skip work before native dispatch; tests explicitly cover queued BEGIN/close skipping. Document that distinction instead of forcing all canceled queued work to execute.
Close/forgotten owners	Swift deinit queue; Kotlin phantom cleaner and fallback owner; JNI detach; RN process claim and generation cleanup	Explicit close is deterministic; forgotten cleanup is best effort; logical detach retains the backend. No requirement for mobile root switching or crash isolation.
Streaming / COPY	JS synchronous callback markers, Swift/Kotlin recovered-abort sentinels, JNI callback status; module invalidation; caller backpressure	Complete native frontend input and raw response streaming are intentional. Do not add interactive COPY handles or allow async callbacks. Fix C01/C04 without changing those policies.
Storage / restore	root classification, descriptor publication, unique staging, seed hardening, complete PGDATA gate, native static restore, input-byte snapshots	Fix C02. Root symlink acceptance is finally prevented by C. Descriptor-last and create-only restore are intentional and should remain.
Packaged resources	Swift bundled discovery and exact fragment registration/composition; Kotlin manifests, static registry readiness, source/cache copying, seed target/profile checks	Keep release-resolved exact extensions and standard/ICU closure identity. Do not automatically activate SQL extensions or add runtime download resolution in every language.
RN platform parity	configuration normalization, handles, typed-array offsets, binary copy boundaries, open/close claim, callbacks, invalidation, detached cleanup	Swift/Kotlin delegation is the right product boundary. Share small proven transition fixtures where implementations drift; a universal native SDK rewrite is not justified.
Qualification	Swift task/test history, Kotlin unit/build task split, native bridge tests, RN installed-app workflow/example	Unit passes and compile/header closure gates do not prove device runtime behavior. Q01 is a target defect; installed-app E2E remains necessary.

Actionable implementation checklist

Each item is intentionally bounded. Correctness fixes can proceed independently except where dependencies are named; conditional optimization items require their stated evidence before expanding scope.

• MOB-C01 — P1, correctness: Keep normal one-chunk backpressure and make late acknowledgement registration reject atomically after owner invalidation on Android and iOS. Minimal fix: use the existing owner lock/state; share only the small state helper if it reduces duplication. Acceptance: deterministic invalidate-before-register and register-before-invalidate tests unblock the producer exactly once; retired runtime receives no callback; subsequent module/open can acquire the process owner. Depends on: no production prerequisite; device confirmation under MOB-Q03.
• MOB-C02 — P1, correctness: Preserve another initializer's process-temporary PGDATA. Minimal fix: remove whole-root deletion on unowned preparation failure; retain unique-staging cleanup. Acceptance: two default opens paused around seed staging/descriptor publication produce at most one winner; the loser leaves winner files and queryability intact; existing nonempty roots remain unchanged. Depends on: none; reuse current publication helper seams.
• MOB-C03 — P2, correctness: Carry standard UTF-8 across every Android JNI string-to-native field. Minimal fix: one shared boundary conversion used by open, restore, paths, identities, and startup args. Acceptance: ASCII/BMP/supplementary round trips; db-😀 opens/restores through the actual JNI path; supplementary GUC/identity value is preserved or PostgreSQL reports its normal semantic error, not invalid encoding; NUL still rejects. Depends on: none.
• MOB-C04 — P2, contract enforcement: Reject same-database work originating in an active Swift raw callback even when task-local context is absent. Minimal fix: read the existing active flag under its lock and retain TaskLocal detection. Acceptance: detached task and DispatchQueue reentry fail within a bounded check, issue no second native request, preserve callback-error recovery, and still permit cancel. Depends on: none.
• MOB-C05 — P2, correctness: Preserve the native operation's own Swift diagnostic through a concurrent cancel/open/restore failure. Minimal fix: operation-local bridge snapshot or owned error return; no shared-slot overwrite between return code and Swift copy. Acceptance: query/cancel and two failing no-handle operations retain distinct messages; repeated size probe/copy is stable; long errors and bridge-originated loading errors remain intact. Depends on: retain the native C snapshot contract.
• MOB-C06 — P2, correctness: Reject unrepresentable JNI response lengths and always release native output. Minimal fix: checked size_t to jsize conversion for output arrays and chunks. Acceptance: boundary doubles for INT_MAX+1, UINT32_MAX+1, and 4 GiB+16 never return successful truncated bytes; every rejection frees output exactly once; small outputs remain byte-identical. Depends on: none; no huge-memory test required.
• MOB-Q01 — P2, qualification truth: Make the Swift native-required smoke execute Swift-to-C PostgreSQL or rename it and remove the unconsumed requirement claim. Minimal fix: one required native integration test/consumer, separately selected from unit tests. Acceptance: nonexistent native paths fail required mode; real mode proves open/query/parameter/close; unit mode remains artifact-free; README and moon task agree. Depends on: usable host native artifacts.
• MOB-Q02 — P2, typed API coverage: Exercise Swift and Kotlin typed facades against real PostgreSQL, not only the RN raw path and mock packets. Minimal fix: extend the direct integration smoke with typed null, binary bytea, custom OID raw fallback, duplicate names, statement error recovery, explicit rollback, and uncertain boundary injection where practical. Acceptance: run reports distinguish native execution from fixtures and retain public error types and field/byte parity. Depends on: Q01 and an Android installed/test runtime.
• MOB-Q03 — P1 before shipping lifecycle fixes, device qualification: Run installed iOS/Android RN lifecycle regressions against the exact candidate artifacts. Minimal fix: extend current app smoke, not a second example app. Acceptance: active streaming plus runtime invalidation cannot strand close/open; cancellation recovers to ReadyForQuery; callbacks remain one-in-flight; old finalizers cannot close a newer generation. Depends on: C01/C03/C04/C05 and platform runners.
• MOB-Q04 — P1 before durability claims, storage qualification: Exercise process kill/WAL recovery, low-storage seed publication, and physical restore through the installed platform adapters. Minimal fix: use current mobile drill/receipts and deliberately injected initialization failure points. Acceptance: no descriptor-only accepted root; no losing-open deletion; successful acknowledged persistent writes meet the chosen native durability contract; restore never replaces nonempty data. Depends on: C02 and the parent audit's native fsync/durability decision.
• MOB-P01 — P2, conditional performance: Replace Kotlin byte-list packet construction for large parameters. Minimal fix: a pre-sized byte buffer/offset writer in Query.kt; retain public ownership copies. Acceptance: existing protocol byte fixtures unchanged; 8 MiB allocation probe substantially below the 227.3 MiB baseline with bounded linear space; compare realistic small-query latency and Android UI scheduling before claiming a general speedup. Depends on: none.
• MOB-P02 — P3, conditional performance: Measure repeated parser frame scans/copies and scalar-read allocations before a broader parser rewrite. Minimal fix if justified: frame spans and direct scalar indexing within the existing parser. Acceptance: allocation/throughput evidence for large rows; malformed frames, notices, duplicate fields, ReadyForQuery and transaction-escape precedence retain current behavior. Depends on: P01 baseline and existing shared fixtures.
• MOB-P03 — P3, investigation: Measure Swift extension registration working set and cold-start time for actual selected resources. Minimal fix only if material: incrementally fingerprint raw bytes instead of retaining base64 strings. Acceptance: deterministic resource identity and conflicting-file detection unchanged; app startup measurement improves with no weaker artifact validation. Depends on: representative packaged PostGIS/SQL resource closure.
• MOB-O01 — P2, maintainability: Add cross-language lifecycle transition fixtures for the concrete drift found here. Minimal fix: common schedules/expected outcomes for callback abort, native failure precedence, transaction drain/cutoff, late acknowledgement, and unowned cleanup; retain platform-specific executors. Acceptance: Swift/Kotlin/RN adapters each consume relevant scenarios; changing one shared semantic expectation requires one fixture change. Depends on: C01/C02/C04/C05 behaviors settled.
• MOB-O02 — P3, maintainability: Keep canonical manifest/catalog domains generated or fixture-checked across SDK resource loaders. Minimal fix: reuse existing cluster-seed/extension-runtime fixtures for missing/extra fields, duplicate domains, static-registry stems, and ICU target/profile pairing. Acceptance: package and runtime validation agree without introducing a second downloader or extension catalog. Depends on: parent extension/package audit findings.
• MOB-D01 — P2, documentation/policy: Precisely distinguish admission, queued cancellation, native dispatch, and completed close. Minimal fix: align README language with Kotlin tests that intentionally skip canceled queued BEGIN/close, and retain explicit cancel semantics. Acceptance: a canceled queued close is documented as possibly leaving a live handle requiring a later close; once native teardown is admitted to execution its ownership transition completes. Depends on: current policy retained; no API rewrite needed.
• MOB-D02 — P3, documentation/policy: Record explicit parameter-count and output-byte limits consistently. Minimal fix: document 32767 bind/describe inputs while that common cap remains; document Java byte-array output ceiling after C06. Acceptance: boundary tests and error messages match; any later widened count is coordinated with shared JS and native parsers. Depends on: C06 for truthful oversized-output behavior.

Checks, artifacts, and remaining limits

Existing checks completed in the first pass and still applicable because production sources are unchanged:

• Swift unit suite: 94 passed.
• Kotlin JVM suite: 79 passed.
• Kotlin Android debug unit suite: 133 passed; this is not an Android JNI/PostgreSQL runtime test.
• Swift C bridge mutex-init failure check and Kotlin C++ stream completion classification check passed.
• Actual Swift callback, actual JNI Unicode, extracted RN acknowledgement state, and actual Kotlin allocation probes reproduced their reported outcomes.

New second-pass checks:

• Actual Swift C bridge linked to thread-local native error doubles reproduced query/cancel error substitution.
• Actual Android JNI backup entry point linked to a native response-size double reproduced successful 4 GiB+16 to 16-byte truncation.
• Design/history review verified that queued Kotlin cancellation and one-process native lifetime are intentional, and that the removed Swift real-runtime test has no replacement in its current test suite.

Reproduction sources and the missing-native smoke log were copied into mobile-repros/ beside this report. They are audit artifacts, not new production tests. The C/JNI probes include the unchanged source from this checkout. Swift/JVM execution probes use the first-pass builds in <audit-scratch>/oliphaunt-audit-swift-build and <audit-scratch>/oliphaunt-audit-kotlin-build.

No Apple/Xcode/iOS device execution, Android PostgreSQL device/emulator execution, or live React Native invalidation was performed here. No 4 GiB archive was allocated. No mobile performance improvement is claimed from a desktop JVM measurement. RN TypeScript tests were not rerun in this subtask; its protocol implementation is shared with @oliphaunt/js-core, which belongs to the parallel JavaScript review. The parent extensions/tools audit owns detailed Gradle/SwiftPM/npm carrier tooling, release manifests, and the full extension catalog; this subtask reviewed their mobile runtime consumption boundaries.

Retained first-pass evidence and analysis (revised findings above take precedence)

Mobile native SDK audit

Commit: e8192180bec4494c83bfa3adecbaa9b228b8f05d (fetched main). No repository files changed.

Prioritized findings

M1 — P1 — React Native invalidation can strand a streaming native owner forever

Locations:

• src/sdks/react-native/android/src/main/cpp/OliphauntJsiBindings.cpp:96-100, :110-120, :464-507.
• src/sdks/react-native/ios/Oliphaunt.mm:906-916, :954, :1297-1309.

Trigger: invalidate/reload the React Native runtime while a native stream is between locating its stream state/checking the module and registering the next chunk acknowledgement.

Android execution order: nativeEmitChunk retains a PendingStream; invalidation clears the map and calls abort() while its acknowledgement is null; the producer subsequently calls acknowledgeWith(), which does not inspect invalidated, schedules onto the retiring JS runtime, and waits without a deadline. If that runtime no longer services callbacks, nobody rejects this new acknowledgement. The owner remains inside the callback, so scheduled close cannot drain and the process-wide native owner cannot be reused.

The iOS path has the equivalent gap: the _invalidated check is under @synchronized, but acknowledgement registration happens after releasing that lock. OliphauntAbortChunkAcknowledgements() can finish in between. Checking _invalidated inside the queued JS callback does not help when the callback is dropped by runtime teardown.

Evidence: a Linux C++ reproduction using the unmodified Android ChunkAcknowledgement and PendingStream definitions, with an inert AsyncCallback type, deterministically executes abort(); acknowledgeWith(ack); ack.wait(). The wait remains blocked after 100 ms and requires explicit harness cleanup. Output: invalidation before acknowledgement leaves native owner waiting: true. This verifies the lost acknowledgement state transition; no React Native device/runtime was run here.

Remediation: make invalidation and acknowledgement registration one atomic state transition. Registration after invalidation must immediately reject the new acknowledgement. On iOS keep the invalidation check and registration within the same owner lock or add an owner-scoped invalidation state to the registry. Add this forced interleaving to the bridge test lane.

M2 — P1 — A failed concurrent Kotlin temporary open can delete another open's database root

Location: src/sdks/kotlin/oliphaunt/src/androidMain/kotlin/dev/oliphaunt/AndroidNativeDirectEngine.kt:137-144; shared root at :518-526; per-open dispatcher at :30-35; descriptorless-root rejection at :218-221.

Trigger: two concurrent default Oliphaunt.open() calls. They each create an owner dispatcher but AndroidDirectTemporaryStorage.resolve() supplies the same process root. Once the first initializer creates a seed staging directory, the second observes a nonempty descriptorless root and fails before calling JNI. Its catch then recursively deletes the entire shared root because nativeOpenAttempted is false. That flag proves only that this caller has not entered native open; it proves no ownership of the directory. The first initializer's staging/PGDATA is deleted, and a delayed losing cleanup can also run after the winner publishes or opens.

Impact: destructive failure of the successful initializer; potentially deletion of its live temporary PGDATA. This is a source-proven interleaving, not an Android-device reproduction. React Native's own process-open claim serializes its calls, so the demonstrated entry point is the direct Kotlin facade.

Remediation: remove the broad root deletion and clean only uniquely owned staging paths, as Swift already does; alternatively acquire process-root admission before any preparation. Add a two-open test paused after seed staging and before descriptor publication. An unsupported second native open should reject safely, not destroy the first caller's state.

M3 — P2 — Android JNI converts valid supplementary Unicode into invalid native UTF-8

Location: src/sdks/kotlin/oliphaunt/src/androidMain/cpp/oliphaunt_android_bridge.cpp:66-76; all open fields at :350-363, startup args at :79-90, restore destination at :582.

jniString() uses GetStringUTFChars, whose bytes are JNI modified UTF-8, and hands them directly to POSIX paths and PostgreSQL UTF-8 strings. Supplementary characters such as emoji become two encoded surrogate halves instead of one UTF-8 code point. Paths created by Kotlin/Java therefore differ from the paths used by native open/restore; supplementary role/database names or GUC values also arrive with invalid encoding. React Native Android inherits this bridge.

Evidence: a tiny JNI library includes the actual repository C++ bridge and calls its jniString() helper. Java creates db-😀, then native stat() uses the converted string:

UTF-8: 64622df09f9880
JNI:   64622deda0bdedb880
Java path exists: true; native SDK conversion path exists: false

Remediation: pass explicit UTF-8 byte arrays from Kotlin or convert UTF-16 obtained through JNI to standard UTF-8 in one shared boundary helper. Preserve existing NUL rejection and handle pending allocation exceptions. Test supplementary characters in storage paths and a PostgreSQL identity/config value.

M4 — P2 — Swift's raw-stream reentry guard can be bypassed by detached work

Location: src/sdks/swift/Sources/Oliphaunt/Oliphaunt.swift:315-316; callback active state already exists at :290-308; guard caller at :1124-1128.

The guard checks only a @TaskLocal database ID. Task.detached and work submitted through another queue do not inherit that task context. If a synchronous stream callback starts such work and waits for its result, the operation is admitted and queues behind the stream that is waiting for it. The native owner deadlocks instead of rejecting the forbidden same-database work. The lock-protected active flag is not consulted by isReentry().

Evidence: a standalone executable links the compiled, unchanged Swift SDK, uses its internal fake-session seam, and starts Task.detached { db.execProtocolRaw(...) } within a stream callback. The callback's bounded wait times out; after it returns, the forbidden second request executes:

callback wait timed out: true
detached callback work unexpectedly succeeded
native calls: 2, expected 1 when reentry is rejected

The existing rawStreamCallbackRejectsSameHandleReentryButAllowsCancellation test uses inheriting Task {} only. Kotlin already rejects against a database-wide callback-active flag, including cross-dispatcher work.

Remediation: under the existing lock, reject when the callback is active, while retaining task-local rejection for inherited work that starts after callback return. Keep cancel out of band. Add detached/queue-based reentry to the callback test.

M5 — P2 — Kotlin wire construction allocates approximately 28 times a large parameter's size

Locations: src/sdks/kotlin/oliphaunt/src/commonMain/kotlin/dev/oliphaunt/Query.kt:640-646, :1622-1634, :1650-1668; caller-thread construction at :563, :573.

Frontend messages are constructed as MutableList<Byte> bodies, converted to arrays, then expanded into another MutableList<Byte> packet before another conversion to bytes. The list backing arrays hold references, and their growth/copies dominate large bytea inputs. Public suspend query/execute functions build these packets before reaching native-owner dispatch, so this work can also stall the calling UI coroutine.

Evidence: ThreadMXBean.getThreadAllocatedBytes around the actual JVM-built extendedQueryProtocol("SELECT $1", [QueryParam.bytes(8 MiB)]), after warmup and excluding creation of the owned input parameter, reported:

payload 8 MiB; packet 8388673 bytes; allocated 227.3 MiB; elapsed 269.2 ms

This is one Linux JVM measurement, not an Android performance claim; the concrete redundant allocation pattern is shared. Parsing also copies every frame during readiness inspection and again during result parsing (:1003, :1057-1119); ByteCursor.readUByte() allocates a one-byte array (:1574) and QueryRow copies the parsed values again. Those are additional optimization candidates, not separately benchmarked regressions.

Remediation: allocate one correctly sized ByteArray and write by offset, or use an already available byte-oriented builder; avoid introducing a new dependency. Read scalar values directly from the input buffer and return frame spans instead of frame copies. Keep ownership copies at public boundaries. Add one representative parameter/result allocation benchmark before larger rewrites.

M6 — P1 qualification gap — The Swift native smoke command never exercises native PostgreSQL

Location: src/sdks/swift/moon.yml:53-64; tests under src/sdks/swift/Tests/OliphauntTests.

The smoke target sets OLIPHAUNT_SWIFT_REQUIRE_NATIVE=1, native-library and runtime paths, then runs swift test. The requirement variable is referenced nowhere else in the repository. The current tests use fake sessions or stop before successful native loading; none executes PostgreSQL through the Swift C bridge. The preceding native C smoke dependency proves the C product independently, but cannot catch Swift-to-C ABI, ownership, callback, or real cancellation regressions. README's env-backed SQL/cancel/backup smoke description does not match the current tests.

Evidence: reran the entire Swift suite with OLIPHAUNT_SWIFT_REQUIRE_NATIVE=1, LIBOLIPHAUNT_PATH=/definitely/missing/oliphaunt.so, and OLIPHAUNT_INSTALL_DIR=/definitely/missing/postgres. All 94 tests still passed. Log: target/audit/2026-09-07/checks/mobile/swift-fake-native-smoke.log.

Remediation: restore one required real-runtime test or runnable consumer smoke selected by the flag. It must fail if assets are unavailable and should cover open, parameter query, cancellation of active work, callback abort/recovery, backup/restore, and logical close/reopen. Leave ordinary mocked unit tests independent of runtime artifacts.

Shared core findings supplied to the parent audit

Both Swift and Kotlin configurations default to empty startup GUC lists. Their argument builders forward only explicit GUCs plus required preload names (Oliphaunt.swift:1242, Kotlin common Oliphaunt.kt:83). They do not override native core's default -F. React Native forwards the same configuration through these SDKs, so the parent audit's fsync=off finding affects persistent mobile storage as well.

Investigated but not counted as runtime defects:

• A serial Swift DispatchQueue is not a fixed pthread, but the native C core owns the PostgreSQL pthread; host queue migration is not itself an affinity defect.
• Kotlin's preflight validator omits checking that the pgdata root is a real directory, and a compiled-helper reproduction accepts a symlink there. However, the final C managed-root validator rejects it before runtime open, and the managed-root path does not mutate linked PGDATA first. This is inconsistent redundant validation, not proven runtime acceptance.

Organization and maintainability

The existing architectural direction is sound: React Native delegates storage/native execution to the Swift and Kotlin SDKs, and its TypeScript protocol/query modules re-export @oliphaunt/js-core. Keep that reuse rather than adding another native runtime or another JS parser.

The highest-return consolidation is where the audit found actual drift:

1. Share a small C++ stream acknowledgement/lifecycle component between the iOS and Android React Native bindings, or at minimum one deterministic state-transition fixture. The same lost-registration race exists in two implementations.
2. Give root publication/cleanup one explicit ownership contract. Kotlin's broad cleanup differs from Swift's selective publication cleanup. Do not duplicate another root manager in React Native.
3. Extend the existing shared protocol fixtures to lifecycle schedules and failure precedence. Swift, Kotlin, and TypeScript each maintain substantial transaction state machines, SQL scanners, terminal-boundary classifiers, and diagnostics. Native platform ownership code must remain platform-specific, but behavioral fixtures can prevent semantic divergence without forcing a new universal abstraction.
4. Replace Kotlin's byte-list builder and copy-heavy scanner before larger performance redesigns. This has measured cost and needs few files.
5. Resource packaging has useful strict manifests, exact extension selection, registry readiness checks, and staged publication. Maintain a single generated catalog/schema vocabulary and share its invalid/valid fixtures; avoid independently hand-maintaining field sets and extension closure rules across language SDKs.

Checks and practical coverage

Passed on Linux:

• swift test --scratch-path <audit-scratch>/oliphaunt-audit-swift-build: 94 tests.
• ./gradlew :oliphaunt:jvmTest --no-daemon -PoliphauntBuildRoot=<audit-scratch>/oliphaunt-audit-kotlin-build: 79 tests (77 facade, 2 shared protocol).
• ./gradlew :oliphaunt:testDebugUnitTest --no-daemon -PoliphauntBuildRoot=<audit-scratch>/oliphaunt-audit-kotlin-build: 133 tests (77 common facade, 50 runtime-assets, 5 native-owner, 1 Android config test).
• Swift C bridge mutex-init failure check.
• Kotlin C++ stream-result classification check.
• The four independent reproductions above: actual JNI string helper, actual Swift callback guard, extracted unmodified React Native acknowledgement state, actual Kotlin packet allocation.

Reproduction source/binaries are in target/audit/2026-09-07/checks/mobile/: BridgeUnicode.java, bridge_unicode.cpp, SwiftCallback.swift, ack-race.cpp, PacketAllocation.java. No production code was altered.

Coverage: traced native open/config/identity/close/detach/forgotten cleanup, owner/cancel dispatch, transaction settlement and poisoning, raw stream/COPY restrictions, query parameter/result parsing, resource seed/cache/extension composition, backup/restore boundaries, and both React Native platform bridges. Reviewed build/package entry points; the separate extensions/tools audit owns the full generator/plugin/tooling catalog.

Limits: no Apple runtime/Xcode/iOS device execution and no Android native PostgreSQL/device/React Native runtime execution. The Android task is a unit-test lane, not a JNI-backed PostgreSQL smoke. React Native TypeScript tests were not run by this subagent; no node_modules were present initially. Existing protocol, transaction-failure, cancellation-admission, manifest-validation, and publication fixtures are substantial, but do not cover the races and Unicode edge above. Passing them does not prove native integration.

[f0rr0]

Supporting report D: WASIX bindings and concurrent runtime: revised assessment

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

WASIX second pass: intent, correctness and actionable work

Reviewed e8192180bec4494c83bfa3adecbaa9b228b8f05d, unchanged after the root reviewer fetched main. No production edits. This deepens the earlier binding report (supporting report E — Retained WASIX and Postmaster evidence) and targeted postmaster report (supporting report E — Retained WASIX and Postmaster evidence). It is a source audit with bounded runnable checks, not a build or exhaustive verification of the 44,475-line Wasmer fork. Patch links below refer to checked-in patch-file lines.

The second pass retains five binding findings and the mapping-allocation finding, withdraws IndexedDB default durability as a defect, and adds a reproduced generic VFS data-loss bug in the zero-write shortcut. Preserve the fresh-exec, fixed shared-mapping, lifecycle and sealed-artifact machinery: these implement real requirements, and cannot be replaced by ordinary PostgreSQL extensions.

Intent established before judging implementation

The postmaster maintainer guide explicitly chooses separate products: single-backend embedding and an actual postmaster with independent backend instances. It rejects cloning a live Store because exec must reset process state. Fixed reattachment, real shared atomics, process-scoped identities and retirement, and explicit supervisor signal ownership follow from that choice. Hiding postmaster behind a portable single-session API would weaken those contracts.

The sealed executor intentionally removes runtime compilation and package resolution. Its immutable images, detached artifact metadata and shared immutable function tables address observed startup work and physical-memory costs; raw VSZ and summed RSS are not valid substitutes for measuring those costs. This gives those optimizations a plausible purpose, not a correctness exemption. Their identity/ownership checks are required parts of the optimization.

The browser storage design chooses synchronous same-worker OPFS to avoid an I/O mailbox and full-PGDATA copies, and explicitly chooses browser-default IndexedDB durability. The preopened OPFS reserve and staged overflow avoid exposing a fixed database file-count limit. The mistake in W1 is the missing durable namespace at an intermediate PostgreSQL barrier; neither same-worker I/O nor a reserve is itself wrong.

The TypeScript architecture promises synchronous bounded native actor admission, distinct direct/worker ownership, bounded streaming acknowledgements and quiescent native worker close. Keep these distinctions. Ordinary call serialization is needed; allowing unlimited already-copied work in front of the actor is a separate limit failure.

Available file history is dominated by the API/product consolidation commits 4384d1bd (#153) and fae2bd7b (#129). Durable design notes, runtime/capabilities.tsv, source pins, build receipts and behavior tests are better evidence of current intent than guessing author motivation from the monolithic patch title.

Prior finding dispositions

Earlier ID	Disposition	Intent-aware conclusion and evidence
W1 OPFS WAL/namespace ordering	Retain P1; filesystem failure reproduced, full PG crash case unverified	Immediate exact-range I/O is valuable, but new WAL names remain only in RAM while reachable control/data backings change in place. Staged-file flush also returns without flushing. The mandatory later boundary does not protect an interruption before it. Actual pool plus fake handles reproduced both spare and staged cases again. Locations: flush, create, publication.
W2 byte-channel lost close/fail wakeup	Retain P1; deterministic interleaving reproduced	A bounded ring is appropriate. Waiters sleep on offset words, while EOF/failure modifies other words and only notifies the offsets. Close between predicate inspection and wait loses the notification. This affects sync and waitAsync paths. channel. Correction to earlier impact: there is no universal 120-second escape; the database deadline is conditional on an abort-capable session and WorkerDatabaseSession exposes no abort. Do not recommend forced termination across a native frame as the fix.
W3 unrelated Wasm traps sent through PG ERROR cleanup	Retain P1 source-supported unsafe recovery policy; actual trap injection unverified	Known PG nonlocal error transfer needs recovery. The catch-all buffered branch also invokes that export and discards the original trap; the streaming branch returns unknown traps. Some runtime exceptions represent valid PG ERROR, so classify the specific transfer instead of treating all RuntimeErrors alike. buffered branch, drain, streaming branch.
W4 AOT cache receipt does not bind current bytes	Retain P2 local integrity; do not describe as a remote attack	Avoiding a repeated startup hash has a performance rationale. A same-size replacement/corruption still satisfies Fast receipt checks before unsafe native-artifact loading. Use exact opened bytes once per process and the existing module cache; do not impose redundant hashing on the separately sealed immutable postmaster loader. receipt check, Fast default.
W5 browser-default IDB durability	Withdraw as a defect; optional documentation/benchmark task	The default is an explicit product decision in storage architecture, and IDB transaction atomicity is retained. Do not silently change it to strict in response to this audit. A stricter option would need a separate product/performance decision. Existing check proves only the omitted transaction option, not a bug under the selected contract.
W6 unbounded TypeScript admission before bounded actor	Retain P2 resource/admission issue	The Promise FIFO preserves a single session. It also snapshots all requests before Rust admission can limit them. Reproduced 128 × 1 MiB retained while only one session call ran. raw snapshot, queue. Bound the public pending requests/bytes before allocation while preserving accepted-call ordering.
PM1 nonfixed shared mmap never reuses unmapped intervals	Retain P2 source-supported; compiled guest loop unverified	memory.grow is the correct race-free primitive for acquiring new pages alongside sbrk. The gap is the lack of a runtime-owned free-interval path after unmap; inherited exec reservations are not ordinary hole reuse. fresh growth, unmap registry removal, 4096-page product cap. Long-lived map/unmap churn exhausts address space despite few live maps. POSIX DSM is enabled and the profile permits workers, but a real SQL DSM reproduction remains to be run.

New finding: PM2 — P2, zero-extension optimization can truncate another writer

Locations: try_extend_with_zeroes in patched lib/virtual-fs/src/host_fs.rs, zero-buffer dispatch and shared positioned write call in lib/wasix/src/syscalls/wasi/fd_write.rs.

The optimization detects all-zero positioned writes. When offset >= file.metadata()?.len(), it substitutes file.set_len(offset + len) for writing the zero bytes. The shared positioned fast path holds a shared handle lock, and independent opens/backends need not even share that lock. File size can change between the metadata read and the truncate call.

For example, A is writing 4 KiB of zeros at offset zero into an empty file. After A observes size zero, B writes newer bytes at offset 8192. A then calls set_len(4096), reports the full 4 KiB write successful, and truncates B's data. An ordinary positioned write at offset zero would preserve B's higher bytes in either syscall ordering. This is a generic VFS violation; PostgreSQL relation-extension locks may prevent some native PostgreSQL callers from exhibiting it. No normal SQL workload is claimed to reproduce it here.

Runnable evidence: zero-write-race.rs (audit-local evidence: zero-write-race.rs; observation and scope recorded in this report) embeds the exact helper extracted from patch lines 13332–13348. A test-only File facade forwards operations to two real std::fs::File handles and schedules the second writer immediately after the first metadata read; it does not alter the helper's branches. It reports zero_write_reported=Some(4096) final_len=4096 newer_bytes_readable=0. This is a deterministic legal interleaving at the host-file boundary, not a built Wasmer or PostgreSQL test.

The same substitution also deserves two narrowly scoped checks. First, the O_SYNC/O_DSYNC path calls sync_after_blocking_write, which skips an explicit sync when the host file reports sync-on-write. The operation was changed to truncate, so the original write-specific premise no longer holds. Actual power-failure behavior and use by a shipped default PG workload were not tested. Second, replacing zero writes with sparse extension changes physical allocation behavior: PostgreSQL may be zero-filling to reserve disk space. These are additional consequences of the shortcut, not independently demonstrated PG corruption findings. A truncate introduced through this path also bypasses the shared-mapping shrink guard because a positioned write ordinarily cannot shrink a file.

Minimal repair: remove only the set_len shortcut from generic zero-write handling; keep the existing vectored batches over ZERO_WRITE_CHUNK. Do not add an inode-lock subsystem merely to save this shortcut: independent OS writers still would not participate. Any future allocation optimization should use an explicit contract/API that preserves concurrent file contents, sync semantics and allocation guarantees, rather than inferring that contract from zero payload bytes.

Deepened coverage and conclusions

Subsystem / patch region	What was traced	Limits / remaining check
LLVM code and intrinsics, patch 2495–4056	Bulk copy/fill bounds and memmove/memset lowering; rotate intrinsics; SIMD load/store representation; seq-cst fence restoration; indirect-call refactoring and anyfunc shadow lookup	No LLVM build or generated-code differential suite. Bulk bounds load current length as i32; the 256 MiB product cap avoids a 4 GiB-wrap case, but generic-runtime claims need separate boundary tests. Do not call this a current product failure.
Artifact builders/engine/code memory/frame info, 4057–6482	Checked archive inspection before activation; detached metadata; Arc function tables; activation rollback and frame/unwind ownership; pinned-directory O_TMPFILE, relocation publication, read-only remap and cache advice	No corrupt native artifact execution, no executable permission failure injection, no arm64/macOS run. Relocation calculations and unwind internals were not fully proven.
Product executor/start proof/profile, 6483–12744	Compiler-free role, exact module/profile ownership, sealed policy, start closure analyzer, memory profile, existing negative tests	Exact analyzer source's five tests ran in a standalone crate using compatible cached dependencies, not the full pinned Wasmer workspace. Full sealed loader and receipt graph only selectively traced; extension/tool agent owns launcher/carrier tooling review.
Virtual filesystem and syscall I/O, 12911–14822 and selected 37825–40782	Directory fsync retains opened identity; lazy Tokio file descriptor; positioned reads/writes and vectors; zero-write detection; sync flags; writeback/advice distinction; size refresh	PM2 reproduced. No runtime ENOSPC/EINTR/partial-I/O fault injection. Mixed asynchronous and blocking I/O, append combinations and every FD operation were not exhaustively reviewed.
Virtual I/O/net/epoll, 14972–16555, 21254–23540, selected socket syscalls	Selector registration rollback; external-handler/waker coexistence; bounded accept priming; immediate receive/send paths; open-file-description keys; final-close guards; stale readiness generations; enabling Notify before draining	Strong fixes for actual listener/OFD issues are present. No full runtime wave stress, multiwaiter fairness or EINTR/EOF fault suite run. General epoll edge/oneshot behavior was not established.
VM instances/memory/table/traps, 16556–18378	Stable nonmoving memory preconditions; mapping bounds; shared immutable function metadata; table shadow set/grow updates; trap lifecycle selections	No proof that every table mutation/host view path maintains the new layout; no sanitizer or compiled guest tests. Preserve declared memory bounds and guard requirements.
Fresh exec/process/task/signal lifecycle, selected 18467–18826 and 23541–31732	Rechecked process-group ownership, admission/retirement guards and signal supervisor rationale from prior pass	Prior bounded coverage remains; no exhaustive scheduling audit or signal stress. Process-safety guards should not be deleted as unnecessary complexity.
Dynamic linker / memory image / globals, 31947–37575 and 43838–44387	Single-slot broadcast removes per-channel helper threads while preserving mutex/condvar predicates; fresh linker image phase; ordinary-start witness consumed before remap; image metadata and immutable backing; single-flight first-instance comparison; sparse global shape validation	No main-image mutation differential or complete rollback proof. Analyzer is deliberately narrow; negative cases for global initialization dependencies, operand/address changes and control-flow changes deserve coverage before generalizing its policy.
Libc fork, selected mmap/sbrk/allocator/exec/wait/signal hunks	Runtime-owned mapping ranges kept disjoint from sbrk allocation, ignored hints, exact partial ownership handling, errno/default signal and exec conventions	No compiled libc probes on supported targets; PM1 remains. Other libc changes have source-level coverage only.
Single-backend TS/Rust/NAPI integration	Revisited OPFS namespace/flush/create/rename/close, IDB policy, FIFO/terminal state, worker acknowledgements and self-exit, Rust buffered/streaming trap policy and AOT receipt binding	Earlier source scope retained; no native addon or browser runtime built. Callback queues are bounded separately from total public operation admission.

Bounded checks actually run

• Existing OPFS helper reproduction rerun: both preopened-spare and staged-WAL cases acknowledged guest flushes while reopening changed control bytes with no WAL name. Uses copied actual pool source and repository fake handles; not actual PGDATA recovery.
• Existing byte-channel race reproduction rerun: injected close before wait loses its notification. A diagnostic timeout makes the failure observable; production wait has no timeout.
• Existing public queue reproduction rerun: 128 raw requests accepted, native/session calls = 1, retained copied bytes = 134,217,728.
• New exact zero-extension helper with real host files and deterministic interleaving: reproduces truncation as described above. Compiled with rustc --edition=2024.
• Exact start-proof.rs extracted from the patch: five existing tests pass via standalone cargo test --offline. The standalone lock uses wasmparser 0.247.0 and wat 1.258.0, with cached standard support crates; this does not substitute for the source-pinned full runtime test task.
• verify-postmaster-concurrency-contract.test.py: 12 pass; verify-postmaster-wasm-import.test.py: 4 pass; verify-source-lock.test.py: pass. These verify the checkers and policy wiring with fixtures, not the final compiled PostgreSQL/LLVM behavior.

Check files are under second-pass/checks/wasm (audit-local evidence: wasm; observation and scope recorded in this report). Earlier host reproductions remain under checks/wasm (audit-local evidence: wasm; observation and scope recorded in this report). No full Wasmer build, Cargo runtime suite, browser crash qualification or addon test is claimed.

Prioritized TODO checklist

Priorities distinguish confirmed fixes from qualification work. Validation items are not assertions that a bug exists. A dependency of “none” means work can begin independently.

Done	ID / priority	Intent to preserve	Minimal action	Acceptance	Dependencies
[ ]	WA01 / P1	Crash-recoverable persistent OPFS	Route persistence through existing portable COW provider until synchronous namespace publication is safe; preserve direct I/O implementation for later repair	Both W1 interleavings retain a recoverable old/new generation; real worker-kill WAL-rotation/checkpoint reopen passes	None
[ ]	WA02 / P1	Fast same-worker exact-range storage	Design synchronous durable namespace/journal or delay destructive writes until required names/data are durable	Interrupt each create/rename/fsync/control-write boundary, including reserve exhaustion; no unreferenced required WAL	WA01 before re-enabling direct persistence
[ ]	WA03 / P1	Bounded duplex COPY/tools transport	Change byte-channel wait protocol so terminal transitions change the waited state/generation	Deterministic empty reader and full writer races pass for close/fail, sync/waitAsync; no polling latency regression unless explicitly chosen	None
[ ]	WA04 / P1	PostgreSQL recoverable ERROR semantics	Retain recognized PG recovery but return/retire on unclassified traps; share classification across drivers	SQL ERROR keeps session usable; unrelated guest trap preserves cause and makes handle terminal; buffered/stream/browser agree	None; use root guest-fault fixture where applicable
[ ]	WA05 / P1 qualification	Postmaster memory/exec safety	Run existing required runtime patch tests and compiled capability probes for the exact revision	No skipped expected tests; fresh exec/shared reattach/wait/signal/latch proofs pass on all supported platforms	Exact pinned build inputs
[ ]	WA06 / P2	Correct positioned file I/O	Remove generic zero-extension set_len substitution; keep vectorized zero writes	PM2 interleaving preserves newer high-offset bytes; partial writes and errors preserved	None
[ ]	WA07 / P2	Real sync/space guarantees	Add zero-write cases to sync-on-write and ENOSPC/allocation probes	Guest zero writes under SYNC/DSYNC honor the barrier; WAL preallocation behavior compared to native oracle	WA06
[ ]	WA08 / P2	Race-free shared allocation beside sbrk	Track/reuse only runtime-owned unmapped holes, including allocation padding	>4096 one-page map/unmap iterations succeed with bounded live memory; partial unmaps and parallel heap growth preserve disjointness	None; compiled mmap probe
[ ]	WA09 / P2	Fast verified AOT reuse	Bind first-process cache validation to exact opened bytes; reuse existing Module cache	Same-size corruption rejected before unsafe load; concurrent path replacement cannot swap verified/deserialized objects	None
[ ]	WA10 / P2	Serialized responsive API	Enforce public pending request/byte admission before snapshots/encoding	Burst test remains bounded and excess work fails predictably; accepted operations/close retain FIFO semantics	None
[ ]	WA11 / P2	Transaction-owned sequencing	Apply admission accounting to transaction work and private protocol/tool reservations without another scheduler	No transaction reentry deadlock; budgets released on every rejection, cancellation and terminal path	WA10
[ ]	WA12 / P2 qualification	Quiescent worker teardown	Trace fatal/messageerror paths with outstanding stream acknowledgements; establish terminal wakeup before native teardown	Pending calls settle, blocked callbacks wake, storage ownership releases exactly once; no forced termination inside active NAPI frames	WA03, exact Node/Bun/Deno addon build
[ ]	WA13 / P2 qualification	Bulk-memory optimization	Differential compiled WAT cases for overlap, zero length, out-of-bounds, memory growth, imported/local memory	Same bytes/traps as reference engine; boundary reads use the correct length width	Pinned compiler build
[ ]	WA14 / P2 qualification	Cheap indirect calls	Exercise table.set/fill/copy/init/grow, null/signature traps, imported tables and side modules against shadow table	Both table representations remain coherent; ordinary and tail indirect calls agree	Pinned compiler build
[ ]	WA15 / P2 qualification	Cross-instance latch ordering	Run final-module fence checks plus real multi-backend wait/reset/set stress on x86_64 and arm64	No lost wakeup under timers/backend churn; compiled fences match qualified contract	WA05
[ ]	WA16 / P2 qualification	Correct activation rollback	Fault allocation, relocation, executable publication and metadata registration/admission one stage at a time	Code mappings, frame registration, temporary descriptors return to baseline; no dangling callable pointers	Pinned runtime build
[ ]	WA17 / P2 qualification	Immutable executable backing	Qualify O_TMPFILE/filesystem/noexec/permission/space failures and macOS private-copy path	Explicit failure without silent policy fallback; exact verified bytes owned throughout mapping lifetime	WA16
[ ]	WA18 / P2 qualification	Attested deterministic start images	Extend existing analyzer negative fixtures for global-init dependencies, changed operands/control flow and unsupported effects	Unsupported shape rejected; any admitted shape remains differential-equivalent across fresh instances and base/layout variations	Standalone analyzer tests, pinned image build
[ ]	WA19 / P2 qualification	Safe fresh image reuse	Inject failure after ordinary start, image validation/remap, shared reservation install and side-module relocation	Rollback releases only successor resources; parent/other backends remain usable; first-instance failure cannot become later success	WA05, WA18
[ ]	WA20 / P2 qualification	Exact FD/OFD semantics	Exercise dup/fork/renumber/close with partial positional I/O, append, independent file growth and EINTR	Native POSIX oracle parity for the supported contract; no data truncation or stale EOF/offset	WA06
[ ]	WA21 / P2 qualification	Fair level-triggered listener progress	Run real queued-accept waves, duplicate watches, simultaneous waiters, EOF/error and selector-registration failures	No dropped listener progress or stale-fd delivery; all watch/handler resources return to baseline	WA05
[ ]	WA22 / P2 qualification	Process-group isolation	Two simultaneous clusters with colliding guest PID/fd values; cancel/kill/restart one under load	Other cluster unaffected; task budget and process registrations return to exact baseline	WA05
[ ]	WA23 / P2 qualification	PostgreSQL crash recovery	WAL recycle, checkpoint, backend churn, clean shutdown, immediate crash/reopen with libpq-visible assertions	Qualified committed data retained under selected storage contract; no leaked host process/lock	WA01/WA02 for browser, WA05–WA08 for postmaster
[ ]	WA24 / P2 maintenance	Maintainable product executor	Extract product-owned executor and proof tooling into normal first-party sources; retain narrow patched runtime APIs	Same sealed manifest/CLI/feature/dependency contract and behavior tests; direct lint/navigation/test support	Map existing build/provenance dependencies first
[ ]	WA25 / P2 maintenance	Reviewable runtime fork	Split patch by correctness, process ownership, shared memory, artifact/image policy and compiler optimization dependencies	Exact current postimage reproducible; tests map to individual contracts; patch drift rejected	WA24 can proceed independently
[ ]	WA26 / P2 maintenance	Safe upgrade path	Record each fork hunk's invariant, upstream issue/candidate status, test and owner	Next Wasmer/libc bump has explicit semantic checklist rather than only patch-apply success	WA25
[ ]	WA27 / P3	Existing IDB product policy	Clarify browser-default durability alongside atomicity and use matched durability in benchmarks	Public docs and perf reports avoid equating IDB transaction completion with native fsync; no silent default change	Product decision only if a strict option is requested
[ ]	WA28 / P3	Defensible startup optimizations	Benchmark detached metadata, shared pointer tables, sparse globals and images with exact identities and PSS/cgroup/tail latency	Each optimization has measured benefit plus its correctness checks; preserve required runtime fixes regardless	WA13–WA19 for qualification
[ ]	WA29 / P3	Cohesive product organization	Reuse pure codecs/descriptors/fixtures across native and WASIX; retain distinct single/postmaster lifecycle adapters	One semantic source for shared formats, no hidden topology fallback or duplicated database state machine	None
[ ]	WA30 / P3	Honest resource ceilings	Document queue budgets, mapped-memory cap, full-buffer backup/result costs and close/cancellation limitations	User-facing claims agree with real admission, persistence and termination paths; no universal timeout claim	WA08, WA10, WA12

Explicitly unverified

This report does not establish full compiler correctness, unsafe Rust memory safety, race freedom across every guest-thread/host-view path, real browser fsync/power-failure behavior, macOS/Linux arm64 mapping behavior, extension faults, finalizer teardown inside a native frame, or release readiness. It also does not claim that the presence of carefully named negative tests proves their full pinned workspace passes. The checklist specifies the evidence needed to close those gaps instead of turning them into speculative defect findings.

[f0rr0]

Supporting report E: Retained WASIX and Postmaster evidence

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

This comment preserves the detailed first-pass observations behind report D. Report D and the master checklist control current priorities and scope. W5 (IndexedDB default durability) is withdrawn as a defect. ND3 close waiting and other revised scopes are not additional open findings.

Retained first-pass evidence and analysis (revised findings above take precedence)

WASIX bindings and runtime-host audit

Reviewed commit: e8192180bec4494c83bfa3adecbaa9b228b8f05d (fetched main). No repository source edits.

Scope: TypeScript browser direct/worker execution, browser persistence, TypeScript server-host adapters, Rust WASIX synchronous/async ownership and protocol drivers, N-API boundary, physical backup/restore flow, extension-carrier integration, tools and bounded byte transport. The root reviewer owns PostgreSQL guest patches and concurrent postmaster. This is a source review with focused host-level reproductions, not full WASIX/browser/platform qualification.

Prioritized findings

W1 — P1: Direct OPFS can persist a newer checkpoint/data file without the WAL namespace needed to recover it

Location: src/bindings/wasix-ts/src/storage/opfs-pool.ts:534 (#flushRecord), :406 (new file opens), :218 (host sync and namespace publication).

New PostgreSQL files receive either an unused preopened backing file or a RAM-only staged record, and the logical path is updated only in the in-memory #entries. The on-disk state.json is not published until an asynchronous host-operation boundary. Guest fsync on a staged file silently succeeds without doing anything. Guest fsync on an ordinary new spare flushes its backing but still does not make its logical name recoverable. Meanwhile existing relation and global/pg_control backings are modified and flushed in place.

Trigger: PostgreSQL creates/renames a WAL segment, flushes that WAL, and writes an existing data/control file before the next JavaScript publication. A worker/process interruption or failed publication at that point leaves old namespace metadata alongside new reachable data/control bytes. A WAL rotation during a long operation, buffer eviction, or checkpoint makes this a database-recovery concern, not just a failure to retain an unacknowledged last transaction. A later host-level WAL-first flush cannot repair a crash that happened before that boundary.

Evidence: target/audit/2026-09-07/checks/wasm/check.ts runs the actual pool source with the repository's fake OPFS handles. It creates and flushes a new WAL path, writes and flushes existing pg_control, then closes without a publication and reopens. Both simulated guest fsyncs report success, control bytes changed, and the WAL name is missing. The check covers both preopened-spare and exhausted-reserve/staged paths; staged path flushes only the control backing. The fake is not a real PostgreSQL crash test, and its control bytes are deliberately symbolic; it demonstrates the filesystem ordering violation directly.

Remediation: until a crash-safe direct namespace exists, route persistent OPFS through the existing copy-on-write portable provider. A performant replacement needs a synchronous durable namespace/journal or a design that holds all destructive/in-place data changes until required WAL names and bytes are recoverable. Merely increasing the 32-file spare reserve or sorting flushes at the end does not fix the normal spare case. Add an interruption test at the guest fsync boundary and a real WAL-rotation/checkpoint recovery test.

PostgreSQL requires WAL to reach permanent storage before corresponding data files are written: PostgreSQL WAL documentation.

W2 — P1: Byte-channel close/failure can lose its wakeup and block a worker indefinitely

Location: src/bindings/wasix-ts/src/byte-channel.ts:31 (close), :39 (failure), :79–:85 (blocking read), :97–:104 (blocking write); equivalent async waits at :121–:127 and :142–:149.

The waiters block on READ_OFFSET or WRITE_OFFSET. Closing/failing changes different CLOSED/FAILED words and notifies the offset word without changing its value. Valid interleaving: consumer sees empty queue and CLOSED=0; producer sets CLOSED=1 and notifies; consumer calls Atomics.wait(WRITE_OFFSET, oldWrite) after the notification. The offset is unchanged, so the consumer sleeps forever. Checking CLOSED again immediately before wait still leaves a race. Full-queue writers have the same issue; the waitAsync branch also can wait forever. The polling fallback happens to recover.

Impact: frontend tools and protocol connections can hang at EOF or transport failure. Database queue/lifecycle code then cannot drain, potentially relying on a 120-second forced worker close. The affected public scenarios include browser psql and worker-owned protocol connections.

Evidence: target/audit/2026-09-07/checks/wasm/channel-close-race.ts imports the actual byte-channel source and injects the close immediately after CLOSED is read. It wraps only the subsequent wait with a 30ms diagnostic timeout. The wait returns timed-out, proving the actual unbounded wait misses the already-issued notification. This is a deterministic model of a legal cross-thread interleaving, not a probabilistic stress test.

Remediation: wait on a wake-generation word incremented on data/space/closed/failed transitions, with predicates checked against the captured generation. A finite wait timeout is a small stopgap, with a latency/performance tradeoff. Cover both reader and full writer EOF/failure races with an explicit interleaving test.

W3 — P1: Buffered Rust protocol driver tries PostgreSQL ERROR recovery for unrelated Wasm traps

Location: src/bindings/wasix-rust/crates/oliphaunt-wasix/src/oliphaunt/postgres_mod.rs:565–:568, :792–:800; compare streaming path :622–:624.

The driver recognizes the explicit PostgreSQL longjmp fallback and uncaught-exception path, but its final catch-all branch also calls PostgresMainLongJmp, discards the original Wasmer error, and continues. The error-drain loop repeats that catch-all behavior. The streaming implementation correctly returns the unrecognized trap instead.

A PostgreSQL ERROR has initialized ErrorData and the expected top-level unwind boundary. An unrelated bounds trap, unreachable, stack overflow, or faulty extension can occur without those preconditions, or after state has been partially modified. The guest recovery export performs error reporting and transaction cleanup; it is not a generic Wasm-fault recovery mechanism. A runtime error can sometimes wrap a legitimate PostgreSQL error, so the problem is specifically unclassified errors being treated as confirmed recoverable errors, not that every RuntimeError is invalid.

Evidence: source trace, with root review correlating the guest's extracted original PostgreSQL cleanup (EmitErrorReport, AbortCurrentTransaction, etc.). No fault-injected real guest was executed. This is an unsafe control-flow policy, with actual trigger severity dependent on the guest fault.

Remediation: one explicit guest/host discriminator for intentional PostgreSQL nonlocal ERROR transfer, shared by buffered/streaming/browser paths; return and retire the session for other traps while retaining their original cause. Inject one ordinary PG ERROR and one unrelated Wasm trap, asserting only the former leaves the handle reusable. Matching message text uncaught exception is also a weak long-term discriminator and should be tightened where the host permits it.

W4 — P2: Default AOT cache verification accepts same-size corrupted native machine code

Location: src/bindings/wasix-rust/crates/oliphaunt-wasix/src/oliphaunt/aot.rs:207–:212, :565–:606, :666 (Fast default), :681–:689 (unsafe mmap deserialization).

Fast verification checks only cached file length and an independently stored JSON receipt containing expected manifest values. It does not hash the cached bytes or even bind the receipt to file mtime/inode. Changing bytes in a native artifact without changing its size leaves every fast check valid. The code then invokes unsafe Wasmer artifact deserialization; the receipt is not evidence that those are still the originally verified native bytes. Retrying on deserialization error covers a subset of corrupt headers but not valid-looking corrupt machine code.

Impact: corrupted/replaced local executable cache can crash the process or execute wrong native instructions, including silently wrong database behavior. This is an integrity/correctness issue; there is no assertion here of a remote attack, and an attacker already able to replace same-user executable files has wider capabilities.

Evidence: source validation data flow; no malicious/corrupted native artifact was executed.

Remediation: default to verifying the exact bytes being deserialized at first process load and reuse the existing process-wide Module cache afterwards. Do not add a new cache abstraction. If retaining a user-selectable unsafe fast cache, document the integrity tradeoff plainly and avoid treating receipt comparison as content verification. Full verification currently hashes and subsequently reopens by path, so an untrusted concurrent cache writer still requires binding verification to the actual opened bytes or otherwise trusted immutable cache ownership.

W6 — P2: Public TypeScript FIFO bypasses the Rust actor's bounded admission and retains unlimited request copies

Location: src/bindings/wasix-ts/src/database.ts:328 (execProtocolRaw copy), :471 (#execOwned), :1013 (#serialize); Rust comparison src/bindings/wasix-rust/crates/oliphaunt-wasix/src/async_api.rs:605–:655.

The Rust actor has bounded admission, but every TypeScript operation is fully planned/copied and attached to an unbounded Promise chain before the actor sees it. Only one request reaches the actor at a time; therefore its capacity guard cannot reject or backpressure a JavaScript burst. Promise.all on many large requests can consume memory proportional to the complete burst while one slow query blocks the queue. Query parameter snapshots and worker placement have the same parent-queue issue.

Evidence: target/audit/2026-09-07/checks/wasm/queue.ts instantiates the actual public state machine with a stalled mock session. It accepts 128 separate 1-MiB raw requests, dispatches only one session call, and retains exactly 134,217,728 copied request bytes. No native artifact is needed to show where admission occurs.

Remediation: enforce a small pending-work/byte budget at the public admission boundary before copying/encoding, or expose an explicit caller backpressure contract with a bounded queue. Reuse the existing state machine; do not add a second scheduler. Transaction-owned requests need the same limit and lifecycle controls must remain admitted so close/rollback cannot be starved.

Organization and performance recommendations (not additional proven bugs)

1. Preserve the current shared query core. WASIX query.ts/protocol.ts already re-export @oliphaunt/js-core; Rust query types/codecs use the shared query core as well. This is the right boundary for common fixtures and removes a large historical duplication source. Do not merge native and WASIX execution/session ownership simply because their APIs look similar.
2. Reduce independent control-flow policies. Buffered Rust, streaming Rust, browser patched host, TypeScript public transaction state, and Rust actor state all participate in readiness/error/lifecycle decisions. W3 illustrates the drift. Keep transport owners explicit but use one written protocol-outcome contract and the same fault fixtures across them. Share small pure helpers where already in the same language; avoid a generic engine/plugin framework.
3. Treat browser persistence as a filesystem correctness project. OPFS direct mode is an approximately 1,475-line filesystem/pool/namespace implementation with another Wasmer sync bridge underneath. The portable provider is slower but simpler because it publishes a generation atomically. Measure direct-OPFS benefits against its crash-correctness cost before extending the pool with more mechanisms.
4. Avoid adding another transaction abstraction to address W6. The current Promise tail is enough for ordering, but admission and allocation must be bounded before that tail. Native actor and Worker layers add distinct ownership hops intentionally; /direct remains appropriate for callers willing to block their realm.
5. The browser host and Rust host use different Wasmer generations (the browser's coherent 0.601 family versus Rust 0.702.1/Wasmer 7.2.1). Each has narrow custom host behavior. PostgreSQL extensions cannot eliminate Wasm syscalls, filesystem implementation, guest lifecycle exports, or host exception recovery patches. A future host migration needs paired runtime/extension/tool tests, not an isolated dependency bump.
6. Keep extension packaging metadata generated and frozen, but centralize repeated schema primitives. extensions.ts, extension-descriptor.ts, and other descriptor parsers each carry requireObject/key/string/hash/path helpers. Reuse the existing descriptor-validation module for identical trust-boundary checks; retain domain-specific strict schemas. No need for a new validation dependency.
7. Backup is intentionally buffered by its public return type. Browser backup snapshots all relation files, reads selected WAL, and encodes a second full tar; Rust stages a filesystem copy then returns complete archive bytes; N-API copies these into V8. Large backups therefore need multiples of database size in memory/disk. Document/measure a size envelope now; add a streaming destination only when large-db use is a supported requirement. Correct backup-mode exit tracking and selected WAL collection should be preserved.
8. File opening and namespace mutations in Rust SyncHostFileSystem do multiple metadata/symlink checks and eager directory fsyncs; direct OPFS #rebuildChildren() scans the full namespace on every create/unlink/rename. These are likely DDL/temp-file scalability costs, not measured regressions in this review. Profile large relation/temp-file counts before introducing indexes or unsafe syscall shortcuts.
9. N-API memory ownership is conservative in useful ways: requests are borrowed only for synchronous direct calls, actor requests own their bytes, responses/chunks are V8-owned, creator-thread checks protect direct owners, and stream callbacks have one-at-a-time acknowledgement. Its finalizer intentionally leaks/quarantines an unclosed direct owner when the environment goes away, including its lock, instead of invoking unsafe guest shutdown. This is documented caller ownership, but applications must use explicit close/async disposal; the JavaScript forgotten-handle finalizer is best effort and does not make forced Worker termination safe.
10. Browser root execution can block the UI thread and oversized dynamic side modules have the documented Window limitation. Keep the explicit worker entrypoint prominent for real browser applications. No claim that every browser can load every selected carrier in the root realm.

Validation and limits

All review copies/checks are under target/audit/2026-09-07/checks/wasm; production files are unchanged. The copies change relative import suffixes from .js to .ts so Node can run source directly, and substitute only carrier identity constants. The OPFS check uses existing repository fake handles.

Executed successfully:

• rtk proxy node target/audit/2026-09-07/checks/wasm/check.ts: two direct-OPFS crash-boundary reproductions (normal spare and staged overflow).
• rtk proxy node target/audit/2026-09-07/checks/wasm/channel-close-race.ts: deterministic lost wakeup reproduction.
• rtk proxy node target/audit/2026-09-07/checks/wasm/idb-policy.ts: actual writer uses unspecified durability.
• rtk proxy node --expose-gc --experimental-transform-types target/audit/2026-09-07/checks/wasm/queue.ts: unbounded public request retention reproduction, 128 MiB retained behind one session call.
• rtk proxy bun test src/runtimes/wasix-napi/tools/detect-linux-libc.test.mjs src/runtimes/wasix-napi/tools/portable-command.test.mjs: 6 passed, 0 failed.

The two N-API tools tests initially invoked with Node's test runner failed to import bun:test; rerunning with their intended Bun runner passed. Node source stripping initially rejected shared-core constructor parameter properties; the queue check uses Node's transform-types mode. No product failure is inferred from those runner mismatches.

Not executed: complete Vitest suite (workspace node_modules absent), WASIX Rust/N-API artifact integration tests, real-browser OPFS crash/power-loss test, browser large-extension execution, OS-specific addons, full PostgreSQL regression suite, corrupted AOT execution. The Rust buffered-trap and AOT-integrity findings are source-supported; they are not advertised as reproduced runtime failures. Tools argument validation, archive path validation, physical compatibility identity, and async transaction/close cancellation paths were sampled and traced around their principal flows; this does not establish exhaustive correctness of every branch.

Retained first-pass evidence and analysis (revised findings above take precedence)

Targeted WASIX postmaster runtime review

Revision: e8192180bec4494c83bfa3adecbaa9b228b8f05d. Read-only review; no repository changes. This is a bounded second pass over selected process, shared-memory, signal and executor paths in the 44,475-line Wasmer patch and associated libc patch, not a full fork review, build, or proof of concurrent memory safety. Links below identify lines in checked-in patch files, rather than the generated upstream files. The separate target/audit/2026-09-07/wasm-bindings.md covers single-connection bindings and browser persistence.

PM1 — P2: Unmapping shared memory permanently consumes the bounded guest address space

Locations: runtime-selected placement state mapping allocator, unconditional fresh-page reservation, unmap implementation, mapping removal, 256 MiB profile maximum; libc address selection.

In the normal execution phase, install_runtime_selected_shared_memory_mapping always chooses Fresh; the only reuse branch is an inherited reservation during fresh exec. mem_mmap implements Fresh by memory.grow(ceil(mapped_len / 64 KiB)) and returns the old end. mem_munmap restores private memory over the range and removes its active interval; it neither records a reusable interval nor returns it to the guest allocator. Libc deliberately ignores nonfixed address hints and its allocator only claims exact positive sbrk return intervals, so supplying the old address as a hint or ordinary malloc activity does not recover these holes.

Trigger and impact: one long-lived guest repeatedly maps and unmaps a supported shared file. Every successful iteration permanently spends at least one WebAssembly page despite no live mappings. The selected product profile permits only 4,096 guest pages total, including initial memory and heap, so a one-page-at-a-time loop exhausts the available headroom in fewer than 4,096 iterations; larger mappings exhaust it sooner. Subsequent mappings or heap growth fail with ENOMEM. This matters for backends or extensions that create and detach shared mappings throughout a connection's lifetime. PostgreSQL DSM churn is a plausible exercising workload, but was not run or established as the exact production trigger in this pass.

Evidence level: direct source trace through libc dispatch, runtime placement, memory growth and interval removal. No fresh-exec reuse path applies to ordinary map/unmap cycles. No compiled guest reproducer was run. A useful regression is a guest that creates a single 64 KiB backing file and repeats supported mmap(MAP_SHARED, PROT_READ|PROT_WRITE) / munmap beyond its initial-memory-adjusted page budget while keeping at most one mapping live, then verifies allocation still works.

Repair: retain and reuse runtime-owned unmapped intervals before growing memory. Preserve the existing atomic memory.grow reservation for new space and the disjointness from guest heap intervals. Track any 64 KiB allocation padding as well, so small maps cannot leak most of their reserved page. Do not turn arbitrary guest hints into unchecked fixed mappings. Increasing the configured memory maximum only postpones exhaustion.

What the inspected ownership code gets right

These are observations of implemented protections, not a declaration that their entire transitive safety argument is proven.

• Fresh exec has explicit ownership transitions. The shared-memory state distinguishes normal mappings from inherited address reservations, checks exact backing identity/range when reinstalling them, and keeps separate successor-admission and reservation-installation conditions. Process creation uses publication/rollback guards; proc_exec3 retains the child monitor through successor termination. The inspected transition paths use a consistent phase → reservations → active lock order. Copy-memory fork explicitly returns unsupported rather than pretending to provide full POSIX fork; vfork requires the expected Asyncify rewind exports. Relevant areas: mapping exec phase, exec commit, proc_exec3, proc_fork.
• Host remapping has substantial preconditions. The code checks backing lengths/alignment, active-range ownership, stable nonmoving memory capability and exact guest bounds; it rejects an unsupported memory representation before mutation. Shared-file truncation through the runtime takes a registry guard across the shrink. Libc only falls back from runtime unmap on NOENT, while partial overlap is an error. These guards should remain even if the code is reorganized. Relevant areas: VM memory, VM mmap, file shrink guard, libc mmap layer.
• Signal ownership is explicit. The executor opts into a process-global host lifecycle supervisor rather than enabling it implicitly for arbitrary embedders. The Unix adapter saves/restores dispositions, forwards via a nonblocking self-pipe plus pending bitset, saves errno in the handler, and waits for in-flight handler use before closing descriptors. Failed disposition restoration retains the associated resources/exclusivity instead of allowing a reused-descriptor race. Relevant area: Unix signal supervisor.
• Executor policy is appropriately narrow. The inspected runtime is headless, validates the sealed artifact/profile, owns its Tokio runtime, bounds host task admission, uses an explicit code-memory policy and keeps compiler/package acquisition out of the run product. The preinitialized-memory-image metadata explicitly retains ordinary start execution per instance; it is not evidence of silently skipping Wasm start. Relevant areas: execute, runtime, memory image contract.

Validation still needed for a release-level conclusion

No Wasmer build, runtime suite, compiled guest, PostgreSQL concurrency workload, sanitizer run or real signal fault injection was performed in this second pass. The patch includes useful tests for process publication rollback, task-budget accounting, wait ownership, stale identities, mapping behavior and Unix signal restoration; their presence was inspected, their success was not verified here. A blanket claim that the fork is safe or its tests pass would be unsupported.

The highest-value remaining checks are simultaneous guest memory growth/remap and threaded access; fresh-exec failure at each publication/rewind/relocation boundary; cancellation while a child starts or joins; real signal delivery during supervisor installation/destruction; and mapping/backing-file lifetime across process exit and failed exec. Unsafe remapping relies on execution leases and absence of live host memory views. Fully proving those invariants requires auditing all callers, thread scheduling and generated-code access, beyond this bounded pass.

The LLVM changes, serialized artifact validation and relocation internals, preinitialized-memory proof analyzer, file-backed executable-code machinery, networking/epoll changes and the entire virtual filesystem were not comprehensively audited here. No additional concrete flaw is asserted in those areas.

Organization and maintenance

The patch mixes upstream runtime corrections, product policy and optional startup optimizations. Roughly 6,261 new lines belong to the product-owned executor crate itself. Move that crate and its policy/proof tooling into ordinary checked-in first-party Rust sources, preserving the necessary patched Wasmer APIs. This makes direct navigation, linting, tests and revision review available without decoding a generated patch. The compiler and executor separation already present is useful; extraction should preserve it.

Split the remaining runtime changes into dependency-ordered patches with independently named contracts: syscall correctness, process/task ownership, shared-memory remapping, preinitialized images, executable-code backing and compiler optimization. That will not eliminate the need for a runtime fork, but it will isolate upstreamable changes from Oliphaunt policy and make a version upgrade reviewable.

Do not remove the ownership guards just to reduce line count. Simplify the storage and review format first, then use a measured benchmark to decide whether each optional startup optimization earns its maintenance cost. The missing reusable mapping allocation is a concrete example where a smaller explicit runtime-owned allocator is more useful than expanding the existing policy surface.

[f0rr0]

Supporting report F: All39 extension integrations, tools and qualification

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

Extensions, tools, source and release pipelines: intent-aware second pass

Reviewed commit: e8192180bec4494c83bfa3adecbaa9b228b8f05d. This report supersedes the priority and scope of first-pass E1–E7. No production files changed. All 39 public extensions received integration/catalog/build/fixture review; none received a fresh runtime build or execution in this audit. This is an audit of Oliphaunt's changes and integration responsibilities, not an exhaustive audit of upstream extension algorithms.

Intent and boundaries worth preserving

The normative extension packaging policy deliberately requires exact opt-in resources, dependency closure, runtime-owned contrib releases and independently versioned external products. Native dynamic modules, mobile static registries and WASIX side modules are different legal/build products. Generated SDK constants and separate physical-versus-expanded package inventories serve those differences; their existence is not needless duplication.

Read alongside that policy: final-product-source-architecture, wasm postmaster maintainer/public documentation, extension/release/qualification policies, and release invariants. History shows deliberate independent-product separation (#173), task boundaries (#170), unified APIs (#153/#129), runtime-owned contrib (#127), recent source-acquisition serialization (#195), and frozen-candidate reuse fixes (#194/#196/#197/#200). Do not undo these boundaries during cleanup.

The postmaster is explicitly core PostgreSQL with true EXEC_BACKEND concurrency and an immutable compiler-free carrier. It intentionally does not build contrib (build-wasix-core.sh:228), and does not currently consume the 39-extension product catalog. Windows/browser support is explicitly excluded/planned in its own documentation. Extension parity with native/single-backend WASIX is a product decision, not a discovered broken implementation. Native direct lifecycle, broker lifecycle and regular server tools also intentionally have different backup APIs.

The seven external extensions already use PostgreSQL's extension mechanisms for SQL objects, functions, hooks and access methods. Most integration work is build/link/package adaptation, not changes to PostgreSQL semantics. Replacing those adaptations with another extension cannot eliminate MSVC symbol exports, mobile static linking or wasm ABI needs. Prefer upstream build variables; retain the small compatibility adapters that are necessary and make their source-version assumptions explicit.

Disposition of earlier findings

Prior ID	Second-pass disposition	Reason and precise scope
E1	Retain P1	WASIX direct smoke drops protocol responses, so SQL failures pass. Raw APIs intentionally leave parsing to caller; the defect is in this test caller.
E2	Retain P1	Evidence claims all 39 logical round trips after running only a shared pgTAP logical fixture. Further tracing confirms release acceptance requires that fabricated full matrix.
E3	Retain P2, narrow claim	Three valid-SQL parser failures reproduced. Applicable to custom mobile static extension packaging and future pins; no currently shipped extension was shown to fail. Compiled exports are one candidate replacement, not a proved drop-in solution for all aliases/lifecycle functions.
E4	Retain P2, evidence gap	Persistent extension objects are recreated after reopen/restore. There is no observed corruption. Server physical backup is intentionally unsupported by this facade; correct mode-specific evidence rather than forcing it through the wrong API.
E5	Downgrade to optional P3	--force overwrites maintainer-generated build resources, not an installed customer database. Existing behavior is coherent with a force-rebuild command. Transactional output can save rebuild time, but is not an established durability defect.
E6	Retain P1	Maintained Bash 3.2.57 reproduces failure of documented default start. Actual source anchor is launcher line 181, not first report's 166; Bash3 itself reports 166.
E7	Retain P2	Accepted ::1 produces an invalid URI. Actual URI source anchor is line 143, allowlist 75–80, correcting first report's 150/79–80.

E1 evidence: extensions.rs:556 discards activation and fixture responses; client.rs:823 returns buffered PostgreSQL ErrorResponse bytes as a successful transport response. Checking the extension catalog later catches failed CREATE, but not failed functional assertions. Use the existing checked SQL execution/parser at the smoke boundary.

E2 evidence: check-extension-model.py:2303 assigns every mode passed; runtime-smoke.sh:84 explicitly describes narrower test selection; tools.rs:1303 selects only PGTAP for the shared logical round trip. New downstream confirmation: release-candidate-lib.mjs:204 requires direct/server/restart/dump-restore success for every public extension before binding evidence into the frozen candidate. Exact SHA/digest checking faithfully preserves overstated test evidence; it cannot correct its meaning. Fix collection and the required claims together.

E3 evidence: static_registry.rs:286, line-comment stripping at312, statement splitting343, implicit symbol433 and identifier handling469. Extracted actual functions reproduce (a) block-commented nonexistent function retained, (b) dollar-quoted C symbol omitted, (c) unquoted Alive kept uppercase rather than PostgreSQL's folded alive. Existing reproducer (audit-local evidence: oliphaunt-static-parser-audit.rs; observation and scope recorded in this report) is retained. Replacing it must preserve module-local pg_finfo_*, _PG_init, explicit alias metadata and symbol prefixing; enumerating every ordinary C export would be wrong.

E4 evidence: native_extensions.rs:408 skips server backup and repeats the full fixture at417/432; WASIX extensions.rs:468 only checks catalog state after reopen. pg_ivm and pg_textsearch fixtures DROP/recreate their persistent objects, while PostGIS uses a temporary table. The native success marker at174 and receipt writer:122 flatten supported modes and lifecycle stages into an ambiguous combined label. Record exercised pairs explicitly.

E6/E7 reproduction is now retained in launcher-audit.py (audit-local evidence: launcher-audit.py; observation and scope recorded in this report). It creates a fake complete carrier and existing cluster, never a real server. Bash5 default start passes; Bash3.2.57 exits1 with gucs[@]: unbound variable. IPv6 prints postgresql://postgres@::1:5432/postgres, rejected by Python's standard URI parser. Existing launcher tests miss default start because their start case supplies a GUC.

Additional supported findings

ET8 — P2: startup GUCs can disagree with the advertised connection and listener policy

run-release-carrier.sh:175 adds -h/-p, then appends unrestricted -c overrides at181–183. The URI was already constructed from the unmodified host/port at143. The retained fake-carrier repro runs start --guc port=55433 --guc 'listen_addresses=*': it advertises port5432 while passing -p 5432 -c port=55433 -c listen_addresses=*. The latter also contradicts the documented --allow-remote option contract. These accepted inputs produce startup behavior different from the launcher's stated connection settings.

Smallest change: reserve startup settings owned by launcher arguments (port, listen_addresses, and its controlled data/socket settings), rejecting them with a pointer to the dedicated option; alternatively resolve their effective values before validation/printing. Perform validation before initializing PGDATA. Test both explicit flags and conflicting GUCs. Do not introduce a general configuration framework.

ET9 — P2: regression shutdown/readiness can wait forever despite existing bounded supervision

run-wasix-regress-subset.sh:139 sends default SIGTERM then waits without a deadline. PostgreSQL smart shutdown can wait for connected clients; a stuck worker/executor also prevents completion. The readiness loop at150 has a count, but each psql call is unbounded, so it does not establish a readiness deadline. CI's outer job timeout ultimately stops the job; local invocations have no such boundary. The same product already owns process-group identity/deadline/escalation logic in process-supervision.sh.

Smallest change: route this older regression runner through existing supervision and bound individual readiness calls within the total deadline. Test a fake executor ignoring TERM and a fake psql that never returns. This is source-confirmed control-flow behavior; no actual PostgreSQL hang was induced.

ET10 — P3: stale PGXS plan columns and removed AGE logic are maintenance debt

extension_catalog.rs:380 emits six PGXS fields ending with make_args. docker_pgxs_extensions.sh:95 reads seven fields, retaining obsolete stable before make_args, so a real sixth-field argument would be ignored. However all six current PGXS rows contain -; the only nonempty producer at extension_catalog.rs:1081 is removed AGE. The shell also retains an AGE-specific validation. No current39 artifact defect is demonstrated. Delete dead AGE branches and obsolete fields; keep a small producer/consumer schema check if make_args remains supported.

All-extension integration coverage and remaining proof scope

All32 contrib were checked through canonical catalog/contrib manifest, shared build plans, mobile metadata, dependency graph, activation SQL and fixture inventory. Each name below appears once. These families summarize the integration mechanisms reviewed, not a claim of upstream source execution.

Integration family	Extensions	Reviewed adaptation and useful next proof
Standard types/operators/index support	bloom, btree_gin, btree_gist, citext, cube, fuzzystrmatch, hstore, intarray, isn, ltree, pg_trgm, seg	Normal upstream contrib build; native embedded relinking; wasm PIC/side-module ABI; mobile symbol-prefix registry. Existing smoke is basic. Persistent index query/vacuum/reopen verification belongs in the common lifecycle harness.
Dictionaries and packaged data	dict_int, dict_xsyn, unaccent	Control/SQL plus dictionary data inventory; package-relative support files. Preserve clean-consumer dictionary checks instead of assuming successful CREATE proves data closure.
Dependencies and activation exceptions	earthdistance, auto_explain, pgcrypto, uuid-ossp	cube dependency closure; LOAD-only auto_explain; OpenSSL closure; portable UUID replacement. These explicit exceptions are real product semantics and should stay declarative.
Inspection, storage and administrative functions	amcheck, pageinspect, pg_buffercache, pg_freespacemap, pg_surgery, pg_visibility, pg_walinspect	Generic producer/activation/packaging with privileged SQL fixture coverage. Treat privileges/feature availability as a support contract; no source-specific failure found here.
Remaining runtime SQL support	file_fdw, lo, tablefunc, tcn, tsm_system_rows, tsm_system_time	Generic module path, artifact and fixture integration; COPY/files, notifications and sample handlers need topology-specific tests before broader behavioral claims.

External extension	Source/build/patch inspection	Existing proof and smallest consequential missing proof
pg_hashids1.3	Exact pin; upstream two-object PGXS list matches Windows two-source adapter; generic native/wasm/mobile registration	Encode/decode1001 smoke. Add selected upstream SQL cases for empty/large/signed inputs when qualifying a pin/ABI update.
pg_ivm1.13	Exact pin; upstream five objects match Windows and static target file lists; schema/SQL upgrade list and lifecycle mapping	Creates IMMV and checks initial two rows. Add INSERT/UPDATE/DELETE + rollback after creation, then query same IMMV after restart/restore; concurrency applies server topologies.
pg_textsearch0.6.1	Exact pin; native/mobile/WASIX preload/shared-memory and Snowball closure. Windows adapter checks authoritative upstream OBJS/DATA, source existence and version macro; converts seven packed/aligned structs with compile-time size/alignment assertions	Nonempty English BM25 fixture meaningfully exercises dictionary closure. Reopen/recovery never queries retained index; add persistent search and mutation/vacuum, then upstream recovery/concurrent-build subset for concurrent server topology.
pg_uuidv7 1.7	Exact pin; single-module PGXS; Windows clock_gettime shim backed by PostgreSQL timestamp; generic static registry	UUID text length and non-null timestamp only. Assert version/variant and known timestamp conversion, then multithread/collision behavior at documented volume; no unsupported promise of strict ordering.
pgTAP1.3.5	SQL-only recipe/PLpgSQL dependency and generated SQL prefixes. Windows template uses __VERSION__=1.3, which matches upstream NUMVERSION major.minor generation—not a version bug	Shared logical roundtrip genuinely tests pgTAP. Preserve it, but give other extensions their own restore verification.
PostGIS3.6.3	Reduced core geometry/geography build; GEOS/PROJ/SQLite/JSON-C/libxml2/iconv closure; runtime PROJ data. Windows generates config/SQL/Meson and rewrites exported declarations/MSVC compatibility; WASIX edits generated link Makefiles	Useful distance/buffer/within/transform/polygonize/geography smoke and temporary GiST table. Add persistent geometry/GiST roundtrip and selected upstream regression covering local disabled-feature assumptions; no whole upstream suite ran here.
pgvector0.8.2	Exact pin; upstream19-object list matches Windows19-source adapter; clears upstream OPTFLAGS for portable PGXS. Upstream already deliberately uses associative FP optimization, so Windows /fp:fast alone is not evidence of accidental semantics	Only scalar vector distance is asserted. Add HNSW+IVFFlat build/search/delete/vacuum on retained objects; crash/concurrent build coverage where topology supports it.

Exact upstream Makefiles were downloaded read-only at the repository's six immutable pins into checks/upstream (audit-local evidence: upstream; observation and scope recorded in this report). A bounded source-list comparison verified pg_hashids2, pg_ivm5, pg_textsearch32, vector19 sources. This rules out current source-list omission for those adapters; it does not compile them. PostGIS dependency source versions checked: GEOS3.14.1, PROJ9.8.1, SQLite3.53.1, JSON-C0.18, libxml2 2.14.6, libiconv1.19. Algorithm internals remain upstream scope.

Source, release and organization conclusions

Source acquisition has exact-commit HTTPS transport, disabled submodule recursion, archive/checksum/expansion validation, dirty-checkout protection and transactional promotion; relevant fault tests passed in first pass. Recent Moon graph serialization addresses shared acquisition. No additional source integrity failure was established. Preserve this implementation. The separate documented opt-in pggraph/pg_search pgrx candidate harness has its own bounded/transactional fetch; it is not part of public39. Its existence conflicts with broad branch-only extension policy wording, but is an explicit experiment/support-policy inconsistency, not a shipped missing extension. Resolve that scope deliberately before deleting working experimental machinery.

Native lifecycle CI consumes same-run Linux-x64 runtime/exact-extension/broker/proof-runner artifacts (ci.yml:2219), records their byte/hash identities, and checks candidate SHA/tree and full planned sharded coverage at aggregate time. The SHA/identity safeguards are meaningful. This specific lifecycle job is Linux-x64 only; other desktop/mobile package/consumer jobs cannot be inferred to provide the same lifecycle dimensions. Describe receipt coverage as actual target/mode/stage cells. No artifact-substitution hole was established in this pass.

Release-candidate evidence binds exact source/run/attempt and complete public extension identities; tests also reject changed bytes and permit earlier successful attempts of the same run intentionally. Frozen-candidate reuse/control repair is deliberate. The main release weakness found here is inaccurate semantic evidence (E1/E2/E4), not the number of digests. Adding another checksum layer would not fix it.

Postmaster qualification uses the sealed carrier and embedded-concurrent/safe GUC profile, but qualify-release-carrier.sh:13 invokes a qualification harness, not the packaged public launcher. Default launcher startup uses ordinary PostgreSQL settings. Do not claim qualification memory/resource measurements describe that default invocation. Choose and document intended default settings, then add a small real packed-launcher consumer test on each supported host; this would have caught E6. Do not duplicate the expensive entire recovery campaign just to test shell option plumbing.

Maintainability priority: isolate extension-specific source transformations from the 3,370-line Windows PostgreSQL producer into per-extension build adapters owned with each recipe, while retaining one common Meson-module helper. Preserve fail-fast upstream markers and pg_textsearch layout assertions. PostGIS's patches README saying only build flags are used is incomplete for Windows; tests/regression.sql:1 points at absent upstream.toml. Replace these misleading placeholders with the actual adapter/proof inventory.

Performance opportunities remain measurements, not proven regressions: native/WASIX convenience logical dumps retain complete strings; add a streaming/file route only with a clear large-database API requirement. PostGIS WASIX currently whole-archives its support closure with export-all/no-GC (build_wasix.sh:240); benchmark carrier bytes, AOT time and startup before reducing exports, protecting constructors and runtime lookup symbols. Postmaster's separate full native PostgreSQL client-tool build could reuse the owned tools carrier plus pg_regress, but ABI/version/qualification needs must be preserved. Avoid replacing all of this with another generic build framework.

TODO checklist

Priorities are implementation order within this area. P1 blocks trusting the advertised behavior/proof, P2 is an actionable correctness or qualification gap, P3 is optional cleanup/measurement. No TODO requires changing public support implicitly.

• ET-01 P1 — Make direct extension smoke fail on SQL ErrorResponse. Use existing checked SQL execution. Acceptance: a deliberately failing functional statement and activation statement each fail direct smoke with extension/statement context; all 39 normal direct smoke pass. Dependencies: none.
• ET-02 P1 — Produce honest per-extension WASIX lifecycle evidence. Collect actual extension/mode/stage result rows; add real logical roundtrips for claimed supported cells and reject missing rows at release binding. Acceptance: omit/fail any one extension's dump/restore and collector+candidate fail; successful39 matrix traceable to executed cases. Dependencies: ET-01, ET-04 seed/verify fixtures.
• ET-03 P1 — Fix default macOS launcher. Guard optional Bash array expansion. Acceptance: shipped documented no-GUC start executes with maintained Bash3.2 and Bash5; existing GUC case still passes. Dependencies: none.
• ET-04 P2 — Verify retained extension state and report mode-specific lifecycle. Split fixtures into seed and verify; query retained index/IMMV objects after reopen and physical/logical restore, then modify them. Avoid CREATE/DROP in verify. Receipt must not label native server backup passed when skipped. Acceptance: deliberately missing/corrupt fixture object fails reopen/restore verification; supported cells alone appear in receipts. Dependencies: ET-01 for WASIX; supported backup API per mode.
• ET-05 P2 — Correct accepted host and startup-setting handling. Bracket IPv6 URI literals; reject or consistently resolve launcher-owned GUC overrides before initialization. Acceptance: ::1 URI parses, port override cannot advertise another port, remote listening follows the documented --allow-remote contract. Dependencies: none; can share tests with ET-03.
• ET-06 P2 — Replace incomplete static-registry SQL interpretation. Choose compiled pg_finfo metadata plus explicit lifecycle/aliases, or an actual SQL parser; retain prefixing and strong selected-symbol checks. Acceptance: block comments, dollar quotes, folded/quoted identifiers and aliases work in a custom static artifact; one iOS/Android clean consumer loads it. Dependencies: mobile binary/toolchain qualification.
• ET-07 P2 — Use bounded supervision in regression runner. Reuse process-supervision for child identity/timeout/escalation and bound readiness calls. Acceptance: TERM-ignoring executor and hung psql finish with diagnostic failure inside declared deadline, leaving no children. Dependencies: none.
• ET-08 P2 — Add an intent-focused extension behavioral subset. Start with pg_ivm maintenance/rollback, vector HNSW+IVFFlat, textsearch persisted BM25, and PostGIS persistent GiST/transform; reuse pinned upstream cases where practical. Acceptance: selected tests execute through each modified ABI/topology where support is claimed, result receipts distinguish target and topology. Scalar contrib/SQL-only smoke stays lightweight. Dependencies: ET-01/ET-04; actual native/mobile/WASIX products.
• ET-09 P2 — Qualify the public postmaster launch path. Decide default GUC contract, document any resource-profile distinction, run a small packed default start/connect/stop test on Linux/macOS. Acceptance: published instructions execute exactly; tested defaults and reported memory profile agree. Dependencies: ET-03/ET-05, supported-host build artifacts.
• ET-10 P3 — Remove obsolete PGXS AGE/column code. Align producer/consumer field count; delete removed-only exceptions. Acceptance: all six current PGXS rows parse identically; a future optional makearg cannot disappear silently. Dependencies: none.
• ET-11 P3 — Move extension adapters next to recipes and document actual modifications. Extract Windows per-extension helpers without semantic edits; keep common producer small; fix misleading PostGIS patch/regression placeholders. Acceptance: generated source/SQL/module inventories byte-equivalent for current pins, existing compile assertions retained. Dependencies: no broad generation rewrite.
• ET-12 P3 — Resolve explicit experiment/support-policy mismatch. Document opt-in pgrx candidates separately or remove them deliberately; do not advertise as public39/postmaster support. Acceptance: one unambiguous support inventory and no conflicting branch-only claim. Dependencies: product support decision.
• ET-13 P3 — Measure large-dump and PostGIS carrier costs. Measure dump RSS/throughput and PostGIS bytes/AOT/startup, then implement smallest streaming or export-list optimization justified. Acceptance: measured benefit with complete output and constructor/SQL function lookup preserved. Dependencies: benchmark artifacts; no speculative framework.
• ET-14 P3 optional — Stage maintainer resource replacement before promotion. Only if rebuild resilience is valuable; preserve documented force behavior. Acceptance: bad candidate leaves previous generated output intact. Dependencies: none; not a release/durability blocker.

Checks executed and limits

Second pass: retained launcher repro confirmed Bash3 default-start failure, IPv6 URI failure and GUC advertisement/policy discrepancy; pinned upstream source-list comparisons passed for four C extensions; pgTAP major.minor template version was confirmed against its pinned Makefile. release-candidate-lib.test.mjs: 8 tests passed. native-extension-lifecycle-receipts.test.mjs could not initialize because installed Moon2.3.2 differs from pinned2.5.4 (environment limitation, not a test assertion failure).

First-pass checks retained:46 source-acquisition/component-contract tests passed;87 native tool-argv cases passed;1 standalone native tools unit test passed; static SQL parser reproduced three defects; launcher/process-supervision/server-lifecycle shell tests passed. No actual extension SQL/native/mobile/WASIX producer builds, full upstream regressions, real-server carrier tests, full exact-SHA release qualification or performance measurements ran. These remain explicit checklist acceptance work, not implied audit validation.

Retained first-pass evidence and analysis (revised findings above take precedence)

Extension and intermediate-product audit

Reviewed commit: e8192180bec4494c83bfa3adecbaa9b228b8f05d (fetched main).

This is a source audit of all 39 catalogued extension integrations, their shared native/WASIX/mobile build and packaging paths, source acquisition, and native logical tools. None of the 39 upstream extension implementations was individually executed: pinned source checkouts and produced native/WASIX artifacts are absent. Findings distinguish observed code defects, reproduced parser errors, and unmeasured performance opportunities. No repository source changes were made.

Prioritized findings

1. P1 — WASIX direct extension qualification ignores PostgreSQL errors. src/bindings/wasix-rust/crates/oliphaunt-wasix/src/oliphaunt/extensions.rs:556-576 sends activation and every functional smoke statement with exec_protocol_raw, then discards the response. client.rs:821-831 deliberately returns Ok(response) when the transport succeeds; raw callers own parsing PostgreSQL ErrorResponse. Consequently a DO block's RAISE EXCEPTION, missing C function, or invalid extension query can pass direct qualification. The subsequent catalog-count check catches a failed CREATE EXTENSION for persistent databases but cannot catch broken extension functions or indexes. The sqlx server path does parse server errors, so this specifically masks differences between direct and server execution. Smallest remediation: use the existing typed execution/response parser in this test helper and add one mutation check proving a deliberately failing SQL statement makes qualification fail. Confidence: high from complete caller/implementation trace; no runtime artifact required to establish return semantics.

2. P1 — Recorded full-lifecycle evidence asserts untested dump/restore success for every extension. src/extensions/tools/check-extension-model.py:2294-2308 unconditionally writes "dump-restore": "passed" for all catalog entries. Its collector runs runtime-smoke.sh regression, whose lines 84-94 explicitly state that the three exhaustive extension tests cover direct, restart, server and materialization, and execute only public_tools_round_trip_shared_logical_fixture for logical restore. That fixture selects only PGTAP (src/bindings/wasix-rust/crates/oliphaunt-wasix/src/oliphaunt/tools.rs:1303-1318). There is a separate uuid-ossp dump test, but the collector's extension_tests::public_extensions filter does not select it. The generated evidence therefore passes --require-current-evidence even if, for example, pg_ivm or pg_textsearch cannot restore a logical dump. Smallest remediation: add a real per-extension logical round-trip harness and have the evidence writer consume its result rows; until that exists, represent only exercised modes as passed. A collector exit code alone must not generate a larger matrix than the collector executed. Confidence: high, traced exact test selection and evidence writer.

3. P2 — Mobile static registry is derived with an incomplete SQL parser and mishandles valid extension scripts. tools/native-packaging/src/static_registry.rs:286-367 understands only single-quoted strings and line comments. It scans all versioned SQL files (:242-271), collects commented-out declarations from block comments, misses dollar-quoted AS arguments, and preserves case for unquoted implicit C function names (:433-491). Reproduced directly using an extracted copy of the actual functions and rustc: a block-comment declaration yields both alive_symbol and nonexistent removed_symbol; AS $$MODULE_PATHNAME$$, $$alive_symbol$$ LANGUAGE C yields no symbols; CREATE FUNCTION Alive() ... AS 'MODULE_PATHNAME' LANGUAGE C yields Alive instead of PostgreSQL's alive. These cause missing-function errors or native link failures for valid prebuilt custom extensions and create fragile PostgreSQL/extension-upgrade behavior. Smallest remediation: generate the registry from compiled module pg_finfo_* exports and explicit lifecycle/alias metadata rather than reparsing PostgreSQL SQL; alternatively use a real PostgreSQL parser at build time. Do not expand the homegrown lexer one special case at a time. Reproducer retained at target/audit/2026-09-07/checks/oliphaunt-static-parser-audit.rs and executable <audit-scratch>/oliphaunt-static-parser-audit.

4. P2 — Restart/backup extension proofs do not verify persistent extension state. WASIX reopens the database and checks only the pg_extension row (extensions.rs:468-478, :646-668). Native src/sdks/rust/tests/native_extensions.rs:415-432 reuses the complete setup fixture after reopen and physical restore; the pg_textsearch fixture immediately drops and recreates its BM25 index/table (src/shared/fixtures/extensions/pg_textsearch.sql:4-18) and pg_ivm drops its incremental view and source table (pg_ivm.sql:1-9). Missing/corrupt persisted index content and broken incremental maintenance after reopen can pass by reconstruction. Native server mode does not perform backup/restore at all (native_extensions.rs:408-422), although the aggregate success line at :174 gives one lifecycle label across all modes. Smallest remediation: divide fixtures into seed and verify phases, rerun verification without CREATE/DROP after reopen/restore, then mutate base rows after restoring pg_ivm and query the existing BM25/vector index. This is a test correctness gap rather than evidence of an observed storage corruption.

5. P2 — Replacing packaged resources deletes a working installation before validating/extracting its replacement. tools/native-packaging/src/bin/package_resources.rs:995, :1017, :1035-1058 remove the whole output directory for --force, before opening or decoding the candidate archive (:1067). A bad gzip, unsupported archive extension, disk-full or read error loses the previous valid resources and leaves an incomplete directory. The local builder similarly deletes output/oliphaunt (tools/native-packaging/src/package.rs:3-15) before copying the complete tree. Smallest remediation: use a sibling staging directory, validate/build it, then rename with rollback. The source fetcher's existing transactional approach (src/sources/tools/source-fetch-core.mjs:243) demonstrates the desired contract. This is lower priority than database durability but belongs in the same product's reusable packaging behavior.

Performance and organization

• Logical dumps are necessarily proportional to dump size in RAM with the current API. Native pg_dump returns only String; both stdout and stderr are piped and wait_with_output() buffers them completely (src/runtimes/liboliphaunt/native/crates/tools/src/lib.rs:202-242). Script input is another owned byte vector. PgDumpOptions rejects --file, archive format, compression and parallel jobs in arguments.rs:105-149, so the public facade cannot route a large database dump to disk or a streaming destination. WASIX bindings use the same complete-string public contract. Preserve these convenience methods but add one Read/Write or explicit file API and bounded stderr. Measure a multi-gigabyte dump's RSS and throughput; no benchmark was run here. The existing stdin writer thread correctly avoids the classic stdin/stdout pipe deadlock and should remain.
• PostGIS is the first artifact-size optimization target. src/extensions/external/postgis/tools/build_wasix.sh:240-257 combines --export-all, --no-gc-sections and --whole-archive across GEOS, PROJ, SQLite, JSON-C, libxml2, libiconv and the C++ runtime. This intentionally retains the entire support-library closure, including symbols PostGIS may never reference, increasing download, AOT compilation and module initialization cost. An export list based on actual undefined references plus constructor/lifecycle roots should be evaluated before a broader runtime redesign. Benefit is unmeasured, and constructor correctness must be retained. The same script modifies generated Makefiles via unchecked regex substitutions (:260-269); an upstream build-file change can silently skip these mutations. Prefer PGXS variables or small checked patches with apply verification for genuinely unavoidable build changes.
• Consolidate the catalog producer, not every language wrapper. tools/xtask/src/extension_catalog.rs discovers/writes the catalog and plans, while src/extensions/tools/check-extension-model.py validates recipes and generates SDK/mobile projections, and its JS wrapper launches Python before checking Android legal metadata. The public metadata already has one generated SDK JSON, so finish making product recipes the only hand-maintained source and select one owner for generation. Maintaining release TOML, source catalog JSON, contrib TOML and exception recipes as competing entry points makes upgrades require coordinated edits that checks detect only afterward. Keep generated per-language constants: they avoid runtime catalog parsing in consumer SDKs.
• Remove or explicitly isolate the second extension universe. src/runtimes/liboliphaunt/native/postgres18/external-extensions.toml:4-36 still contains pggraph and paradedb-pg-search as candidates outside the 39-entry public catalog. bin/check-external-extension-pins.sh repeats their pins as literal grep checks; build-external-pgrx-extensions-macos.sh has a separate fetch/package pipeline and platform support contract. These are not shipped public extensions, but they are maintained on main and contradict the declared policy that incomplete extensions stay on branches. Delete dormant experiments or adopt the shared recipe/source-fetch/catalog flow before shipping them. Merely using PostgreSQL extension APIs will not solve duplicated packaging policy.
• Archive handling diverges unnecessarily. Source acquisition has bounded HTTPS-only downloads, checksum checks, safe archive member validation, transactional promotion, dirty-tree protection and fault tests. Native extension artifacts have a dedicated archive policy and reject unsafe links. The older release resource resolver still calls general-purpose tar::Archive::unpack and uses a much smaller ZIP extractor, and lacks equivalent size/member/duplicate-path validation. Reuse one checked extraction contract with format-specific readers; do not grow another release-specific archive implementation.

Complete inventory coverage

All 32 contrib entries were checked against src/extensions/contrib/postgres18.toml, the shared catalog, generated native/WASIX/mobile plan, and shared smoke inventory. They are: amcheck, auto_explain, bloom, btree_gin, btree_gist, citext, cube, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, intarray, isn, lo, ltree, pageinspect, pg_buffercache, pg_freespacemap, pg_surgery, pg_trgm, pg_visibility, pg_walinspect, pgcrypto, seg, tablefunc, tcn, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp.

Special shared contracts inspected: earthdistance's cube dependency; auto_explain's LOAD-only lifecycle; pgcrypto's OpenSSL closure; uuid-ossp's portable UUID closure; dict_xsyn/unaccent data files; static-only mobile export generation. The dependency graph is already centralized in native-components.toml and rejects cycles and overlapping target declarations. These are good boundaries to preserve.

External product	Reviewed integration	Significant remaining behavioral gap
pg_hashids 1.3	Exact source pin, generic PGXS/native/mobile plan and SQL activation	Smoke checks a single encode/decode pair; signed/large input boundaries not exercised
pg_ivm 1.13	Exact source pin, explicit five-file mobile source list, schema/lifecycle and packaging	Smoke only creates IMMV and checks initial count; no post-create INSERT/UPDATE/DELETE, rollback or concurrent maintenance
pg_textsearch 0.6.1	Exact source pin, recipe, preload/shared-memory metadata, recursive mobile sources, English/Snowball data closure	Reopen test does not query persisted BM25 index; WAL/recovery/concurrent writes not established
pg_uuidv7 1.7	Exact source pin, generic PGXS/native/mobile plan and smoke	Smoke checks UUID text length and non-null timestamp, not version/variant, timestamp range, collision/concurrency behavior
pgtap 1.3.5	SQL-only recipe, plpgsql dependency, special SQL-file prefixes, tool round trip	Useful shared logical fixture; cannot stand in for other extensions' dump/restore semantics
PostGIS 3.6.3	Recipe, native/WASIX/static targets, dependency closure, PROJ data/environment, build script	Existing functional smoke is useful but temporary-table based; tests/regression.sql is only a comment referring to absent upstream.toml; no upstream regression execution found in reviewed paths
pgvector 0.8.2	Exact pin, generic PGXS and static paths, optimization portability	Fixture creates one vector row and checks distance only; no HNSW/IVFFlat build/search/vacuum/recovery/concurrency

PostGIS transitive pins reviewed: GEOS 3.14.1, PROJ 9.8.1, SQLite 3.53.1, JSON-C 0.18, libxml2 2.14.6 (canonical GNOME plus exact-commit mirror), libiconv 1.19 (checksum-pinned archive). Shared OpenSSL, ICU and portable UUID ownership was checked through the native component graph; their algorithm internals were outside this subtask.

Intermediate products reviewed: native pg_dump/psql Rust facade and argument validator; WASIX pg_dump/psql carrier generation and build closure; native logical-tools proof runner; all-extension proof runner; native resource/extension artifact/index packagers; static registry; WASIX extension packager; xtask catalog/source/asset utilities; source fetch and tar/zip checks. pg_basebackup is required in the native tools artifact closure, but the Rust logical facade exposes only pg_dump and psql. Standalone pg_restore is not part of the exposed facade; restore is intentionally psql/plain SQL, which should be stated in API/docs and tested accordingly.

Checks actually run

• rtk proxy bash tools/dev/bun.sh test src/sources/tools/source-fetch-core.test.mjs src/extensions/tools/native-component-contract.test.mjs: 46 passed, 0 failed. Includes exact-commit failover, dirty checkout protection, failed-promotion rollback, archive traversal/link/expansion faults, and target dependency closure.
• Native argument validator compiled directly with rustc against all canonical logical-tools.json cases: 87 accepted/rejected argv checks passed; target/audit/2026-09-07/checks/oliphaunt-tools-argv-audit.rs retains the harness.
• rtk proxy rustc --edition=2024 --test src/runtimes/liboliphaunt/native/crates/tools/src/lib.rs -o <audit-scratch>/oliphaunt-native-tools-unit-audit; executable: 1 passed.
• Actual static registry parsing functions compiled in target/audit/2026-09-07/checks/oliphaunt-static-parser-audit.rs: reproduced the three valid-SQL defects above.
• rtk proxy bash tools/dev/bun.sh src/extensions/tools/check-extension-model.mjs --check: blocked by environment; installed Moon is 2.3.2, required is 2.5.4. This does not establish a repository failure.
• No native/WASIX producer builds, extension SQL executions, mobile clean-consumer tests, GitHub exact-SHA release gate or performance benchmarks were run. Existing CI evidence cannot be treated as proof of the unexecuted lifecycle modes identified above.

Bounded postmaster launcher/lifecycle second pass

Additional files traced: release launcher and package script, client-tools builder, regression runner, qualification start/stop path, process supervision, TCP/cgroup lifecycle helpers, and PostgreSQL profiles. No PostgreSQL/Wasmer build or real server was launched.

6. P1 — Packaged postmaster default start fails under macOS's Bash 3.2. src/runtimes/liboliphaunt/wasix-postmaster/bin/run-release-carrier.sh:166 expands "${gucs[@]}" under set -u when no --guc was supplied. Reproduced with the existing maintained <audit-scratch>/bash (GNU Bash 3.2.57), a fake complete carrier and a complete existing cluster. start --data-dir DIR exits 1: line 166: gucs[@]: unbound variable. Same invocation under Bash 5 exits 0. The release package copies this launcher verbatim (bin/package-release-assets.sh:95-97). Existing run-release-carrier.test.sh passes even under Bash 3.2 because its only start case supplies --guc max_connections=16; it never checks the documented default invocation. Smallest fix: guard the optional array expansion using the established ${gucs[@]+"${gucs[@]}"} idiom and exercise default start under Bash 3.2.

7. P2 — Accepted IPv6 loopback host produces an invalid connection URI. bin/run-release-carrier.sh:79-80 accepts --host ::1, but line 150 builds postgresql://$username@$host:$port/$database without IPv6 brackets. Running uri --data-dir DIR --host ::1 produced postgresql://postgres@::1:5432/postgres; Python's standard URI parser rejected its port as :1:5432. PostgreSQL URI consumers likewise require postgresql://postgres@[::1]:5432/postgres. Smallest fix: bracket colon-containing host literals for URI rendering while passing the original host to PostgreSQL; add this exact accepted-input test.

Further product/cohesion observations:

• Postmaster is a distinct extension-support product today. bin/build-wasix-core.sh:228 explicitly builds core server/tools, PL/pgSQL, Snowball and encoding conversions with no contrib. It does not consume the 39-entry shared extension catalog. Do not label the native/single-backend WASIX extension evidence as postmaster support. Feed the same extension build/model contract into this lane if parity is intended, with its own fork/concurrency/recovery evidence.
• The qualified startup profile differs from the public startup profile. bin/qualify-wasix-immediate-recovery.sh:369 resolves embedded-concurrent + safe; these force io_method=sync, shared_buffers=32MB, max_connections=8, plus durability settings, and the recovery campaign validates them. The release launcher supplies only data directory, listen host/port and disabled Unix socket, and the package script carries no profile files. Thus the release's measured memory and recovery envelope is not the default user's invocation. Resolve defaults once and make the clean-consumer qualification invoke the shipped launcher, or explicitly qualify and document each supported profile.
• Use the existing bounded process supervision consistently. lib/process-supervision.sh already uses process groups, birth identities, deadlines, reaping and escalation. bin/run-wasix-regress-subset.sh:139-143 still performs an unbounded kill/wait on one PID; a stuck smart shutdown or surviving child can stall local/CI regression indefinitely. Readiness has a retry count but each native psql invocation is unbounded. Call the existing supervision functions rather than retaining a second older lifecycle implementation.
• Avoid building a second complete native PostgreSQL for client tools. bin/build-native-client-tools.sh:126-132 runs top-level make and make install on another baseline, while the repository already owns a native tools artifact. Its configuration/signature and TLS/compression exclusions are separate from the main native tools product. Reuse the exact-version native tools carrier where possible and build only pg_regress or truly additional test helpers locally.

Second-pass checks actually run:

• rtk proxy bash .../bin/run-release-carrier.test.sh: passed.
• rtk proxy bash .../lib/server-lifecycle.test.sh: passed.
• rtk proxy bash .../lib/process-supervision.test.sh: passed.
• Launcher test run through Bash 3.2.57 with Bash3 first on PATH: passed, revealing the missing default-start case.
• Direct minimal fake-carrier default-start invocation: Bash5 passed; Bash3.2.57 failed with the empty-array error above.
• Direct minimal fake-carrier IPv6 uri invocation: produced the invalid URI above, rejected by standard-library parsing.

[f0rr0]

Supporting report G: Coverage, actual checks, limitations and checklist crosswalk

Snapshot: audit of main at e8192180bec4, September7–8,2026. Current checklist priorities and revised findings take precedence over any retained first-pass wording. Implementation reported in open PR #202 must be reconciled after merge; this report is not a review of that PR.

Evidence distinguishes source review, exact-source boundary tests, real host algorithm checks and unexecuted product qualification. Scratch harnesses/build outputs are not attached; their relevant observations, scope and source references are included below.

---

Coverage and evidence ledger

Audit target: e8192180bec4494c83bfa3adecbaa9b228b8f05d (origin/main fetched again, unchanged). The requested product families are all represented below. This is comprehensive product/integration coverage with deeper review of modified execution flows; it is not a line-by-line proof of every upstream dependency, every compiler hunk or every possible runtime schedule.

The tracked-file inventory (supporting report G — Coverage, validation and task crosswalk) makes the source scope visible. Counts include tests, manifests and build files and are not read-file or verified-file counts. Agents' detailed coverage tables identify the actual flows they traced. Documentation was used as evidence of intent, then checked against implementation and tests. A valid design rationale does not excuse a wrong implementation; an explicit supported limitation does not automatically become a bug.

Coverage by product and responsibility

Area	Coverage across both passes	Evidence actually obtained	Remaining limitation
PostgreSQL native changes	All20 patch purposes and upstream touchpoints inventoried; assembled startup, exit, signals, cwd, host I/O, mobile shmem/semaphore, static loader, seed collation and checkpoint flows reviewed	Both18.4/18.6 source application; C boundary suites; complete native traffic-cop compilation	No full current native runtime producer or real embedding-consumer matrix
PostgreSQL single WASIX changes	All43 patches inventoried; host-driven loop/recovery/COPY and maintenance traced; algorithm/atomics/build/port assumptions assessed	Both source applications; LIKE differential function check; isolated full-host-PG JSONB comparison	No full guest build/regression replay; single-owner and generated-code invariants need actual target evidence
PostgreSQL Postmaster changes	All5 local patches,7 reused patches and6 overlays inventoried; fresh EXEC_BACKEND, POSIX DSM, wait/join/latch contracts traced	Both source applications; provenance/latch/concurrency checker tests	No actual concurrent carrier or compiled latch/DSM stress
Wasmer/libc fork	Architecture and broad compiler, artifact, image, mapping, VFS, networking, epoll, process/task/signal regions inspected; original agent coverage expanded	Exact helper check, five start-proof tests with compatible cached dependencies;12 concurrency checker and4 import checker tests; source-lock checker tests	Selected branches/regions, not every141 changed file exhaustively verified; no pinned whole-fork build or compiler proof
Native C ABI	All central lifecycle/protocol/error/config/process/archive/fs responsibilities traced end to end	Existing generation/error/registry/descriptor tests; exact-source boundary observations; restore metadata timings	Backend doubles for added boundary checks; no live C runtime in this audit
Rust native SDK	Blocking/async executor, transaction ownership, storage, direct/broker/server, cancel/close, protocol and resources	First-pass199 library tests; public broker observations; source traces	Some artifact-dependent tests self-skip; no full live SDK regression
JS native SDK / Node addon	Typed/raw query, inference, callback streams, server/broker launch, native resource resolution, worker/finalizer ownership; Deno path source review	Exact-source addon fixture suite57+5+1; Node process/socket checks	No real-PG addon run; Vitest dependencies absent; Deno unavailable; Bun/Deno adapters not executed
Swift	Typed values/results, transaction scope, serial owner, C bridge, resources, close/cancel/callback diagnostics	94 tests first pass; exact-source bridge observations; normal source review	Unit tests do not establish real Swift-to-PG execution; no iOS/device run
Kotlin / JNI	Typed protocol, coroutine owner/cancellation, root preparation, resources, backup/restore, JNI strings/lengths/errors	79 JVM +133 Android unit tests; bridge checks; packet allocation measurement	No actual Android installed runtime or hardware performance measurement
React Native	JS query core and iOS/Android native delegation; JSI acknowledgement/invalidation and generation ownership	Source traces and bounded state observations	No Expo installed-app E2E during audit
WASIX Rust/TS/NAPI	Public FIFO/transaction ownership, AOT, recovery, browser worker and addon lifecycle, byte channels, persistence	Source review and selected actual-source helper checks	No complete addon/browser/runtime consumer matrix
Browser storage	Memory/host/IDB/portable OPFS/direct OPFS design and higher-risk durability/namespace flows	Explicit IDB intent confirmed; pool/source observations	No real browser recovery campaign or hardware durability proof
All39 public extensions	All32 contrib and7 external catalog/build/activation/resource/fixture responsibilities; modified adapter assumptions reviewed	Source-list comparison at immutable pins for four C extensions; parser/receipt checks; existing component tests	None freshly built/executed; upstream algorithms are not independently audited in full
Tools and launchers	Native psql/pg_dump facade, WASIX tools/transport, public Postmaster launch/readiness/shutdown, packed-carrier option flow	87 argv cases; native tool unit test; shell/launcher checks	No actual packaged tool/server consumer matrix
Seeds and ICU	Native and Datum32 domains, profiles, runtime capability/data pairing, producer environment, descriptor publication, ABI receipts	12 existing seed/ICU tests; contract and producer source review	Cross-target receipts are not mobile execution evidence; final locale/seed probes remain
Sources and release/qualification	Exact source ownership, shared acquisition, extension matrix/evidence collector, frozen candidate source/run/attempt identities, lifecycle CI	46 source/component tests first pass;8 release-candidate tests second pass	Moon2.3.2 vs required2.5.4 blocked receipt/model task initialization; no full exact-SHA CI run
Performance and organization	Existing intent/results, core micro-optimizations, SDK copies/queues/threads, restore algorithm, package closure and dead code	Measured Kotlin allocation and archive metadata scaling; selected prior historical results treated as context	No fresh complete product performance matrix; many optimization proposals intentionally conditional

The six upstream extension Makefiles inspected at immutable pins are retained in the checks directory. The all 39 extension table in extensions-tools.md (supporting report F — All extension integrations, tools and release evidence) identifies every name and the behavior worth adding; it does not equate successful CREATE EXTENSION with tested index, recovery or incremental-view semantics.

Website presentation, unrelated account/publication operations, complete third-party library internals and every historical experiment are outside the requested runtime/SDK/integration audit. Release code was reviewed where it qualifies or packages these products. No messages, releases, commits or external publication were performed.

Checklist crosswalk

The consolidated65 items are deduplicated from the following detailed lists. Ranges here are task IDs, not claims that one test proves every listed behavior.

Detailed owner items	Consolidated items
CORE-01–CORE-07	01,06–07,14–18,58,60
Native ND-C01–ND-C09	02–04,08–13
Native ND-C10–ND-C15	51,53–56,62
Native D-C01–D-C06	01,06,10,14,18,24,50,63
Native Q-C01–Q-C02	38–39
WASIX WA01–WA04	05,19–20
WASIX WA05–WA12	21–24,39,43
WASIX WA13–WA23	43–47
WASIX WA24–WA30	57,59–61,63–64
Mobile MOB-C01–MOB-C06	25–30
Mobile MOB-Q01–MOB-Q04	40–42
Mobile MOB-P01–MOB-P03	52,54,56
Mobile MOB-O01–MOB-O02	50,61
Mobile MOB-D01–MOB-D02	63
Extensions ET-01–ET-07	31–37
Extensions ET-08–ET-09	48–49
Extensions ET-10–ET-14	55,58,62,64–65

How to read confidence

• Observed behavior: a supplied local check or ordinary test demonstrated the described boundary/algorithm outcome. Read its scope: a backend double is not real PostgreSQL; a host helper is not the entire Wasmer product.
• Source-supported: the relevant control flow and callers establish the concern, but its full product trigger has not been executed here.
• Contract decision: intended behavior or supported scope needs a deliberate choice. It is not a request to implement every possible capability.
• Qualification gap: the report identifies what current tests/evidence do not establish; it does not assert unobserved corruption or failure.
• Conditional performance: measure realistic costs before implementation; retain the existing simpler code if the gain is negligible.

Source inventory

These are tracked-file counts, not read/verified-file counts.

scope,tracked_files,prefix,meaning
PostgreSQL inputs,5,src/postgres/,"inventory count, not a claim every file was read"
Native runtime/C/build,126,src/runtimes/liboliphaunt/native/,"inventory count, not a claim every file was read"
Single WASIX runtime/build,142,src/runtimes/liboliphaunt/wasix/,"inventory count, not a claim every file was read"
Postmaster runtime/build,136,src/runtimes/liboliphaunt/wasix-postmaster/,"inventory count, not a claim every file was read"
WASIX Rust bindings,51,src/bindings/wasix-rust/,"inventory count, not a claim every file was read"
WASIX TypeScript bindings,167,src/bindings/wasix-ts/,"inventory count, not a claim every file was read"
Node native boundary,18,src/runtimes/node-direct/,"inventory count, not a claim every file was read"
WASIX NAPI boundary,25,src/runtimes/wasix-napi/,"inventory count, not a claim every file was read"
Broker/helper/build,58,src/runtimes/broker/,"inventory count, not a claim every file was read"
Rust SDK,58,src/sdks/rust/,"inventory count, not a claim every file was read"
JavaScript SDK,63,src/sdks/js/,"inventory count, not a claim every file was read"
Swift SDK,92,src/sdks/swift/,"inventory count, not a claim every file was read"
Kotlin SDK,50,src/sdks/kotlin/,"inventory count, not a claim every file was read"
React Native SDK,76,src/sdks/react-native/,"inventory count, not a claim every file was read"
Extension integration,104,src/extensions/,"inventory count, not a claim every file was read"
Shared contracts/code/fixtures,101,src/shared/,"inventory count, not a claim every file was read"
Source/toolchain acquisition,39,src/sources/,"inventory count, not a claim every file was read"
Packaging/qualification/performance tools,504,tools/,"inventory count, not a claim every file was read"
CI/release workflows,78,.github/,"inventory count, not a claim every file was read"
Architecture/maintainer docs,50,docs/,"inventory count, not a claim every file was read"