fix(storage): default embedded fsync off and preserve publication barriers

[f0rr0]

Summary

• Default fsync=off for embedded native and WASIX databases. Standalone/Postmaster keeps fsync=on. Use PostgreSQL's boot default instead of forced startup overrides, preserving saved configuration and caller settings.
• Separate ordinary write flushing from explicit fdatasync/fsync in the owned WASIX filesystem crates and host adapters. Forward explicit barriers through filesystem wrappers and propagate failures.
• Keep checked initialization and restore publication barriers independent of query settings. Use write-capable, non-truncating handles for Windows file synchronization; do not claim a POSIX directory barrier there.
• Report when native restore has published a destination but its final durability check fails, retaining both the destination and underlying error. Cover buffered and streamed restore, Windows/Unix filesystem behavior, and OPFS flush ordering in existing tests.
• Have the Linux supervisor terminate the Windows cache-producer helper after it reports its result, avoiding Wine/QEMU self-termination crashes. Unexpected exits, timeouts and incompatible-cache rejection still fail. SDK process shutdown is unchanged.

No new SDK option or environment flag. Applications opt into PostgreSQL file synchronization through the existing fsync setting. With the default off, successful transactions and CHECKPOINT do not promise power-loss durability; browser publication guarantees remain provider-specific. The crash-recovery example explicitly opts in.

Validation

• Native runtime unit checks; 81 native and 358 WASIX TypeScript tests; SDK formatting, lint, typechecks and packages; browser example typecheck; ordered engine patch replay; release metadata — passed.
• Native configuration precedence and real archive restore fault injection; Rust WASIX tests and fresh portable/Linux AOT smoke checks; real Chromium OPFS flush tracing; shared filesystem helper exercised in Node, Bun and Deno on Linux — passed.
• Windows producer: five supervision regression tests, production-helper generation, 20 fresh-process cache reads and incompatible-cache rejection under Wine/QEMU — passed locally. The diagnostic helper was compiled with Clang for the MSVC ABI; native MSVC and integrated Windows execution remain CI gates.
• Runtime owner tests, formatting/lint, targeted TypeScript checks, workflow checks and release metadata — passed for the supervisor change.
• The earlier browser OPFS timeout is not claimed fixed. Full integrated qualification remains a CI gate; no power-loss or main-versus-candidate performance claim.

Rebased onto the current patch-correctness branch after the Wasmer dependency refresh merged. Related to #249.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
oliphaunt-docs	Ready	Preview	Oct 8, 2026 8:31am UTC