Follow up patch consolidation: signal semantics, performance profiling, and qualification

[f0rr0]

Purpose

Track the unfinished work deliberately excluded from the consolidated patch-correctness PR. The PR is a correctness and maintainability checkpoint, not a claim that WASIX has closed the PostgreSQL 18.4 performance gap or that new release artifacts are qualified.

Implementation: PR #202. Its focused fresh Native, Rust WASIX memory/directory and Chrome memory/IndexedDB correctness checks passed. The unchecked items below are broader or separate work, not a claim that those focused checks are still pending.

Immediate merge blocker: Windows/MSVC Wasm exception handling

• Restore real Windows/MSVC guest error recovery before merging across the current supported targets. On 8e45be7e, Windows AOT serialization/validation/install succeeded, but regression job 101905963703 crashed in savepoints_error_recovery_and_indexed_updates: wasmer-vm 7.2.1 libcalls/eh/mod.rs:36 explicitly panics in throw, process exit 0xe06d7363. Its other MSVC exception operations are also stubs.
• Check maintained upstream alternatives: official v7.4.0 and current main 1e9d585b still have those stubs. Upstream PR #6523 disabled Windows EH-dependent tests; no existing implementation was found in the targeted open-PR search. A version bump alone is not remediation.
• Implement/consume genuine MSVC exception support, or separately design and qualify a compatible guest/recovery mechanism. The Rust SDK currently consumes published Wasmer crates; a local Cargo patch alone is not a distributable downstream-SDK solution. Maintained dependency/upstream release ownership must be decided before carrying an engine fork. No target removal, test skip, host-panic catch, unsafe old longjmp restoration or silent Native fallback is authorized by this finding.
• Acceptance must include actual Windows/MSVC optimized guest SQL/savepoint/PLpgSQL error recovery, reuse and terminal-fault behavior, as well as Linux/macOS non-regression. Successful AOT serialization is not execution proof. Known formatting/root fixes and documentation are pushed in PR fix(runtime): consolidate patch correctness and retire unsafe shortcuts #202 at 0f4a9966; the Windows blocker remains open.

Highest priority: inherited Postmaster signal-mask semantics

• Implement real guest/host POSIX signal masks. The audit established that pinned WASIX pthread_sigmask returns success without reading/updating a mask, sigpending returns EINVAL, and __wasm_signal ignores sa_mask. Wasmer queues signals but has no guest blocked-mask state or mask syscall. The capability inventory now explicitly marks this unsupported.
• Add a mask/pending-signal ABI, per-thread blocked/pending state, deferred delivery and wakeup on unblocking, libc bindings, handler sa_mask/SA_NODEFER, and saved-mask restoration. A libc-only remembered mask would not block Wasmer delivery and is not a fix.
• Validate PostgreSQL startup/fork mask transitions, nested SIGQUIT protection, saved-mask error recovery and worker/checkpointer/walwriter/autovacuum paths under stress. This is an inherited correctness risk, not evidence of observed corruption. The separate macro single-evaluation fix does not close it.

The read-only end-to-end audit identified the concrete implementation boundary:

• Reuse Wasmer's existing mutex/queue/waker state in lib/wasix/src/os/task/{thread,process}.rs, but add per-thread masks/thread-pending and process-pending state. Process signals currently broadcast to all threads and can redirect to children; POSIX process-directed delivery must choose one eligible thread. Preserve any separate host supervisor broadcast policy explicitly.
• Add narrow mask/pending imports in existing Memory32/Memory64 registration and libc bottom-half bindings, using an explicit signal bitset rather than host sigset_t layout. Keep SIGKILL/SIGSTOP unmaskable and host-only wakeups outside guest masks. Failed validation/output writes must not partially mutate state.
• Make handler action selection and entry masking coherent. The current action registry is only in libc; merely wrapping its callback in pthread_sigmask leaves a re-entry window. Reuse one authoritative action registry/ABI, not a second unsynchronized table.
• Unify timer, synchronous syscall and blocking/Asyncify delivery paths. state/env.rs currently drains all queued signals before calling handlers; a jump/trap can lose the rest. syscalls/mod.rs can mark SIGINT/QUIT/ABRT finished before guest handling. Blocked signals must not disappear, terminate the thread, spin or cause spurious EINTR.
• Preserve mask/pending/disposition semantics through thread creation, fork, successful/failed exec and fresh execution epochs. libc signal/block.c currently substitutes a nonexistent callback and ignores the supplied saved-mask buffer; replace that with real operations.
• Preserve actual guest Wasm EH through handler-to-syscall unwinding. state/env.rs currently converts handler exceptions to Exit(Intr). The existing import adapter recognizes a top-level RuntimeError, so nesting it in another error enum alone will not restore valid siglongjmp behavior. Consume eligible pending signals one at a time and do not override masks explicitly restored by siglongjmp.

Acceptance: actual optimized C/C++ Wasm tests for oldset/null/invalid operations; blocked pending delivery and exactly-one-thread process delivery; handler self-blocking/sa_mask/SA_NODEFER; handler raises another signal then siglongjmp with remaining pending signals preserved; savesigs=0/1; lifecycle inheritance; blocking read/poll/futex behavior; PostgreSQL cancellation/reuse, fork, shutdown and error recovery. Host-adapter tests alone are insufficient. sigsuspend, sigtimedwait, masked pselect, stop/continue and cooperative-delivery limits must remain separately scoped rather than silently claimed fixed. Reference contracts: pthread_sigmask, sigaction, fork, exec.

1. Measure the exact corrected candidate before making performance claims

• Compare frozen34f and main e819 under the same strict-memory profile: 324 accepted independent children, nine varied workloads, both memory/directory, balanced order and A/A control. Retained final binaries and exact payload/source identities checked. All directory receipts verify fsync/synchronous_commit/full_page_writes=on. Fifty-four known-interference records were replaced as complete blocks, not pooled.
• Screen the final configured-identity guest separately: 220 children, all correctness and actual durability/version checks pass. Final/prior RTT is unchanged; final/strict-main RTT paired cost is 3.5% memory / 2.3% directory. The old narrow-directory ~10% warning did not repeat (now +1.8% vs main), but final/prior wide temporary INSERT warns +5.1% memory / +4.2% directory. All binaries/payloads/source identities and raw reports are retained. CPU affinity was equal but not exclusive; external shared-host activity remains a limitation.
• Separate required correctness from optional optimization claims. Strict memory, real session admission/identity and regular PGPROC are invariants, not switches to remove for better numbers. Final results do not establish blanket non-regression. No old compound compiler win is credited to this final candidate.
• Profile the retained prior/final wide temporary INSERT pair. Four complete ABBA captures collected 45,283 samples on unchanged strict guest/AOT payloads. Existing public Wasmer function extents provide diagnostic address maps without an engine switch. The initial permission blocker was resolved with explicit user approval; temporary perf_event_paranoid=2 was restored to its original 4 immediately after capture. No persistent setting changed.
• Establish a concrete shared hotspot: repeat(chr(...),96) performs 96 one-byte copies per row. Exact guest disassembly/error strings prove the caller; approximately 98% of imported-copy helper samples come from repeat. Imported-copy self share is 24.02% prior / 27.34% final, versus statistics-counter 0.46% / 0.45%. Both guest repeat loops are identical. This is not causal proof for the +5.1% final/prior warning, and diagnostic timings do not replace accepted benchmark results. Raw evidence remains in local oliphaunt-profile-20260908/REPORT.md.
• Run a bounded generic repeat experiment following the smaller single-byte/empty-input direction in the existing upstream discussion, not general doubling. Retained candidate uses <=1MiB fill chunks with interrupt checks and unchanged longer-input copying. Sanitizer/differential, Native encoding and cancellation/reuse checks pass. Fresh real candidate seeds and strict AOT were generated using retained producers; original outputs were restored.
• Complete 184 balanced independent children with result/settings oracles passing: wide temporary INSERT improves 41.5% memory / 33.5% directory, logged wide 29.0% / 20.7%, expression-only 73.0%. These are paired changes against the corrected final candidate, not new paired stock-PG proof. Actual WASIX timeout delivery fails on both builds and is tracked separately below.
• Complete the separately labelled 72-child, six-repetition targeted+A/A recheck without rebuilding, on equal affinity 6,9. All result/settings checks pass. Preconstructed-directory warning did not persist; memory preconstructed is inconclusive. Prepared-directory remains approximately 6–7% slower against both baseline controls, predominantly in transaction body rather than COMMIT. Selected cores also experienced shared-host load; no exclusive-machine claim or pooling with the earlier screen.
• Repeat candidate held at this checkpoint, not promoted. If reopened, attribute the persistent prepared-directory warning using retained exact binaries and relocation/layout evidence before another source variant. No SQL repeat occurs in that case, and weakening sync or tuning fill chunk size is not a demonstrated remedy. A calmer Native 12-pair check did not reproduce its initial small-input warning; all records and the conditional integration proposal remain in local oliphaunt-repeat-20260908/README.md. No rebuild is needed to resume attribution.
• The earlier W0044/prior warning still needs causal attribution; optimizing a shared expression hotspot does not establish that cause. Do not disable counters or fake standalone state. Stock PostgreSQL context remains narrow INSERT 1.41x memory / 1.64x directory, wide ~1.60x, and mixed OLTP 1.35x / 1.51x; two stock process replicates and differing transports limit inference.
• Only reopen an optional optimization when profiling identifies a material cost and a factor-isolated experiment produces a repeatable overall win without semantic regressions. The remaining INSERT gap belongs in executor/tuple/allocator/indirect-call investigations, not weaker durability.

Required correctness follow-up: embedded Rust WASIX SQL timeouts

• Repair timer setup, units, one-shot delivery and cooperative guest interruption as a coherent change. Actual retained baseline and repeat-candidate probes accept statement_timeout=2ms but complete a long CPU-bound repeat; Native PostgreSQL returns SQLSTATE57014 and reuses the connection. This is an inherited limitation, not a repeat-patch regression. Rust SDK/usage documentation now explicitly says that accepting this GUC or timing out a caller future does not enforce an execution-resource boundary.
• Exact consumed input is confirmed, not inferred from the separate Postmaster libc pin: image 484749accc2d2e34986cf7aab6f4b1889d6ad2f135fdd4334cb9d16c24e014cc, EH sysroot libc.a:setitimer.o SHA256 2b2823d3f91bf7482f3b8569ed1cf658d776f13a060aeedbe218c6e65810f02c. Disassembly reads it_interval and passes nanoseconds plus repeat=true. PostgreSQL sets only it_value, leaving the interval zero, so its one-shot alarm is disarmed. The final stripped guest is linked from this input; no named final-module disassembly proof is claimed.
• Consumed Rust wasmer-wasix0.702.1 additionally interprets that timestamp using Duration::from_millis, stores but does not honor the repeat flag during dispatch, and processes intervals at syscall pending-operation boundaries. Fixing libc alone therefore neither creates a real one-shot nor interrupts pure guest CPU loops.
• Use one owned timer/interrupt path, including timer-aware blocking waits. Preserve units, zero/disarm, one-shot removal and PG alarm rescheduling. Do not reenter a mutable Wasmer Store from a timer thread or race non-atomic PostgreSQL globals; do not restore retired activity/atomic patches. Existing clock/syscall pending-operation machinery may support an active-timeout-only cooperative poll, but needs measured overhead and real wakeup semantics.
• Acceptance: actual optimized guest timeout57014, cancellation latency under CPU work and blocking waits, subsequent connection reuse, repeated enable/disable/reschedule and no stale alarms; unchanged no-timeout performance and durability. Native cancellation and injected standalone interrupt checks do not prove guest delivery. This is separate from Postmaster POSIX masks and full POSIX interval/old-value support.

The subsequent reuse review found a smaller preferred route for embedded SQL deadlines, without first owning an engine fork: reuse Native N0022's ordered PostgreSQL queue, expiry extraction and rounded wait deadline, with in-guest cooperative scheduling rather than its unavailable host io->set_timeout provider. Select existing prepared/attached trusted-session state, call normal timeout handlers on the owning thread, and keep ordinary bootstrap/Postmaster semantics unchanged. The generic libc/Wasmer transport bugs remain separate upstream work.

Do not port only the obvious CHECK hook: SP-GiST directly tests the pending predicate while holding buffer locks, so detection must be non-throwing there; expiry/error processing follows normal safe boundaries. Poll on loop re-entry only after its live recovery frame exists and before idle timers are disabled. Preserve alarm/queue mutation guards, holdoffs, priority and periodic rescheduling. statement_timeout=0 still permits an active idle-statistics timer, so measure realistic default traffic. Native's timer-bounded WaitEventSetWait logic covers latch/sleep waits, but the WASIX bridge can block directly in stdin read during streaming/COPY, and host callbacks or a dormant guest require separate treatment. CPU-only success must not be labelled complete cancellation support.

2. Finish targeted runtime/platform qualification

• Exercise fresh artifacts across supported non-Linux Native and Rust WASIX targets and Native ICU variants. The consolidation's Linux standard build and focused tests are not that matrix.
• Verify Native configured identity, login triggers, session reset/rejection and role/database GUCs through both direct and installed broker SDK paths on fresh Linux ICU artifacts.
• Close WASIX configured-startup-identity/RESET ROLE parity through direct, proxy and browser runtime tests. W0044 initializes the real catalog principal in InitPostgres and all late SET ROLE workarounds are deleted. Fresh Rust: 211 library, 19 runtime, 7 proxy and 7 PostgreSQL regression tests pass. Fresh Chrome covers direct/worker durable reopen, login triggers, RESET ROLE/DISCARD ALL, superuser escalation rejection and NOLOGIN. Rust startup errors retain typed SQLSTATE and exact proxy response bytes.
• Complete hostile-extension, resource-accounting, cancellation/backpressure, teardown and crash/reopen coverage. Run broad extension and exact-commit release gates only when preparing a release.
• Remove Native's unconditional -F, preserve PostgreSQL's default fsync=on, and verify explicit fsync=off still works through direct and broker entrypoints. Document the potential durable-write cost. Functional reopen alone remains insufficient crash-durability proof. Merged WASIX WAL sync fixes remain intact.

3. Conditional research leads, not mandatory features

• Evaluate the checked single-element Wasmer runtime-copy change under the strict profile. The Rust SDK consumes crates.io Wasmer 7.2.1 and has no Rust engine patch-consumption path; this needs an upstream release or an explicitly maintained fork, not an untracked local engine or a new patch framework by default.
• If still promising, independently isolate frame-pointer and SIMD compiler choices under that same profile. Historical compound candidates cannot establish their individual value.
• Keep optional buffered-output draining, immutable module files, seed/module lifetime changes and adopted-buffer experiments out until current-main ABI/lifetime correctness and repeatable performance are demonstrated. Browser and Rust dependency versions must be treated separately.
• Reconcile invocation-scoped ICU/seed-catalog work and registered broker closures with current main's packaging and identity contracts before porting them. Do not combine half of an older host design with the current guest seed ABI.

4. Maintain and upstream the patch stack

• Decompose the inherited monoliths into 8 Wasmer +7 libc logical patches, preserve exact applied-tree equivalence, update all consumers/receipts and test ordered-series rejection paths. Add separate Wasmer0009 enforcing strict memory in all compiler routes; fresh product/CLI compiled tests pass.
• Complete the separate libc sigsetjmp argument-single-evaluation correction. C/C++ O0/O2 host checks reject the old macro and pass the corrected one; actual C/C++ Wasm O2 checks pass on the newly built strict Wasmer runner using the exact new header/helper objects. Mask support is explicitly unsupported, not falsely inferred from those tests. Inherited memcmp alignment/byte-order/protected-page tests pass; decomposition is not independent performance proof.
• Qualify the corrected strict Postmaster producer/runtime at 51789da in hosted CI: job 101886024003 passed. This supplies hosted evidence for the strict compiler policy, separately from the earlier34f result and clean replay.
• Complete final-head hosted checks, including the full rebuilt libc0008 sysroot/carrier. Known libc-root and formatting fixes are pushed at 0f4a996, with the no-build root test and all 263 formatting files passing locally. Run 34177975360 is the new exact-head run. Parent 8e45be7e completed all material producers before the push: iOS extensions and Linux/macOS AOT passed, while Windows runtime recovery exposed the blocker above. The parent run was subsequently cancelled by the push while app/E2E work remained; it is not an all-green run. Actual focused libc helper/header tests pass, but parent 51789da1 Postmaster runtime success cannot qualify the later full libc delta.
• Follow upstream Wasmer datasync and final-handle-shutdown submissions (#6962 and #6963 in wasmerio/wasmer), validate their eventual released versions, and remove local equivalents only once dependency upgrades supply the fixes.
• Reconcile PostgreSQL JSONB work with existing upstream CF6975 (Robert Haas), not a duplicate submission. Latest five v1 attachments match retained completed differential tests byte-for-byte. Those tests reproduce stale cast metadata and dropped-function lookup errors in upstream v1; other tested scalar/VARIADIC/null/Param cases match.
• Review/send the prepared reply and attachable cast-visibility reproducer to the existing pgsql-hackers thread. No own upstream submission is claimed. Local evidence is retained at target/upstream/jsonb-reply-draft-20260907.md and target/upstream/cf6975-cast-visibility.sql; upstream review remains external.
• Investigate shared build inputs for embedded/Postmaster where safe. A runtime environment flag cannot currently convert the embedded single-program lifecycle, imports and recovery model into concurrent Postmaster; do not promise compile-once interchangeability or add a misleading flag.

Closed experiments, not automatic backlog

The retired hash/current-XID, int4-comparator, stack-scratch, LIKE, semaphore-reset, cached WAL-segment, activity-reporting and scalar-atomic shortcuts do not need to be resurrected simply because they once existed. The host-longjmp symptom patches are superseded by live guest-local recovery boundaries. CRC and the latest lazy-globals candidate did not earn promotion. Reopening requires new evidence and a defensible design.

Section 3 records conditional research leads, not mandatory features or promises to land them. A sound checkpoint does not require another engine fork, compiler toggle, cache, or ownership redesign without a reproduced need. Likewise full release qualification is not a prerequisite for the deliberately scoped local fast path; the PR's hosted checks remain its merge gate.

Recovery and traceability

The original research checkout is preserved. Its complete uncommitted state was snapshotted locally as 8afe681d on f0rr0/patch-research-recovery-20260907; that research branch is intentionally not included in the product PR. This is a local recovery reference, not a publicly downloadable artifact. The consolidated PR carries the active patch rationale/disposition ledger and focused regression checks; experimental harnesses and historical result archives are not release dependencies.

[f0rr0]

Windows direction correction: dedicated issue #208 supersedes the earlier recommendation here to prioritize implementing MSVC Sys/LLVM exception support ourselves. Wasmer PR #6826, merged 2026-08-06, explicitly drops Windows Sys compiler support in favor of V8; this is enforced in 7.4.0. The next step is a bounded actual-Windows Rust/V8 feasibility and SQL-recovery probe, then product qualification if it passes. No migration or Windows fix is claimed yet. Linux/macOS Sys stack-safety work continues separately.