[jratliff79]

Depends on apache/arrow-rs#11969 and a compatible Parquet 55.x release. Keep this PR draft until the pinned WAL3 route independently resolves the patched packages without an overlay.

Require zstd 0.14.3 for the native profile while preserving existing features, codec availability and integrity checks. Add permanent context-isolation, failed-legacy-buffer and optional seekable-bound regressions, Snappy/zstd WAL compatibility and compressed-page corruption controls, and complete-graph floor checks registered in CI.

Complete the independent-workspace release inputs: explicitly declare Apache-2.0 for the TLS/seekable/Parquet fixtures and standalone S3 example. In the tracked FSKit lock, refresh the three zstd packages plus Tokio 1.53.1 -> 1.53.3 (RUSTSEC-2026-0386) and yoke-derive 0.8.3 -> 0.8.4 (yanked release). The follow-up lock diff changes only those last two version/checksum pairs; all other dependency blocks, Windows edges, features and Git pins retain their original bytes.

The original dependencies fail three native assertions and both seekable assertions. The candidate passes all four native controls, both seekable controls and five WAL tests. The original release-input checker reports six errors; the repaired inputs report zero. All four actual license checks pass after originally failing. Thirteen permanent Python controls cover patched/unaffected releases, duplicate bad copies, malformed/prerelease versions and the CLI; CI registers the new input check alongside unchanged cargo-deny.

Dependency blocker: the direct zstd floor alone does not remove WAL3's Parquet 55.x -> zstd 0.13 route. Local all-feature policy results require the manifest-only Parquet 55.2 overlay. There is no signer override; registry aws-sigv4 1.6.4 and the captured MRAP signing/presigning tests were verified separately. FSKit uses no dependency overrides. No advisory ignore, source-policy exception, integrity change or threshold reduction is included.

The complete 36-command local macOS matrix at prior head 34d2d636 passes: all-feature library 991/0/57 and CLI 46/0/1, default library 833/0/49 and CLI 41/0/1, portable/experimental library 62 each, strict Clippy/formatting, rustdoc, FSKit/MSRV packaging and 470 benchmark-harness unit tests. These are separate configurations and overlapping subsets, not summed. The full matrix was not rerun or reattributed to the later metadata/lock follow-up.

Follow-up local checks pass 13 frozen Python controls and 24 targeted Rust tests: FSKit 13, TLS 1, seekable 2, Parquet 5 and native compression 3. All three FSKit production-feature binaries, strict FSKit Clippy, the S3 example locked check, host/Windows filtered locked metadata and zstd floors pass. This remains macOS runtime evidence; filtered Windows metadata is not Windows execution.

The complete root, TLS and S3-example policy checks pass with the stated overlay scope. Full audits of the narrower FSKit, seekable and Parquet graphs still fail on unused root-policy entries (exits 9, 9, 8). The Tokio advisory/yanked-derive errors and missing-license errors are removed; those remaining full audits are not green.

This PR is based on upstream main and includes none of #77. Earlier #77/TLS #78 matrices, original failures, paid failures, latency misses and intermittent-fsck-spike uncertainty remain separate retained history. Application exploitability was not established. The hosted results below are separate from the earlier local matrix. Historical stored-file corpus, paced performance, production, capacity, standalone recovery and downstream adoption remain separate qualification gates. Paid runs stay paused.

Prepared with substantial cloud Codex assistance for tests, implementation, separate source review, verification and documentation. AI review, fork CI, upstream execution, human approval, merge and release remain distinct.

Published release-input follow-up: 72a478dc7f8b6a185c958e0a1137b28e68e2fd11, tree 4a905b7a7ed5bdb07b8e5359b437bb4e182f83df.

Hosted snapshot at 2026-10-30 16:25:47 UTC:

• Upstream workflows initially required action and have since begun executing. Their checked merge b6f635b59af5ae910f406f971a78dc563f11f654 has the exact published tree. Upstream release inputs pass all 13 controls with zero errors; TLS dependency profiles pass. The unoverlaid zstd graph floor fails on zstd 0.13.3 and zstd-safe 7.3.0. Cargo-deny is skipped afterward; this is not advisory clearance.
• Upstream formatting, docs/link checks, native FSKit's Rust 1.94.1 job, API compatibility and fuzz smoke pass. Miri and extended fuzz coverage have their existing conditional skips. Upstream Linux/Windows jobs are running and macOS is queued at this snapshot.
• Temporary fork verification #4 checks merge b2634e439f1c7eeb1f34d290ea83caee73c4fea9, also the exact published tree. Its release-input/TLS checks pass and its unoverlaid graph floor fails on the same packages. Fork main is older than upstream; fork API compatibility is not the upstream API-baseline result.
• Fork Linux fails the default library: 834 passed, 1 failed, 49 ignored, exit 101. The failed test is blob::chunked::tests::repairing_tier_cancellation_releases_the_flight_for_retry at crates/casita/src/blob/chunked/tests.rs:956: “cancelled repair flight was not released for retry”. This test and its runtime implementation are unchanged by the release-input follow-up; the cause is not established. Earlier all-feature library 993/0/57 and CLI 46/0/1 pass. Later portable commands and benchmark-adapter smoke are not qualified by the failed default command. The runner's missing user/mount namespace permission also leaves kernel ENOSPC-to-StorageFull coverage unexecuted.
• Fork Windows passes its entire job: all-feature library 949/0/51, CLI 46/0/1, TLS/seekable/Parquet fixtures 1/2/5, the no-default-feature build, and both portable library profiles with 62 tests each. Counts are separate configurations, not added together.
• Fork formatting, docs/link checks, native FSKit MSRV, API compatibility and fuzz smoke pass; existing Miri/extended fuzz skips remain. Fork macOS is still running. Overall fork CI is not green.

No author nudge, CI rerun, retry increase, assertion change or policy exception was used to turn a failed job green. Passing checks are not maintainer approval, merge or the required compatible Parquet release. This PR remains draft and paid runs remain paused.

Cancellation and reader-inventory follow-up

The Linux cancellation failure was reproduced before implementation. Cancelled repair leaders now synchronously remove only their own registry flight before waking waiters, so a later repair does not depend on an executor polling a cleanup task. Six permanent regressions cover no-runtime cancellation, immediate retry, a real verified far-to-near repair, waiter diagnostics, replacement-flight identity, and a disarmed completed leader.

The original reader-inventory corruption test also failed under the full default library suite. Real same-inode, same-length corruptions produced 24 identical metadata identities in 32 samples; all 24 were accepted by the old cache. A cache hit now also requires the bounded current snapshot's full content fingerprint to match previously validated bytes. Seven permanent regressions cover writer/read-populated caches, header/body/checksum corruption, rejecting register/protect/release without republishing damaged state, valid in-place updates, and the uncached control. With the fix, 28 metadata collisions in 32 samples produced zero accepted corruptions. These counts are correctness observations, not a performance benchmark.

The combined candidate passes complete local ARM64 Linux Rust 1.96.0 commands with the same frozen unoverlaid lock:

• All features: library 1006 passed / 0 failed / 57 ignored, CLI 46 / 0 / 1, with integrations and doctests complete.
• Default: library 848 / 0 / 49, CLI 41 / 0 / 1, with integrations and doctests complete.
• Portable and portable/experimental: 62 / 0 / 0 each, with complete commands. These exclude the native reader/blob modules and do not provide cache/cancellation coverage.
• Strict all-feature/all-target Clippy with -D warnings and formatting pass. All thirteen new regressions and both unchanged original failing assertions pass in the native full suites.

Existing checksum/size/wire/owner-liveness/recovery/GC rules, original test bodies, dependency policy, integrity checks, acceptance thresholds and private publication policy remain unchanged. The cache performs a bounded read/hash on every Unix lookup; paced-workload latency and capacity have not been requalified. The unchanged container namespace restriction leaves kernel ENOSPC-to-StorageFull coverage unexecuted. Earlier failures remain retained history.

This local result is not hosted Windows/macOS/x86-64 execution, upstream approval, advisory clearance, the required compatible Parquet release, downstream adoption, or production qualification. The unoverlaid zstd dependency blocker and narrower-workspace policy failures above remain unresolved. This PR stays draft and paid runs remain paused.

Published follow-up: d7fecaa08cfbf65d8203ae4db392be3374b1320e, tree 64c50d47cd5c93797c0c0d3d514c146cd1820431. Hosted verification for this exact source is recorded below.

Hosted follow-up verification

Snapshot at 2026-11-01 21:30:30 UTC, source d7fecaa08cfbf65d8203ae4db392be3374b1320e. Fork CI #10 completed successfully. Its checked merge 35352ef39fca2da79986e0c8911d3e0fbc549233 has exactly the published tree 64c50d47cd5c93797c0c0d3d514c146cd1820431; final logs confirm that checkout.

• Linux: all-feature library 1006 / 0 / 57 and CLI 46 / 0 / 1; default library 848 / 0 / 49 and CLI 41 / 0 / 1.
• macOS: all-feature library 1004 / 0 / 57 and CLI 46 / 0 / 1; default library 846 / 0 / 49 and CLI 41 / 0 / 1.
• Windows: all-feature library 955 / 0 / 51, CLI 46 / 0 / 1, standalone TLS/seekable/Parquet commands and the no-default-feature build pass.
• Both portable profiles pass 62 / 0 / 0 on all three platforms. These exclude native reader/blob coverage. Counts are passed / failed / ignored, separate configurations rather than a sum.
• All thirteen new regressions and both original failing assertions pass in each Linux/macOS native suite. Windows passes all six cancellation regressions and the original cancellation assertion; the Unix cache tests do not run there. Complete integrations/doctests, Unix hook/check pipelines and benchmark-harness unit tests pass.
• Formatting, docs/link checks, native FSKit MSRV/package, fork API compatibility and fuzz smoke pass. The API baseline remains the fork's older e35b985c, not upstream main. Benchmark-adapter smoke passes on Linux; macOS skips it under the unchanged Linux-only condition. Miri and fuzz coverage retain their existing conditional skips.

Overall release-policy verification remains failed. Fork release policy #10 passes all thirteen release-input controls, reports zero input errors and passes independently resolved TLS dependency regressions. Its fresh unoverlaid zstd floor check fails on zstd 0.13.4 and zstd-safe 7.4.0. Cargo-deny is skipped afterward; no advisory clearance is claimed.

All three new upstream workflows remain action_required, with zero jobs executed pending maintainer approval. Fork success is not upstream execution or approval. The Linux runner's namespace prohibition still leaves kernel ENOSPC-to-StorageFull coverage unexecuted. No CI rerun, author nudge, assertion/timeout change, dependency-policy weakening or acceptance-threshold reduction was used. Earlier failures and all release, performance, capacity, production and downstream-adoption limits remain preserved. This PR stays draft; paid runs remain paused.