@push.rocks/smartdb 5.2.0 → 5.2.1

package/.smartconfig.json

@@ -77,7 +77,22 @@
     },
     "locked": true,
     "static": true,
-    "remapLocalPaths": true
+    "remapLocalPaths": true,
+    "matrix": {
+      "builders": {
+        "linux_amd64": {
+          "transport": "local"
+        },
+        "macos_arm64": {
+          "transport": "ssh",
+          "destinationEnv": "SMARTDB_RELEASE_MACOS_SSH",
+          "temporaryRootEnv": "SMARTDB_RELEASE_MACOS_TEMP_ROOT"
+        }
+      },
+      "smokeTestArgs": [
+        "--version"
+      ]
+    }
   },
   "@ship.zone/szci": {
     "npmGlobalTools": []

package/dist_rust/rustdb_linux_amd64.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "c5c0a72cc3e9001b008c73ecfbc05dbcde559796eeb81ddd9b57a858f98d4515",
+  "binarySha256": "08cf9193c7f6ab682848b35f07b45a1c5894cb0d90cab207b68abe1eb87da0ef",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.0",
-    "gitCommit": "d61180c4086a9f771765d104260f620d76b1cda0",
+    "projectVersion": "5.2.1",
+    "gitCommit": "31b448f06189fc802c6416f1ce6cd85ef275cbe1",
     "gitDirty": false,
-    "builtAt": "2026-08-18T22:39:04.935Z",
-    "tsrustVersion": "1.9.1",
+    "builtAt": "2026-08-19T22:20:32.142Z",
+    "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "linux_amd64"
   }

package/dist_rust/rustdb_linux_arm64.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "5f3878be4da5dd17eb4c269fdb3f63185d496bd84c1066ce54f47ea3b8f45321",
+  "binarySha256": "f246ac1ea19eccabcc828bc5f2db6e2eae2ca0ba67e3fdc9f96177cafe39afe1",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.0",
-    "gitCommit": "d61180c4086a9f771765d104260f620d76b1cda0",
+    "projectVersion": "5.2.1",
+    "gitCommit": "31b448f06189fc802c6416f1ce6cd85ef275cbe1",
     "gitDirty": false,
-    "builtAt": "2026-08-18T22:39:24.164Z",
-    "tsrustVersion": "1.9.1",
+    "builtAt": "2026-08-19T22:21:05.240Z",
+    "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "linux_arm64"
   }

package/dist_rust/rustdb_macos_amd64.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "1cf98dfc94ff75ab0fad7927c5a59cec87e9623bcc8e36908e7811bd9632064c",
+  "binarySha256": "6def4bb635b9993b1d1d8eca70e80500083cc66384f2c99dd39451327fcd027a",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.0",
-    "gitCommit": "d61180c4086a9f771765d104260f620d76b1cda0",
+    "projectVersion": "5.2.1",
+    "gitCommit": "31b448f06189fc802c6416f1ce6cd85ef275cbe1",
     "gitDirty": false,
-    "builtAt": "2026-08-18T22:40:01.824Z",
-    "tsrustVersion": "1.9.1",
+    "builtAt": "2026-08-19T22:22:19.797Z",
+    "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "macos_amd64"
   }

package/dist_rust/rustdb_macos_arm64.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "3784a0e1d125a25a714086b098018a34cef6056677da3f087992a7e76cd9d87f",
+  "binarySha256": "adb7ae9f7fe8a8f791deaab94cac63a607f79890eaf3be64c273658a4c2b6584",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.0",
-    "gitCommit": "d61180c4086a9f771765d104260f620d76b1cda0",
+    "projectVersion": "5.2.1",
+    "gitCommit": "31b448f06189fc802c6416f1ce6cd85ef275cbe1",
     "gitDirty": false,
-    "builtAt": "2026-08-18T22:41:12.434Z",
-    "tsrustVersion": "1.9.1",
+    "builtAt": "2026-08-19T22:23:06.048Z",
+    "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "macos_arm64"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdb',
-    version: '5.2.0',
+    version: '5.2.1',
     description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxxQkFBcUI7SUFDM0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHFIQUFxSDtDQUNuSSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdb",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "private": false,
   "description": "A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.",
   "exports": {
@@ -16,8 +16,7 @@
     "@design.estate/dees-element": "^2.2.4",
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsbundle": "^2.11.4",
-    "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tsrust": "^1.9.1",
+    "@git.zone/tsrust": "^1.10.0",
     "@git.zone/tstest": "^4.0.0",
     "@types/node": "26.2.0",
     "mongodb": "^7.5.0"
@@ -31,7 +30,6 @@
   ],
   "files": [
     "ts/**/*",
-    "scripts/**/*",
     "ts_web/**/*",
     "dist/**/*",
     "dist_*/**/*",
@@ -75,7 +73,7 @@
     "test:rust": "(cd rust && cargo test)",
     "build": "(tsbundle) && (tsbuild tsfolders) && (tsrust)",
     "buildDocs": "tsdoc",
-    "release:check-builders": "tsrun scripts/release-artifacts.ts check",
-    "release:build-artifacts": "tsrun scripts/release-artifacts.ts build"
+    "release:check-builders": "tsrust matrix check",
+    "release:build-artifacts": "(tsbundle) && (tsbuild tsfolders) && (tsrust matrix build)"
   }
 }

package/readme.hints.md

@@ -5,7 +5,7 @@
 - `LocalSmartDb.relocateStoppedStorageRoot()` is the only supported path-changing operation. It uses a dedicated serialized mutating sidecar runner; do not route it through the disposable offline-inspection helper. A bridge whose termination is unconfirmed remains in the static cleanup gate, and no later relocation may spawn until cleanup succeeds.
 - Rust owns the descriptor-relative operation in `rust/crates/rustdb/src/storage_root_relocation.rs`. It never constructs `RustDb`. The fixed journal phases are `preparing`, `prepared`, `exchanged`, `providerPublished`, `sentinelPublished`, and `cleaned`; retries reconcile the exact source-root/destination-absent-or-receipt topology or source-receipt/destination-root topology before continuing.
 - The destination receipt is published with an exclusive rename, then exchanged with the source root using an atomic swap (`RENAME_NOREPLACE`/`RENAME_EXCHANGE` on Linux and `RENAME_EXCL`/`RENAME_SWAP` on macOS). Provider and sentinel replacement also uses checked exchanges, retaining each previous object in the workspace until the replacement is durable and verified. The original root inode ends at the destination and the original receipt inode remains at the source indefinitely. Parent, root, internal, lock, provider, and sentinel identities are revalidated around publication.
-- Eligibility is intentionally narrow: Linux on the existing supported local-filesystem set or macOS on qualified local APFS, exact current owner/provider/sentinel metadata, no auth path digest, and no resource receipt, allocation, retired lock, durable database/transaction workspace, database marker, symlink, unknown entry, or unsafe ownership/mode/link profile. macOS additionally rejects case, Unicode, mount, and ancestry aliases by retained physical identity. Missing metadata is rejected and never initialized by relocation.
+- Eligibility is intentionally narrow: Linux on the existing supported local-filesystem set or macOS on qualified local APFS, exact current owner/provider/sentinel metadata, no auth path digest, and no active resource receipt, allocation, database-mutation workspace, unrelated marker, symlink, unknown entry, or unsafe ownership/mode/link profile. A transaction workspace is eligible only when `rustdb-storage` validates its exact `cleaned` internal journal and matching database transaction marker; workspace debris, unfinished phases, mismatches, and allocation bindings remain unsupported. Empty retired legacy locks are eligible only with the canonical resource-digest/inode name parsed by `resource_fencing`, within its existing bound, and tied to one of those terminal transaction resources. macOS additionally rejects case, Unicode, mount, and ancestry aliases by retained physical identity. Missing metadata is rejected and never initialized by relocation.
 - Both TypeScript startup paths check for `.__rustdb_internal/storage-root-relocation` before `StorageMigrator`. Rust checks immediately after securely opening an existing root and repeats the descriptor-relative check after acquiring the owner lock, before storage initialization. This closes the interval where a relocation can create its workspace and release the lock after startup's first inspection. Occupancy or inspection ambiguity is a startup error; only an exact relocation retry performs recovery.
 - Completed roots retain the SmartDB 5.0.1 provider/sentinel JSON shape, changing only their storage-root path digest. Interrupted Linux state requires 5.1.0 or newer; interrupted macOS state requires a macOS-capable release. Exact replay lasts only while the destination remains current; a later relocation supersedes the old source/destination tuple.
 
@@ -44,4 +44,5 @@
 - `pnpm run test:rust` runs the Rust unit tests; plain `cargo test` in `rust/` works as well.
 - Verify linkage manually with `ldd dist_rust/<binary>_linux_amd64` → "statically linked".
 - Do NOT verify feature presence in release binaries with `strings`/`grep`: on x86_64 release builds LLVM embeds short string literals (≤16 bytes, e.g. BSON doc keys like `volatileOnly`) as instruction immediates, so they are invisible to byte scans while the aarch64 binary shows them in `.rodata`. This produces false "stale binary" alarms. Verify behavior by running the binary (the wire tests spawn the host-arch binary from `dist_rust/`), or disassemble: `objdump -d <bin> | grep <hex-of-literal-LE>`.
-- Release builds use tsrust 1.9 host partitions and strict sidecar assembly. The enabled gitzone test preflight compiles and executes a static Linux arm64 probe through `binfmt` and checks macOS Rosetta before versioning. The post-version build transfers exact HEAD by Git bundle, executes all four target binaries, and assembles separate Linux and macOS inputs. Remote cleanup is limited to the unique sentinel-owned child below `SMARTDB_RELEASE_MACOS_TEMP_ROOT`.
+- Release builds use the tsrust 1.10 native matrix. The enabled gitzone test preflight checks the exact project-local tool, cross-execution, worker identities, toolchains, and remote root before versioning. The post-version build bundles TypeScript, transfers exact HEAD into isolated local and SSH workers, installs the frozen lockfile, executes all four target binaries, retrieves bounded artifact sets, and transactionally publishes the complete provenance matrix. Remote cleanup is limited to the unique owner-marked child below `SMARTDB_RELEASE_MACOS_TEMP_ROOT` and gates publication.
+- Matrix workers use synthetic homes and therefore do not inherit operator-global pnpm policy. Keep the workspace release-age exception pinned to the exact audited `@git.zone/tsrust` version needed by an immediate upstream-to-downstream release; do not disable the age gate or widen the exception to a scope.

package/readme.md

@@ -586,7 +586,7 @@ interface ILocalSmartDbStoppedStorageRootRelocationReceipt {
 
 On success, the destination directory is the original storage-root inode and the source path is an exact mode-0600 regular-file receipt. SmartDB does not remove that source receipt. Data, WAL, hint, and index bytes are not copied or rewritten. `providerRootId`, root device/inode, and every provider/sentinel field are preserved; only `storageRootSha256` changes to the destination's canonical path digest. This leaves a completed destination compatible with SmartDB 5.0.1.
 
-Relocation deliberately supports only the plain, unbound `LocalSmartDb` topology. The existing owner lock, `provider-identity.json`, and resource-fencing sentinel must all be present; the operation never creates missing ownership metadata. A provider identity containing `authUsersPathSha256` is unsupported. Any durable fence receipt or capability, allocation state, retired fence lock, database mutation/transaction journal, allocation/publication marker, symlink, unknown entry, unsafe mode/owner/link count, exhausted scan bound, active owner, or ambiguous identity fails closed.
+Relocation deliberately supports only the plain, unbound `LocalSmartDb` topology. The existing owner lock, `provider-identity.json`, and resource-fencing sentinel must all be present; the operation never creates missing ownership metadata. A provider identity containing `authUsersPathSha256` is unsupported. One narrow terminal transaction topology is also eligible: each retained internal transaction journal must be in the exact `cleaned` phase, contain no workspace debris or allocation binding, and match the exact transaction-publication marker in its database. Canonically named, empty retired legacy fence locks are accepted only when their resource digest belongs to one of those terminal transactions and their encoded inode matches the retained file. These terminal artifacts move unchanged with the root and continue the existing transaction token sequence after restart. Any unfinished or mismatched transaction, durable database-mutation journal, active fence receipt or capability, allocation state, unrelated or malformed retired lock, allocation/general publication marker, symlink, unknown entry, unsafe mode/owner/link count, exhausted scan bound, active owner, or ambiguous identity fails closed.
 
 The operation journals phases `preparing`, `prepared`, `exchanged`, `providerPublished`, `sentinelPublished`, and `cleaned`. If a call returns `RECOVERY_REQUIRED`, stop all startup attempts and retry the exact same normalized source path, destination path, and `relocationId` with the same SmartDB version that began the relocation or a newer version. Startup rejects any relocation-workspace occupancy and does not mutate or recover it. Do not delete, rename, edit, or replace either path between attempts. Linux relocation state created by SmartDB 5.1.0 remains recoverable by 5.1.0 or newer; macOS recovery requires a macOS-capable release. A completed root remains 5.0.1-compatible.
 
@@ -1015,7 +1015,7 @@ Cross-compiled for `linux_amd64`, `linux_arm64`, `macos_amd64`, and `macos_arm64
 
 ### Multi-host release artifacts
 
-Normal `tsrust` builds select only the current host's partition from `targetsByHost`. Releases coordinate both partitions after the version commit exists, then publish only after every exact-commit binary has executed and passed strict provenance assembly.
+Normal `tsrust` builds select only the current host's partition from `targetsByHost`. Releases use `tsrust matrix` to coordinate both partitions after the version commit exists, then publish only after every exact-commit binary has executed and passed strict provenance assembly.
 
 The release coordinator must be Linux amd64 with `aarch64-linux-gnu-gcc` and a registered Linux arm64 `binfmt` interpreter. Set these environment variables to an authorized Apple Silicon builder with Rosetta and a dedicated temporary root:
 
@@ -1024,14 +1024,14 @@ export SMARTDB_RELEASE_MACOS_SSH="release-user@mac-builder.example"
 export SMARTDB_RELEASE_MACOS_TEMP_ROOT="/absolute/dedicated/smartdb-release"
 ```
 
-`gitzone release` first runs `pnpm run release:check-builders`, before creating a version commit or tag. It compiles and executes a static arm64 probe and rejects missing cross-toolchain or `binfmt` execution, an unsuitable macOS host, missing Rosetta, missing tools, or an unwritable remote temporary root. The release build then:
+`gitzone release` first runs `pnpm run release:check-builders`, before creating a version commit or tag. It verifies the project-local tsrust version, compiles and executes the required architecture probes, and rejects missing cross-toolchains or emulation, an unsuitable macOS host, missing tools, or an unsafe remote temporary root. The release build then:
 
-1. Builds and executes the Linux amd64 and arm64 binaries.
-2. Transfers a Git bundle of the unpushed release commit into a unique sentinel-owned macOS workspace.
-3. Builds both Darwin targets from the frozen lockfile, verifies their Cargo bytes and signatures, and executes both architectures.
-4. Copies each host output into separate `.nogit` inputs and runs strict `tsrust assemble` into `dist_rust/`.
+1. Builds the TypeScript package and debug UI bundle from the version commit.
+2. Streams an exact Git bundle into isolated local Linux and remote macOS worker workspaces and installs each frozen lockfile.
+3. Builds and executes the Linux amd64, Linux arm64, macOS arm64, and macOS amd64 binaries on their assigned workers.
+4. Retrieves bounded artifact sets and transactionally publishes the complete provenance-checked matrix into `dist_rust/`.
 
-No host address or path is stored in the repository. A failed run retains its unique diagnostic directories and prints their paths. Successful cleanup can remove only the generated child whose path and random ownership sentinel both match.
+No host address or path is stored in the repository. A failed run retains its unique local diagnostics and owner-marked remote diagnostics, then prints their paths. Remote cleanup is an owner-validated publication gate, and an incomplete matrix never replaces the prior `dist_rust/`.
 
 ### Storage Engine Reliability 🔒
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdb',
-  version: '5.2.0',
+  version: '5.2.1',
   description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 }

package/scripts/release-artifacts.ts

@@ -1,626 +0,0 @@
-import * as childProcess from 'node:child_process';
-import * as crypto from 'node:crypto';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-
-type TReleaseArtifactMode = 'check' | 'build';
-
-interface IReleaseArtifactEnvironment {
-  macosSsh: string;
-  macosTempRoot: string;
-}
-
-const provenanceSuffix = '.tsrust-build.json';
-const defaultCommandTimeoutMs = 60 * 60 * 1000;
-const capabilityCommandTimeoutMs = 5 * 60 * 1000;
-const forceKillDelayMs = 10 * 1000;
-const maximumCapturedOutputBytes = 16 * 1024 * 1024;
-const sshConnectionArgs = [
-  '-o',
-  'ServerAliveInterval=15',
-  '-o',
-  'ServerAliveCountMax=2',
-];
-
-type TForwardedSignal = 'SIGINT' | 'SIGTERM' | 'SIGHUP';
-
-const shellQuote = (valueArg: string): string => `'${valueArg.replace(/'/g, `'"'"'`)}'`;
-
-const executeCommand = (
-  commandArg: string,
-  argsArg: string[],
-  optionsArg: {
-    cwd?: string;
-    capture?: boolean;
-    timeoutMs?: number;
-    heartbeatStdin?: boolean;
-  } = {},
-): Promise<string> =>
-  new Promise((resolveArg, rejectArg) => {
-    const capture = optionsArg.capture === true;
-    const child = childProcess.spawn(commandArg, argsArg, {
-      cwd: optionsArg.cwd || process.cwd(),
-      env: process.env,
-      stdio: capture
-        ? ['ignore', 'pipe', 'pipe']
-        : optionsArg.heartbeatStdin
-          ? ['pipe', 'inherit', 'inherit']
-          : 'inherit',
-      detached: true,
-    });
-    let stdout = '';
-    let stderr = '';
-    let capturedOutputBytes = 0;
-    let timedOut = false;
-    let outputLimitExceeded = false;
-    let forwardedSignal: TForwardedSignal | undefined;
-    let forwardedSignalCount = 0;
-    let settled = false;
-    let forceKillTimer: NodeJS.Timeout | undefined;
-    let heartbeatTimer: NodeJS.Timeout | undefined;
-
-    const killProcessGroup = (signalArg: NodeJS.Signals): void => {
-      if (!child.pid) return;
-      try {
-        process.kill(-child.pid, signalArg);
-      } catch {
-        try {
-          child.kill(signalArg);
-        } catch {
-          // The process may already have exited.
-        }
-      }
-    };
-
-    const terminateProcessGroup = (signalArg: NodeJS.Signals): void => {
-      killProcessGroup(signalArg);
-      if (!forceKillTimer) {
-        forceKillTimer = setTimeout(
-          () => killProcessGroup('SIGKILL'),
-          forceKillDelayMs,
-        );
-      }
-    };
-
-    const processGroupExists = (): boolean => {
-      if (!child.pid) return false;
-      try {
-        process.kill(-child.pid, 0);
-        return true;
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === 'ESRCH') return false;
-        throw error;
-      }
-    };
-
-    const waitForProcessGroupExit = async (timeoutMsArg: number): Promise<boolean> => {
-      const deadline = Date.now() + timeoutMsArg;
-      while (processGroupExists() && Date.now() < deadline) {
-        await new Promise((resolveArg) => setTimeout(resolveArg, 100));
-      }
-      return !processGroupExists();
-    };
-
-    const ensureProcessGroupStopped = async (): Promise<void> => {
-      if (!processGroupExists()) return;
-      terminateProcessGroup('SIGTERM');
-      if (!(await waitForProcessGroupExit(forceKillDelayMs + 1000))) {
-        killProcessGroup('SIGKILL');
-        if (!(await waitForProcessGroupExit(2000))) {
-          throw new Error(`${commandArg} left a live descendant process group`);
-        }
-      }
-    };
-
-    const signalHandlers = new Map<TForwardedSignal, () => void>();
-    for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP'] as TForwardedSignal[]) {
-      const handler = (): void => {
-        forwardedSignal = signal;
-        forwardedSignalCount += 1;
-        if (forwardedSignalCount === 1) terminateProcessGroup(signal);
-        else killProcessGroup('SIGKILL');
-      };
-      signalHandlers.set(signal, handler);
-      process.on(signal, handler);
-    }
-
-    const timeout = setTimeout(() => {
-      timedOut = true;
-      terminateProcessGroup('SIGTERM');
-    }, optionsArg.timeoutMs || defaultCommandTimeoutMs);
-
-    if (optionsArg.heartbeatStdin) {
-      child.stdin?.on('error', () => {
-        // Process close handles a lost stdin channel.
-      });
-      const sendHeartbeat = (): void => {
-        if (!child.stdin?.destroyed) child.stdin?.write('heartbeat\n');
-      };
-      sendHeartbeat();
-      heartbeatTimer = setInterval(sendHeartbeat, 1000);
-    }
-
-    const cleanup = (): void => {
-      clearTimeout(timeout);
-      if (forceKillTimer) clearTimeout(forceKillTimer);
-      if (heartbeatTimer) clearInterval(heartbeatTimer);
-      child.stdin?.end();
-      for (const [signal, handler] of signalHandlers) {
-        process.off(signal, handler);
-      }
-    };
-
-    const captureChunk = (targetArg: 'stdout' | 'stderr', chunkArg: Buffer): void => {
-      capturedOutputBytes += chunkArg.length;
-      if (capturedOutputBytes > maximumCapturedOutputBytes) {
-        outputLimitExceeded = true;
-        terminateProcessGroup('SIGTERM');
-        return;
-      }
-      if (targetArg === 'stdout') stdout += chunkArg.toString('utf8');
-      else stderr += chunkArg.toString('utf8');
-    };
-    child.stdout?.on('data', (chunkArg: Buffer) => captureChunk('stdout', chunkArg));
-    child.stderr?.on('data', (chunkArg: Buffer) => captureChunk('stderr', chunkArg));
-
-    child.once('error', (errorArg) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      rejectArg(errorArg);
-    });
-    child.once('close', (codeArg, signalArg) => {
-      if (settled) return;
-      settled = true;
-      void (async () => {
-        try {
-          await ensureProcessGroupStopped();
-          cleanup();
-          if (codeArg !== 0 && capture) {
-            if (stdout) process.stdout.write(stdout);
-            if (stderr) process.stderr.write(stderr);
-          }
-          if (timedOut) {
-            rejectArg(new Error(`${commandArg} exceeded its command timeout`));
-          } else if (outputLimitExceeded) {
-            rejectArg(new Error(`${commandArg} exceeded the captured output limit`));
-          } else if (forwardedSignal) {
-            rejectArg(new Error(`${commandArg} was interrupted by ${forwardedSignal}`));
-          } else if (codeArg !== 0) {
-            rejectArg(
-              new Error(
-                `${commandArg} exited with ${signalArg ? `signal ${signalArg}` : `status ${codeArg}`}`,
-              ),
-            );
-          } else {
-            resolveArg(stdout.trim());
-          }
-        } catch (error) {
-          cleanup();
-          rejectArg(error);
-        }
-      })();
-    });
-  });
-
-const runCommand = async (
-  commandArg: string,
-  argsArg: string[],
-  cwdArg: string = process.cwd(),
-  timeoutMsArg: number = defaultCommandTimeoutMs,
-  heartbeatStdinArg: boolean = false,
-): Promise<void> => {
-  await executeCommand(commandArg, argsArg, {
-    cwd: cwdArg,
-    timeoutMs: timeoutMsArg,
-    heartbeatStdin: heartbeatStdinArg,
-  });
-};
-
-const captureCommand = async (
-  commandArg: string,
-  argsArg: string[],
-  cwdArg: string = process.cwd(),
-): Promise<string> => {
-  return executeCommand(commandArg, argsArg, {
-    cwd: cwdArg,
-    capture: true,
-    timeoutMs: capabilityCommandTimeoutMs,
-  });
-};
-
-const loadEnvironment = (): IReleaseArtifactEnvironment => {
-  const macosSsh = process.env.SMARTDB_RELEASE_MACOS_SSH?.trim() || '';
-  const macosTempRoot = (process.env.SMARTDB_RELEASE_MACOS_TEMP_ROOT?.trim() || '').replace(
-    /\/+$/,
-    '',
-  );
-
-  if (!/^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+$/.test(macosSsh)) {
-    throw new Error(
-      'SMARTDB_RELEASE_MACOS_SSH must use the user@host form without SSH options',
-    );
-  }
-  if (
-    !/^\/[A-Za-z0-9._/-]+$/.test(macosTempRoot) ||
-    path.posix.normalize(macosTempRoot) !== macosTempRoot ||
-    macosTempRoot.split('/').filter(Boolean).length < 2
-  ) {
-    throw new Error(
-      'SMARTDB_RELEASE_MACOS_TEMP_ROOT must be a non-root absolute path without spaces',
-    );
-  }
-  return { macosSsh, macosTempRoot };
-};
-
-const runRemoteLoginScript = async (
-  environmentArg: IReleaseArtifactEnvironment,
-  scriptArg: string,
-  timeoutMsArg: number = defaultCommandTimeoutMs,
-): Promise<void> => {
-  const ownedRemoteScript = [
-    'set -u',
-    'exec 3<&0',
-    'child_pid=',
-    'watchdog_pid=',
-    'kill_tree() {',
-    '  local parent_pid children child_pid_to_kill',
-    '  parent_pid="$1"',
-    '  kill -STOP "$parent_pid" 2>/dev/null || return 0',
-    '  children="$(/usr/bin/pgrep -P "$parent_pid" 2>/dev/null || true)"',
-    '  for child_pid_to_kill in $children; do kill_tree "$child_pid_to_kill"; done',
-    '  kill -KILL "$parent_pid" 2>/dev/null || true',
-    '}',
-    'terminate_owned() { test -z "$child_pid" || kill_tree "$child_pid"; test -z "$watchdog_pid" || kill -KILL "$watchdog_pid" 2>/dev/null || true; }',
-    'watch_channel() { while IFS= read -r -t 45 ignored_line; do :; done; test -z "$child_pid" || kill_tree "$child_pid"; }',
-    'trap terminate_owned EXIT HUP INT TERM',
-    `/bin/zsh -lc ${shellQuote(scriptArg)} </dev/null &`,
-    'child_pid=$!',
-    'watch_channel <&3 &',
-    'watchdog_pid=$!',
-    'wait "$child_pid"',
-    'exit_status=$?',
-    'child_pid=',
-    'kill -KILL "$watchdog_pid" 2>/dev/null || true',
-    'wait "$watchdog_pid" 2>/dev/null || true',
-    'watchdog_pid=',
-    'exec 3<&-',
-    'trap - EXIT HUP INT TERM',
-    'exit "$exit_status"',
-  ].join('\n');
-  await runCommand(
-    'ssh',
-    [
-      ...sshConnectionArgs,
-      environmentArg.macosSsh,
-      `zsh -lic ${shellQuote(`/bin/sh -c ${shellQuote(ownedRemoteScript)}`)}`,
-    ],
-    process.cwd(),
-    timeoutMsArg,
-    true,
-  );
-};
-
-const checkBuilders = async (
-  environmentArg: IReleaseArtifactEnvironment,
-): Promise<void> => {
-  if (process.platform !== 'linux' || process.arch !== 'x64') {
-    throw new Error('SmartDB release artifact assembly requires a Linux amd64 coordinator');
-  }
-
-  await runCommand('git', ['--version'], process.cwd(), capabilityCommandTimeoutMs);
-  await runCommand('pnpm', ['--version'], process.cwd(), capabilityCommandTimeoutMs);
-  await captureCommand('/bin/sh', ['-c', 'command -v scp >/dev/null']);
-  const linuxProbeParent = path.join(process.cwd(), '.nogit', 'smartdb-release-probe');
-  fs.mkdirSync(linuxProbeParent, { recursive: true, mode: 0o700 });
-  const linuxProbeDirectory = fs.mkdtempSync(path.join(linuxProbeParent, 'arm64-'));
-  try {
-    const sourcePath = path.join(linuxProbeDirectory, 'probe.c');
-    const binaryPath = path.join(linuxProbeDirectory, 'probe');
-    fs.writeFileSync(sourcePath, 'int main(void) { return 0; }\n');
-    await runCommand(
-      'aarch64-linux-gnu-gcc',
-      ['-static', '-O2', sourcePath, '-o', binaryPath],
-      process.cwd(),
-      capabilityCommandTimeoutMs,
-    );
-    await runCommand(binaryPath, [], process.cwd(), capabilityCommandTimeoutMs);
-  } finally {
-    fs.rmSync(linuxProbeDirectory, { recursive: true, force: true });
-  }
-
-  const probeToken = crypto.randomUUID();
-  const probePath = `${environmentArg.macosTempRoot}/smartdb-release-check.${probeToken}`;
-  const remoteCheckScript = [
-    'set -eu',
-    'test "$(uname -s)" = "Darwin"',
-    'test "$(uname -m)" = "arm64"',
-    'command -v git >/dev/null',
-    'command -v pnpm >/dev/null',
-    'command -v codesign >/dev/null',
-    'command -v cmp >/dev/null',
-    `root=${shellQuote(environmentArg.macosTempRoot)}`,
-    `probe=${shellQuote(probePath)}`,
-    `test "$probe" = "$root/smartdb-release-check.${probeToken}"`,
-    'mkdir -p "$root"',
-    'test "$(cd "$root" && pwd -P)" = "$root"',
-    'created=0',
-    `cleanup_probe() { if [ "$created" = 1 ]; then test ! -f "$probe/.smartdb-release-owner" || test "$(cat "$probe/.smartdb-release-owner")" = ${shellQuote(probeToken)} || return; rm -f "$probe/.smartdb-release-owner"; rmdir "$probe" 2>/dev/null || true; fi; }`,
-    'trap cleanup_probe EXIT HUP INT TERM',
-    'mkdir -m 700 "$probe"',
-    'created=1',
-    `printf '%s\\n' ${shellQuote(probeToken)} > "$probe/.smartdb-release-owner"`,
-    'rm -f "$probe/.smartdb-release-owner"',
-    'rmdir "$probe"',
-    'trap - EXIT HUP INT TERM',
-    '/usr/bin/arch -x86_64 /usr/bin/true',
-  ].join('\n');
-  await runRemoteLoginScript(
-    environmentArg,
-    remoteCheckScript,
-    capabilityCommandTimeoutMs,
-  );
-  console.log('All SmartDB release builders can execute their assigned architectures.');
-};
-
-const assertArtifactSet = (directoryArg: string, targetsArg: string[]): void => {
-  const expectedNames = targetsArg.flatMap((targetArg) => [
-    `rustdb_${targetArg}`,
-    `rustdb_${targetArg}${provenanceSuffix}`,
-  ]);
-  const actualNames = fs.readdirSync(directoryArg).sort();
-  if (JSON.stringify(actualNames) !== JSON.stringify(expectedNames.sort())) {
-    throw new Error(
-      `Unexpected release artifact set in ${directoryArg}: ${actualNames.join(', ')}`,
-    );
-  }
-  for (const target of targetsArg) {
-    const binaryPath = path.join(directoryArg, `rustdb_${target}`);
-    const stat = fs.lstatSync(binaryPath);
-    if (!stat.isFile() || (stat.mode & 0o111) === 0) {
-      throw new Error(`Release artifact is not an executable regular file: ${binaryPath}`);
-    }
-  }
-};
-
-const remoteWorkspacePath = (
-  environmentArg: IReleaseArtifactEnvironment,
-  gitCommitArg: string,
-  ownerTokenArg: string,
-): string =>
-  `${environmentArg.macosTempRoot}/smartdb-release.${gitCommitArg}.${ownerTokenArg}`;
-
-const assertOwnedRemoteWorkspacePath = (
-  environmentArg: IReleaseArtifactEnvironment,
-  remoteDirectoryArg: string,
-  gitCommitArg: string,
-  ownerTokenArg: string,
-): void => {
-  const expectedDirectory = remoteWorkspacePath(
-    environmentArg,
-    gitCommitArg,
-    ownerTokenArg,
-  );
-  if (
-    remoteDirectoryArg !== expectedDirectory ||
-    path.posix.dirname(remoteDirectoryArg) !== environmentArg.macosTempRoot ||
-    path.posix.normalize(remoteDirectoryArg) !== remoteDirectoryArg
-  ) {
-    throw new Error(`Refusing unsafe macOS release workspace path: ${remoteDirectoryArg}`);
-  }
-};
-
-const createRemoteWorkspace = async (
-  environmentArg: IReleaseArtifactEnvironment,
-  remoteDirectoryArg: string,
-  gitCommitArg: string,
-  ownerTokenArg: string,
-): Promise<void> => {
-  assertOwnedRemoteWorkspacePath(
-    environmentArg,
-    remoteDirectoryArg,
-    gitCommitArg,
-    ownerTokenArg,
-  );
-  const createScript = [
-    'set -eu',
-    `root=${shellQuote(environmentArg.macosTempRoot)}`,
-    `directory=${shellQuote(remoteDirectoryArg)}`,
-    `test "$directory" = "$root/smartdb-release.${gitCommitArg}.${ownerTokenArg}"`,
-    'mkdir -p "$root"',
-    'test "$(cd "$root" && pwd -P)" = "$root"',
-    'created=0',
-    `cleanup_unowned() { if [ "$created" = 1 ]; then test ! -f "$directory/.smartdb-release-owner" || test "$(cat "$directory/.smartdb-release-owner")" = ${shellQuote(ownerTokenArg)} || return; rm -f "$directory/.smartdb-release-owner"; rmdir "$directory" 2>/dev/null || true; fi; }`,
-    'trap cleanup_unowned EXIT HUP INT TERM',
-    'mkdir -m 700 "$directory"',
-    'created=1',
-    `printf '%s\\n' ${shellQuote(ownerTokenArg)} > "$directory/.smartdb-release-owner"`,
-    'trap - EXIT HUP INT TERM',
-  ].join('\n');
-  await runCommand(
-    'ssh',
-    [...sshConnectionArgs, environmentArg.macosSsh, createScript],
-    process.cwd(),
-    capabilityCommandTimeoutMs,
-  );
-};
-
-const cleanupRemoteWorkspace = async (
-  environmentArg: IReleaseArtifactEnvironment,
-  remoteDirectoryArg: string,
-  gitCommitArg: string,
-  ownerTokenArg: string,
-): Promise<void> => {
-  assertOwnedRemoteWorkspacePath(
-    environmentArg,
-    remoteDirectoryArg,
-    gitCommitArg,
-    ownerTokenArg,
-  );
-  const cleanupScript = [
-    'set -eu',
-    `root=${shellQuote(environmentArg.macosTempRoot)}`,
-    `directory=${shellQuote(remoteDirectoryArg)}`,
-    `test "$directory" = "$root/smartdb-release.${gitCommitArg}.${ownerTokenArg}"`,
-    'test "$(cd "$root" && pwd -P)" = "$root"',
-    'test -f "$directory/.smartdb-release-owner"',
-    `test "$(cat "$directory/.smartdb-release-owner")" = ${shellQuote(ownerTokenArg)}`,
-    'rm -rf "$directory"',
-  ].join('\n');
-  await runCommand('ssh', [...sshConnectionArgs, environmentArg.macosSsh, cleanupScript]);
-};
-
-const buildArtifacts = async (
-  environmentArg: IReleaseArtifactEnvironment,
-): Promise<void> => {
-  await checkBuilders(environmentArg);
-
-  const workspace = process.cwd();
-  const branch = await captureCommand('git', ['branch', '--show-current'], workspace);
-  const gitCommit = await captureCommand('git', ['rev-parse', 'HEAD'], workspace);
-  const gitStatus = await captureCommand(
-    'git',
-    ['status', '--porcelain=v1', '--untracked-files=all'],
-    workspace,
-  );
-  const packageJson = JSON.parse(
-    fs.readFileSync(path.join(workspace, 'package.json'), 'utf8'),
-  ) as { version?: string };
-  const expectedTag = `v${packageJson.version || ''}`;
-  const tagsAtHead = (
-    await captureCommand('git', ['tag', '--points-at', 'HEAD'], workspace)
-  ).split(/\r?\n/);
-  if (branch !== 'main') throw new Error('SmartDB releases must be built from main');
-  if (gitStatus) throw new Error('SmartDB release artifact build requires a clean worktree');
-  if (!packageJson.version || !tagsAtHead.includes(expectedTag)) {
-    throw new Error(`SmartDB release artifact build requires ${expectedTag} at HEAD`);
-  }
-
-  const releaseParent = path.join(workspace, '.nogit', 'smartdb-release');
-  fs.mkdirSync(releaseParent, { recursive: true, mode: 0o700 });
-  const localDirectory = fs.mkdtempSync(
-    path.join(releaseParent, `${gitCommit.slice(0, 12)}-`),
-  );
-  const linuxDirectory = path.join(localDirectory, 'linux');
-  const macosDirectory = path.join(localDirectory, 'macos');
-  const bundlePath = path.join(localDirectory, 'source.bundle');
-  const ownerToken = crypto.randomUUID();
-  let remoteDirectory: string | undefined;
-  let completed = false;
-
-  try {
-    await runCommand('pnpm', ['exec', 'tsbundle'], workspace);
-    await runCommand('pnpm', ['exec', 'tsbuild', 'tsfolders'], workspace);
-    await runCommand('pnpm', ['exec', 'tsrust'], workspace);
-
-    fs.cpSync(path.join(workspace, 'dist_rust'), linuxDirectory, {
-      recursive: true,
-      preserveTimestamps: true,
-    });
-    assertArtifactSet(linuxDirectory, ['linux_amd64', 'linux_arm64']);
-    await runCommand(path.join(linuxDirectory, 'rustdb_linux_amd64'), ['--version'], workspace);
-    await runCommand(
-      path.join(linuxDirectory, 'rustdb_linux_arm64'),
-      ['--version'],
-      workspace,
-    );
-
-    await runCommand('git', ['bundle', 'create', bundlePath, 'HEAD'], workspace);
-    remoteDirectory = remoteWorkspacePath(environmentArg, gitCommit, ownerToken);
-    await createRemoteWorkspace(
-      environmentArg,
-      remoteDirectory,
-      gitCommit,
-      ownerToken,
-    );
-    await runCommand('scp', [
-      '-p',
-      ...sshConnectionArgs,
-      bundlePath,
-      `${environmentArg.macosSsh}:${remoteDirectory}/source.bundle`,
-    ]);
-
-    const remoteWorkspace = `${remoteDirectory}/workspace`;
-    const remoteBuildScript = [
-      'set -eu',
-      `bundle=${shellQuote(`${remoteDirectory}/source.bundle`)}`,
-      `workspace=${shellQuote(remoteWorkspace)}`,
-      `expected_commit=${shellQuote(gitCommit)}`,
-      'git clone --quiet "$bundle" "$workspace"',
-      'cd "$workspace"',
-      'test "$(git rev-parse HEAD)" = "$expected_commit"',
-      'test -z "$(git status --porcelain=v1 --untracked-files=all)"',
-      'pnpm install --frozen-lockfile',
-      'pnpm exec tsrust',
-      'cmp .nogit/tsrust-target/aarch64-apple-darwin/release/rustdb dist_rust/rustdb_macos_arm64',
-      'cmp .nogit/tsrust-target/x86_64-apple-darwin/release/rustdb dist_rust/rustdb_macos_amd64',
-      'codesign --verify --deep --strict dist_rust/rustdb_macos_arm64',
-      'codesign --verify --deep --strict dist_rust/rustdb_macos_amd64',
-      '/usr/bin/arch -arm64 dist_rust/rustdb_macos_arm64 --version',
-      '/usr/bin/arch -x86_64 dist_rust/rustdb_macos_amd64 --version',
-      'test "$(git rev-parse HEAD)" = "$expected_commit"',
-      'test -z "$(git status --porcelain=v1 --untracked-files=all)"',
-    ].join('\n');
-    await runRemoteLoginScript(environmentArg, remoteBuildScript);
-    await runCommand('scp', [
-      '-pr',
-      ...sshConnectionArgs,
-      `${environmentArg.macosSsh}:${remoteWorkspace}/dist_rust`,
-      macosDirectory,
-    ]);
-    assertArtifactSet(macosDirectory, ['macos_amd64', 'macos_arm64']);
-
-    await runCommand(
-      'pnpm',
-      ['exec', 'tsrust', 'assemble', linuxDirectory, macosDirectory],
-      workspace,
-    );
-    assertArtifactSet(path.join(workspace, 'dist_rust'), [
-      'linux_amd64',
-      'linux_arm64',
-      'macos_amd64',
-      'macos_arm64',
-    ]);
-    for (const target of ['linux_amd64', 'linux_arm64', 'macos_amd64', 'macos_arm64']) {
-      await runCommand(
-        'pnpm',
-        ['exec', 'tsrust', 'inspect', `dist_rust/rustdb_${target}`],
-        workspace,
-      );
-    }
-
-    await cleanupRemoteWorkspace(
-      environmentArg,
-      remoteDirectory,
-      gitCommit,
-      ownerToken,
-    );
-    remoteDirectory = undefined;
-    fs.rmSync(localDirectory, { recursive: true });
-    completed = true;
-    console.log(`Assembled and qualified SmartDB release artifacts for ${expectedTag}.`);
-  } finally {
-    if (!completed) {
-      console.error(`Retained local release diagnostics at ${localDirectory}`);
-      if (remoteDirectory) {
-        console.error(`Retained macOS release diagnostics at ${remoteDirectory}`);
-      }
-    }
-  }
-};
-
-try {
-  const mode = process.argv.find((argumentArg) =>
-    ['check', 'build'].includes(argumentArg),
-  ) as TReleaseArtifactMode | undefined;
-  if (!mode) throw new Error('Usage: release-artifacts.ts <check|build>');
-  const environment = loadEnvironment();
-  if (mode === 'check') {
-    await checkBuilders(environment);
-  } else {
-    await buildArtifacts(environment);
-  }
-} catch (error) {
-  console.error(error);
-  process.exitCode = 1;
-}