flake.nix

{
  description = "beastdb — high-assurance embedded KV store (Lean 4 + Nix; freestanding libbeastdb)";

  inputs = {
    nixpkgs.follows = "lean4-nix/nixpkgs";
    flake-parts.url = "github:hercules-ci/flake-parts";
    systems.url = "github:nix-systems/default";
    lean4-nix.url = "github:lenianiva/lean4-nix";
    systems-lean.url = "github:cryptoquick/lean4/systems";
  };

  outputs = inputs @ {
    nixpkgs,
    flake-parts,
    lean4-nix,
    systems-lean,
    systems,
    ...
  }:
    flake-parts.lib.mkFlake {inherit inputs;} {
      systems = import systems;

      perSystem = {
        system,
        ...
      }: let
        pkgs = import nixpkgs {
          inherit system;
          overlays = [(lean4-nix.readToolchainFile ./lean-toolchain)];
        };

        productSrc = pkgs.lib.cleanSourceWith {
          src = ./.;
          filter = path: type: let
            base = baseNameOf path;
          in
            !(base == "ref" && type == "directory")
            && pkgs.lib.cleanSourceFilter path type;
        };

        systemsLeanPkg =
          let
            sysPkgs = systems-lean.packages.${system} or {};
          in
            sysPkgs.systems-lean or null;

        freestandingLibbeastdb =
          if systemsLeanPkg != null
          then
            import ./nix/libbeastdb.nix {
              inherit pkgs;
              systemsLean = systemsLeanPkg;
              freestandingSrc = ./freestanding;
            }
          else null;

        # First-party package SPDX: Unlicense (see LICENSE.md). Not for ref/ upstream.
        beastdbLicenseMeta = description: {
          inherit description;
          license = pkgs.lib.licenses.unlicense;
          platforms = pkgs.lib.platforms.unix;
        };

        leanPkg = pkgs.lean.buildLeanPackage {
          name = "beastdb";
          roots = ["beastdb.Main"];
          src = productSrc;
          debug = false;
          leancFlags = ["-O3" "-DNDEBUG"];
        };

        leanPkgExport = pkgs.lean.buildLeanPackage {
          name = "beastdb_export";
          roots = ["beastdb.FfiExport"];
          src = productSrc;
          debug = false;
          leancFlags = ["-O3" "-DNDEBUG"];
        };

        beastdbFsync =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-fsync";
            dontUnpack = true;
            buildInputs = [];
            buildPhase = ''
              cat > fsync_path.c <<'EOF'
              #define _POSIX_C_SOURCE 200809L
              #include <fcntl.h>
              #include <stdio.h>
              #include <string.h>
              #include <unistd.h>
              int main(int argc, char **argv) {
                int dir = 0;
                const char *path = NULL;
                if (argc == 2) { path = argv[1]; }
                else if (argc == 3 && strcmp(argv[1], "--dir") == 0) {
                  dir = 1; path = argv[2];
                } else {
                  fprintf(stderr, "usage: beastdb-fsync [--dir] PATH\n");
                  return 2;
                }
                int fd = open(path, dir ? O_RDONLY : O_RDWR);
                if (fd < 0) { perror("open"); return 1; }
                if (fsync(fd) != 0) { perror("fsync"); close(fd); return 1; }
                if (close(fd) != 0) { perror("close"); return 1; }
                return 0;
              }
              EOF
              $CC -O2 -o beastdb-fsync fsync_path.c
            '';
            installPhase = ''
              mkdir -p $out/bin
              cp beastdb-fsync $out/bin/
            '';
            meta = beastdbLicenseMeta "beastdb optional path fsync helper";
          };

        beastdbWrapped =
          pkgs.runCommand "beastdb" {
            nativeBuildInputs = [pkgs.makeWrapper];
            meta = beastdbLicenseMeta "beastdb host CLI (lean4-nix pin; multi-file durable store)";
          } ''
            mkdir -p $out/bin
            makeWrapper ${leanPkg.executable}/bin/beastdb $out/bin/beastdb \
              --prefix PATH : ${beastdbFsync}/bin
            ln -s ${beastdbFsync}/bin/beastdb-fsync $out/bin/beastdb-fsync
          '';

        beastdbRelease =
          pkgs.runCommand "beastdb-release" {
            nativeBuildInputs = [pkgs.makeWrapper pkgs.binutils];
            meta = beastdbLicenseMeta "beastdb stripped release CLI wrapper";
          } ''
            mkdir -p $out/bin
            cp ${leanPkg.executable}/bin/beastdb $out/bin/beastdb
            chmod u+w $out/bin/beastdb

            strip --strip-unneeded $out/bin/beastdb

            mv $out/bin/beastdb $out/bin/beastdb.unwrapped
            makeWrapper $out/bin/beastdb.unwrapped $out/bin/beastdb \
              --prefix PATH : ${beastdbFsync}/bin
            ln -s ${beastdbFsync}/bin/beastdb-fsync $out/bin/beastdb-fsync
          '';

        lmdbMicrobench =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-lmdb-bench";
            dontUnpack = true;
            buildInputs = [pkgs.lmdb];
            buildPhase = ''
              cat > lmdb_bench.c <<'EOF'
              #define _POSIX_C_SOURCE 200809L
              #include <lmdb.h>
              #include <stdio.h>
              #include <stdlib.h>
              #include <string.h>
              #include <time.h>
              #include <sys/stat.h>
              #include <errno.h>

              static long long now_ms(void) {
                struct timespec ts;
                clock_gettime(CLOCK_MONOTONIC, &ts);
                return (long long)ts.tv_sec * 1000LL + ts.tv_nsec / 1000000LL;
              }

              static int put_kv(MDB_txn *txn, MDB_dbi dbi, int i) {
                char kbuf[64], vbuf[64];
                snprintf(kbuf, sizeof kbuf, "k%d", i);
                snprintf(vbuf, sizeof vbuf, "v%d", i);
                MDB_val key = { .mv_size = strlen(kbuf), .mv_data = kbuf };
                MDB_val val = { .mv_size = strlen(vbuf), .mv_data = vbuf };
                return mdb_put(txn, dbi, &key, &val, 0);
              }

              static int get_kv(MDB_txn *txn, MDB_dbi dbi, int i) {
                char kbuf[64];
                snprintf(kbuf, sizeof kbuf, "k%d", i);
                MDB_val key = { .mv_size = strlen(kbuf), .mv_data = kbuf };
                MDB_val val;
                return mdb_get(txn, dbi, &key, &val);
              }

              int main(int argc, char **argv) {
                const char *dir = argc >= 2 ? argv[1] : "/tmp/beastdb-lmdb-bench";
                int n = argc >= 3 ? atoi(argv[2]) : 1000;
                if (n < 1) { fprintf(stderr, "n must be >= 1\n"); return 2; }
                if (mkdir(dir, 0755) != 0 && errno != EEXIST) {
                  perror("mkdir"); return 1;
                }
                MDB_env *env = NULL;
                MDB_txn *txn = NULL;
                MDB_dbi dbi;
                int rc;
                if ((rc = mdb_env_create(&env)) != 0) {
                  fprintf(stderr, "mdb_env_create: %s\n", mdb_strerror(rc)); return 1;
                }
                mdb_env_set_mapsize(env, 256UL * 1024UL * 1024UL);
                if ((rc = mdb_env_open(env, dir, 0, 0644)) != 0) {
                  fprintf(stderr, "mdb_env_open: %s\n", mdb_strerror(rc)); return 1;
                }
                if ((rc = mdb_txn_begin(env, NULL, 0, &txn)) != 0) {
                  fprintf(stderr, "txn: %s\n", mdb_strerror(rc)); return 1;
                }
                if ((rc = mdb_dbi_open(txn, NULL, 0, &dbi)) != 0) {
                  fprintf(stderr, "dbi: %s\n", mdb_strerror(rc)); return 1;
                }
                long long t0 = now_ms();
                for (int i = 0; i < n; i++) {
                  if ((rc = put_kv(txn, dbi, i)) != 0) {
                    fprintf(stderr, "put %d: %s\n", i, mdb_strerror(rc)); return 1;
                  }
                }
                if ((rc = mdb_txn_commit(txn)) != 0) {
                  fprintf(stderr, "commit: %s\n", mdb_strerror(rc)); return 1;
                }
                long long t1 = now_ms();
                long long put_ms = t1 - t0;
                if ((rc = mdb_txn_begin(env, NULL, MDB_RDONLY, &txn)) != 0) {
                  fprintf(stderr, "ro txn: %s\n", mdb_strerror(rc)); return 1;
                }
                t0 = now_ms();
                for (int i = 0; i < n; i++) {
                  if ((rc = get_kv(txn, dbi, i)) != 0) {
                    fprintf(stderr, "get %d: %s\n", i, mdb_strerror(rc)); return 1;
                  }
                }
                mdb_txn_abort(txn);
                t1 = now_ms();
                long long get_ms = t1 - t0;
                mdb_env_sync(env, 1);
                mdb_dbi_close(env, dbi);
                mdb_env_close(env);
                long long put_ops = put_ms <= 0 ? (long long)n * 1000 : ((long long)n * 1000) / put_ms;
                long long get_ops = get_ms <= 0 ? (long long)n * 1000 : ((long long)n * 1000) / get_ms;
                printf("lmdb bench n=%d dir=%s\n", n, dir);
                printf("put: n=%d wall_ms=%lld ops_per_s=%lld\n", n, put_ms, put_ops);
                printf("get: n=%d wall_ms=%lld ops_per_s=%lld\n", n, get_ms, get_ops);
                printf("beastdb-lmdb-bench complete\n");
                return 0;
              }
              EOF
              $CC -O2 -o beastdb-lmdb-bench lmdb_bench.c -llmdb
            '';
            installPhase = ''
              mkdir -p $out/bin
              cp beastdb-lmdb-bench $out/bin/
            '';
            meta = beastdbLicenseMeta "beastdb LMDB microbench harness (measure only; first-party)";
          };

        hostProbeSrc = pkgs.writeText "beastdb-host-probe.c" ''
          #define _POSIX_C_SOURCE 200809L
          #include <stdio.h>
          #include <stdlib.h>
          #include <string.h>
          #include <unistd.h>

          static int flag_present(const char *flags, const char *name) {
            const char *p = flags;
            size_t n = strlen(name);
            while ((p = strstr(p, name)) != NULL) {
              char before = (p == flags) ? ' ' : p[-1];
              char after = p[n];
              if ((before == ' ' || before == '\t' || before == '\n') &&
                  (after == ' ' || after == '\t' || after == '\n' || after == '\0'))
                return 1;
              p += n;
            }
            return 0;
          }

          int main(void) {
            long online = sysconf(_SC_NPROCESSORS_ONLN);
            long conf = sysconf(_SC_NPROCESSORS_CONF);
            printf("beastdb-host-probe\n");
            printf("note: local planning only; do not commit unique machine dumps\n");
            printf("logical_cpus_online=%ld\n", online);
            printf("logical_cpus_configured=%ld\n", conf);
          #ifdef __linux__
            {
              FILE *f = fopen("/proc/cpuinfo", "r");
              char line[4096];
              char flags[8192];
              flags[0] = '\0';
              if (f) {
                /* First flags/Features line only (local planning; not hybrid-CPU inventory). */
                while (fgets(line, sizeof line, f)) {
                  if (strncmp(line, "flags", 5) == 0 || strncmp(line, "Features", 8) == 0) {
                    char *colon = strchr(line, ':');
                    if (colon) {
                      strncpy(flags, colon + 1, sizeof flags - 1);
                      flags[sizeof flags - 1] = '\0';
                      break;
                    }
                  }
                }
                fclose(f);
              }
              if (flags[0] != '\0') {
                printf("vector_source=first_cpuinfo_flags_line\n");
                printf("vector_sse=%s\n", flag_present(flags, "sse") ? "yes" : "no");
                printf("vector_sse2=%s\n", flag_present(flags, "sse2") ? "yes" : "no");
                printf("vector_avx=%s\n", flag_present(flags, "avx") ? "yes" : "no");
                printf("vector_avx2=%s\n", flag_present(flags, "avx2") ? "yes" : "no");
                printf("vector_avx512f=%s\n", flag_present(flags, "avx512f") ? "yes" : "no");
                printf("vector_asimd=%s\n", flag_present(flags, "asimd") ? "yes" : "no");
              } else {
                printf("vector_flags=unavailable\n");
              }
            }
          #else
            printf("vector_flags=probe_linux_only\n");
          #endif
            printf("beastdb-host-probe complete\n");
            return 0;
          }
        '';
        hostProbe =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-host-probe";
            dontUnpack = true;
            buildPhase = ''
              $CC -O2 -o beastdb-host-probe ${hostProbeSrc}
            '';
            installPhase = ''
              mkdir -p $out/bin
              cp beastdb-host-probe $out/bin/
            '';
            meta = beastdbLicenseMeta "beastdb local host capability probe (no identity fields)";
          };

        linuxPerf =
          if !pkgs.stdenv.isLinux
          then null
          else if pkgs ? perf
          then pkgs.perf
          else if pkgs ? linuxPackages && pkgs.linuxPackages ? perf
          then pkgs.linuxPackages.perf
          else if pkgs ? linuxPackages_latest && pkgs.linuxPackages_latest ? perf
          then pkgs.linuxPackages_latest.perf
          else null;
        linuxValgrind =
          if pkgs.stdenv.isLinux && pkgs ? valgrind then pkgs.valgrind else null;
        linuxRr =
          if pkgs.stdenv.isLinux && pkgs ? rr then pkgs.rr else null;

        namecheck =
          import ./nix/namecheck.nix {
            inherit (pkgs) lib;
            inherit pkgs;
            root = ./.;
          };

        whitespaceTools =
          import ./nix/whitespace.nix {
            inherit pkgs;
            inherit (pkgs) lib;
            checkSrc = productSrc;
          };
        whitespaceBin = whitespaceTools.whitespaceBin;
        whitespaceCheck = whitespaceTools.whitespaceCheck;

        noSorry =
          pkgs.runCommand "beastdb-no-sorry" {
            src = productSrc;
          } ''
            if grep -R --include='*.lean' -nE '(^|[^a-zA-Z_])sorry([^a-zA-Z_]|$)' "$src/beastdb"; then
              echo "beastdb: sorry found in product Lean sources" >&2
              exit 1
            fi
            mkdir -p $out
            echo ok > $out/result
          '';

        gitPolicy =
          import ./nix/git-policy.nix {
            inherit pkgs;
            inherit (pkgs) lib;
            inherit whitespaceBin;
          };
        preCommitHook = gitPolicy.preCommitHook;
        verifySignatures = gitPolicy.verifySignatures;
        prePushHook = gitPolicy.prePushHook;
        installHooks = gitPolicy.installHooks;

        # User-facing flake apps: store Python (writePython3Bin), not writeShellApplication.
        flakeApps =
          import ./nix/flake-apps.nix {
            inherit pkgs;
            inherit (pkgs) lib;
            inherit beastdbWrapped lmdbMicrobench freestandingLibbeastdb linuxPerf linuxValgrind whitespaceBin;
            inherit beastdbFsync;
            beastdbFfiCAsan = null;
          };
        freestandingGateApp = flakeApps.freestandingGateApp;
        benchApp = flakeApps.benchApp;
        profileCpuApp = flakeApps.profileCpuApp;
        profileMemApp = flakeApps.profileMemApp;
        testSuiteApp = flakeApps.testSuiteApp;
        namecheckApp = flakeApps.namecheckApp;
        whitespaceFixApp = flakeApps.whitespaceFixApp;

        beastdbLib =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-lib";
            src = productSrc;
            dontStrip = true;
            nativeBuildInputs = [
              pkgs.pkg-config
              pkgs.lean.leanc
              pkgs.lean.lean-all
              pkgs.stdenv.cc
              pkgs.binutils
            ];
            propagatedBuildInputs = [pkgs.lean.leanshared];
            BEASTDB_BIN = "${beastdbWrapped}/bin/beastdb";
            buildPhase = ''
              set -euo pipefail
              mkdir -p build
              export LEAN_CC="$CC"
              LEANSHARED="${pkgs.lean.leanshared}"
              STATIC_A="${leanPkgExport.staticLib}/libbeastdb_export.a"
              test -f "$STATIC_A"


              $CC -O2 -fPIC -pthread \
                -I"$src/ffi/include" \
                -I${pkgs.lean.lean-all}/include \
                -DBEASTDB_BIN=\"$BEASTDB_BIN\" \
                -DBEASTDB_HAS_EXPORT=1 \
                -c "$src/ffi/src/beastdb_bridge.c" -o build/beastdb_bridge.o



              leanc -shared -fPIC -pthread \
                build/beastdb_bridge.o \
                -Wl,--whole-archive "$STATIC_A" -Wl,--no-whole-archive \
                $LEANSHARED/* \
                -Wl,-rpath,"$LEANSHARED" \
                -o build/libbeastdb.so



              $CC -O2 -fPIC -pthread \
                -I"$src/ffi/include" \
                -I${pkgs.lean.lean-all}/include \
                -DBEASTDB_BIN=\"$BEASTDB_BIN\" \
                -DBEASTDB_HAS_EXPORT=0 \
                -c "$src/ffi/src/beastdb_bridge.c" -o build/beastdb_bridge_static.o
              $AR rcs build/libbeastdb.a build/beastdb_bridge_static.o
            '';
            installPhase = ''
              mkdir -p $out/lib $out/include $out/lib/pkgconfig
              cp build/libbeastdb.so $out/lib/
              cp build/libbeastdb.a $out/lib/
              cp "$src/ffi/include/beastdb.h" $out/include/
              cat > $out/lib/pkgconfig/beastdb.pc <<EOF
              prefix=$out
              libdir=$out/lib
              includedir=$out/include
              Name: beastdb
              Description: beastdb foreign C ABI (dual-backend: export default + CLI emergency)
              Version: 0.1.0-core
              Libs: -L$out/lib -lbeastdb -pthread
              Cflags: -I$out/include
              EOF
            '';
            meta = beastdbLicenseMeta "beastdb temporary export+runtime C ABI library (libbeastdb.so; not freestanding)";
          };

        libbeastdbThr =
          if freestandingLibbeastdb != null
          then
            import ./nix/libbeastdb-thr.nix {
              inherit pkgs freestandingLibbeastdb beastdbLib beastdbFsync;
            }
          else null;
        libbeastdbThrApp =
          if libbeastdbThr != null
          then libbeastdbThr.thrApp
          else null;

        valueAssess =
          import ./nix/value-assess.nix {
            inherit pkgs beastdbWrapped beastdbLib beastdbFsync lmdbMicrobench;
          };
        valueAssessHarness = valueAssess.valueAssessHarness;
        valueAssessApp = valueAssess.valueAssessApp;

        compareLmdb =
          import ./nix/compare-lmdb.nix {
            inherit pkgs beastdbWrapped;
          };
        lmdbCompareBench = compareLmdb.lmdbCompareBench;
        compareLmdbApp = compareLmdb.compareLmdbApp;

        ycsbCSrcPath =
          if builtins.pathExists ./ref/ycsb-c/Makefile
          then ./ref/ycsb-c
          else
            pkgs.fetchFromGitHub {
              owner = "basicthinker";
              repo = "YCSB-C";
              rev = "6475c7a5c3c7b229224ce5ca3332a58c994b8a09";
              hash = "sha256-2p1BHgGcFuPBmQ29JSjAksIaeG05YEByuQqDKeFeAMo=";
            };
        ycsbBench =
          import ./nix/ycsb-bench.nix {
            inherit pkgs beastdbWrapped beastdbLib beastdbFsync;
            ycsbCSrc = ycsbCSrcPath;
          };
        beastdbYcsbHarness = ycsbBench.beastdbYcsbHarness;
        ycsbCRef = ycsbBench.ycsbCRef;
        ycsbBenchApp = ycsbBench.ycsbBenchApp;

        ycsbCLinked =
          if ycsbCSrcPath == null
          then null
          else
            import ./nix/ycsb-c-beastdb.nix {
              inherit pkgs beastdbLib beastdbFsync beastdbWrapped;
              ycsbCSrc = ycsbCSrcPath;
              beastdbYcsbDriverSrc = ./bench/ycsb;
            };
        beastdbYcsbc =
          if ycsbCLinked == null
          then null
          else ycsbCLinked.beastdbYcsbc;
        ycsbcRunApp =
          if ycsbCLinked == null
          then null
          else ycsbCLinked.ycsbcApp;
        ycsbcCompareApp =
          if ycsbCLinked == null
          then null
          else ycsbCLinked.ycsbcCompareApp;

        measureChartsApp =
          import ./nix/measure-charts/package.nix {
            inherit pkgs;
          };
        suiteReport =
          import ./nix/suite-report.nix {
            inherit pkgs beastdbWrapped hostProbe compareLmdbApp ycsbBenchApp valueAssessApp;
            ycsbcRunApp = ycsbcRunApp;
            ycsbcCompareApp = ycsbcCompareApp;
            libbeastdbThrApp = libbeastdbThrApp;
            measureChartsApp = measureChartsApp;
          };
        systemClassApp = suiteReport.systemClassApp;
        suiteReportApp = suiteReport.suiteReportApp;

        measureFormatSmoke =
          import ./nix/measure-format-smoke.nix {
            inherit pkgs;
            thrApp = libbeastdbThrApp;
            suiteReportApp = suiteReportApp;
          };
        measureFormatSmokeApp = measureFormatSmoke.smokeBin;
        measureFormatSmokeCheck = measureFormatSmoke.formatSmokeCheck;

        deepMeasure =
          import ./nix/deep-measure.nix {
            inherit pkgs beastdbWrapped linuxPerf linuxValgrind linuxRr valueAssessHarness;
            thrFs =
              if libbeastdbThr != null
              then libbeastdbThr.thrFs
              else null;
          };
        deepCpuApp = deepMeasure.deepCpuApp;
        deepMemApp = deepMeasure.deepMemApp;
        deepRrApp = deepMeasure.deepRrApp;
        linuxFlamegraph = deepMeasure.linuxFlamegraph;

        beastdbExportSpike =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-export-spike";
            dontUnpack = true;
            dontStrip = true;
            nativeBuildInputs = [pkgs.lean.leanc pkgs.lean.lean-all pkgs.binutils pkgs.stdenv.cc];
            buildPhase = ''
              set -euo pipefail
              mkdir -p build
              export LEAN_CC="$CC"


              STATIC_A="${leanPkgExport.staticLib}/libbeastdb_export.a"
              test -f "$STATIC_A"






              LEANSHARED="${pkgs.lean.leanshared}"
              leanc -shared -fPIC \
                -Wl,--whole-archive "$STATIC_A" -Wl,--no-whole-archive \
                "$LEANSHARED"/* \
                -Wl,-rpath,"$LEANSHARED" \
                -o build/libbeastdb_export_spike.so




              cat > build/spike_main.c <<'EOF'
#include <lean/lean.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>

/* Runtime init lives in libleanshared; not always prototyped in lean.h (v4.30 pin). */
void lean_initialize_runtime_module(void);

/*
 * Pure UInt32 constant `@[export]` from beastdb.FfiExport becomes a *data*
 * symbol (BSS/global), not a function — confirmed via nm on the .o (type B).
 * Module init populates it.
 */
extern uint32_t beastdb_lean_api_version;
extern lean_object *initialize_beastdb_FfiExport(uint8_t builtin, lean_object *w);

int main(void) {
  lean_initialize_runtime_module();
  lean_object *res = initialize_beastdb_FfiExport(/*builtin=*/1, lean_io_mk_world());
  if (lean_io_result_is_error(res)) {
    lean_io_result_show_error(res);
    return 1;
  }
  lean_dec_ref(res);
  lean_io_mark_end_initialization();

  uint32_t v = beastdb_lean_api_version;
  if (v != 9u) {
    fprintf(stderr,
      "beastdb export spike FAIL: beastdb_lean_api_version=%u expected 9\n",
      (unsigned)v);
    return 1;
  }
  printf("beastdb export spike: beastdb_lean_api_version=%u ok\n", (unsigned)v);
  printf("beastdb-export-spike link ok\n");
  return 0;
}
EOF




              leanc build/spike_main.c \
                "$STATIC_A" \
                "$LEANSHARED"/* \
                -Wl,-rpath,"$LEANSHARED" \
                -o build/beastdb-export-spike


              nm -D --defined-only build/libbeastdb_export_spike.so \
                | grep -E -q ' [TDBR] beastdb_lean_api_version$'


              ./build/beastdb-export-spike
            '';
            installPhase = ''
              set -euo pipefail
              mkdir -p $out/bin $out/lib $out/share/beastdb
              cp build/beastdb-export-spike $out/bin/
              cp build/libbeastdb_export_spike.so $out/lib/

              {
                echo "beastdb-export-spike package"
                echo "static_lib=libbeastdb_export.a"
                echo "shared_lib=libbeastdb_export_spike.so"
                echo "export_symbol=beastdb_lean_api_version"
                echo "init_symbol=initialize_beastdb_FfiExport"
                echo "runtime_init=lean_initialize_runtime_module"
                echo "leanshared=${pkgs.lean.leanshared}"
                echo "platform=linux (flake systems also list darwin; spike validated on linux)"
                echo "static_a_decision=harness runtime-proves static .a + leanshared; .so built+nm-checked; runtime shared embed validated in PR1 when linked into libbeastdb"
              } > $out/share/beastdb/export-spike-link-facts.txt

              $out/bin/beastdb-export-spike | tee $out/share/beastdb/export-spike-run.txt
              grep -q 'beastdb_lean_api_version=9 ok' $out/share/beastdb/export-spike-run.txt
              grep -q 'beastdb-export-spike link ok' $out/share/beastdb/export-spike-run.txt
            '';
            meta = beastdbLicenseMeta "beastdb Lean @[export] link spike (measure/CI harness)";
          };

        beastdbFfiC =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-ffi-c";
            src = productSrc;
            buildInputs = [beastdbLib];
            nativeBuildInputs = [];
            buildPhase = ''
              $CC -O2 -I${beastdbLib}/include \
                "$src/ffi/demos/c/main.c" \
                -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-ffi-c
            '';
            installPhase = ''
              mkdir -p $out/bin
              cp beastdb-ffi-c $out/bin/
            '';
            meta = beastdbLicenseMeta "beastdb C ABI smoke demo";
          };

        beastdbFfiCAsan =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-ffi-c-asan";
            src = productSrc;
            buildInputs = [beastdbLib];
            nativeBuildInputs = [pkgs.makeWrapper pkgs.stdenv.cc];
            dontStrip = true;
            buildPhase = ''
              set -euo pipefail
              $CC -O1 -g -fno-omit-frame-pointer \
                -fsanitize=address,undefined \
                -I${beastdbLib}/include \
                "$src/ffi/demos/c/main.c" \
                -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
                -fsanitize=address,undefined \
                -o beastdb-ffi-c-asan
            '';
            installPhase = ''
              set -euo pipefail
              mkdir -p $out/bin

              cp beastdb-ffi-c-asan $out/bin/beastdb-ffi-c-asan.unwrapped




              makeWrapper $out/bin/beastdb-ffi-c-asan.unwrapped $out/bin/beastdb-ffi-c-asan \
                --prefix PATH : ${beastdbFsync}/bin \
                --run 'export ASAN_OPTIONS="''${ASAN_OPTIONS:-detect_leaks=0:halt_on_error=1:abort_on_error=1}"' \
                --run 'export UBSAN_OPTIONS="''${UBSAN_OPTIONS:-halt_on_error=1:print_stacktrace=1}"'
            '';
            meta = beastdbLicenseMeta "beastdb C ABI ASan smoke (export path)";
          };

        beastdbFfiCAsanCli =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-ffi-c-asan-cli";
            src = productSrc;
            nativeBuildInputs = [pkgs.makeWrapper pkgs.stdenv.cc];
            dontStrip = true;
            BEASTDB_BIN = "${beastdbWrapped}/bin/beastdb";
            buildPhase = ''
              set -euo pipefail
              $CC -O1 -g -fPIC -pthread \
                -fsanitize=address,undefined -fno-omit-frame-pointer \
                -I"$src/ffi/include" \
                -I${pkgs.lean.lean-all}/include \
                -DBEASTDB_BIN=\"$BEASTDB_BIN\" \
                -DBEASTDB_HAS_EXPORT=0 \
                -c "$src/ffi/src/beastdb_bridge.c" -o beastdb_bridge_asan.o
              $CC -O1 -g -fno-omit-frame-pointer \
                -fsanitize=address,undefined \
                -I"$src/ffi/include" \
                -c "$src/ffi/demos/c/main.c" -o main_asan.o
              $CC -fsanitize=address,undefined -fno-omit-frame-pointer \
                -o beastdb-ffi-c-asan-cli main_asan.o beastdb_bridge_asan.o -pthread
            '';
            installPhase = ''
              set -euo pipefail
              mkdir -p $out/bin
              cp beastdb-ffi-c-asan-cli $out/bin/beastdb-ffi-c-asan-cli.unwrapped


              makeWrapper $out/bin/beastdb-ffi-c-asan-cli.unwrapped $out/bin/beastdb-ffi-c-asan-cli \
                --prefix PATH : ${beastdbFsync}/bin:${beastdbWrapped}/bin \
                --run 'export ASAN_OPTIONS="''${ASAN_OPTIONS:-halt_on_error=1:abort_on_error=1}"' \
                --run 'export UBSAN_OPTIONS="''${UBSAN_OPTIONS:-halt_on_error=1:print_stacktrace=1}"'
            '';
            meta = beastdbLicenseMeta "beastdb C ABI ASan smoke (CLI emergency path)";
          };

        asanSmokeApp =
          (import ./nix/flake-apps.nix {
            inherit pkgs;
            inherit (pkgs) lib;
            inherit beastdbWrapped lmdbMicrobench freestandingLibbeastdb linuxPerf linuxValgrind whitespaceBin;
            inherit beastdbFsync beastdbFfiCAsan;
          }).asanSmokeApp;

        beastdbFfiCpp =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-ffi-cpp";
            src = productSrc;
            buildInputs = [beastdbLib];
            buildPhase = ''
              $CXX -O2 -I${beastdbLib}/include \
                "$src/ffi/demos/cpp/main.cpp" \
                -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-ffi-cpp
            '';
            installPhase = ''
              mkdir -p $out/bin
              cp beastdb-ffi-cpp $out/bin/
            '';
            meta = beastdbLicenseMeta "beastdb C++ ABI smoke demo";
          };

        beastdbFfiRust =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-ffi-rust";
            src = productSrc;
            nativeBuildInputs = [pkgs.rustc pkgs.gcc];
            buildInputs = [beastdbLib];
            buildPhase = ''

              export HOME=$TMPDIR
              rustc -O "$src/ffi/demos/rust/main.rs" \
                -L native=${beastdbLib}/lib \
                -l beastdb -C link-arg=-Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-ffi-rust
            '';
            installPhase = ''
              mkdir -p $out/bin
              cp beastdb-ffi-rust $out/bin/
            '';
            meta = beastdbLicenseMeta "beastdb thin Rust FFI smoke demo";
          };

        beastdbRust =
          pkgs.stdenv.mkDerivation {
            name = "beastdb-rust";
            src = productSrc;
            nativeBuildInputs = [pkgs.rustc pkgs.gcc];
            buildInputs = [beastdbLib];
            dontStrip = true;
            buildPhase = ''
              set -euo pipefail
              export HOME=$TMPDIR
              crate="$src/ffi/rust/beastdb"
              rustc --edition 2021 -O --crate-type rlib --crate-name beastdb \
                "$crate/src/lib.rs" \
                -L native=${beastdbLib}/lib -l beastdb -l pthread \
                -o libbeastdb.rlib
              rustc --edition 2021 -O --crate-type bin --crate-name beastdb_rust_smoke \
                "$crate/examples/smoke.rs" \
                --extern beastdb=libbeastdb.rlib \
                -L native=${beastdbLib}/lib -l beastdb -l pthread \
                -C link-arg=-Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-rust-smoke

              rustc --edition 2021 -O --test --crate-name beastdb_rust_t0 \
                "$crate/tests/t0.rs" \
                --extern beastdb=libbeastdb.rlib \
                -L native=${beastdbLib}/lib -l beastdb -l pthread \
                -C link-arg=-Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-rust-t0
              rustc --edition 2021 -O --test --crate-name beastdb_rust_t1 \
                "$crate/tests/t1.rs" \
                --extern beastdb=libbeastdb.rlib \
                -L native=${beastdbLib}/lib -l beastdb -l pthread \
                -C link-arg=-Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-rust-t1

              rustc --edition 2021 -O --test --crate-name beastdb_rust_t2 \
                "$crate/tests/t2.rs" \
                --extern beastdb=libbeastdb.rlib \
                -L native=${beastdbLib}/lib -l beastdb -l pthread \
                -C link-arg=-Wl,-rpath,${beastdbLib}/lib \
                -o beastdb-rust-t2
            '';
            installPhase = ''
              mkdir -p $out/bin $out/lib
              cp beastdb-rust-smoke $out/bin/
              cp beastdb-rust-t0 $out/bin/
              cp beastdb-rust-t1 $out/bin/
              cp beastdb-rust-t2 $out/bin/
              cp libbeastdb.rlib $out/lib/
            '';
            meta = beastdbLicenseMeta "beastdb heed-inspired Rust crate (Unlicense; links beastdb-lib)";
          };

        beastdbRustSmoke =
          pkgs.runCommand "beastdb-rust-smoke" {
            nativeBuildInputs = [beastdbRust beastdbLib beastdbWrapped pkgs.coreutils];
          } ''
            set -euo pipefail
            work=$(mktemp -d)
            echo "=== beastdb-rust-smoke ===" | tee $out
            beastdb-rust-smoke "$work" | tee -a $out
            grep -q "mode_a immediate put+commit ok" $out
            grep -q "mode_b batch put+commit ok" $out
            grep -q "mode_b flush_policy put+commit ok" $out
            grep -q "mode_b time_flush_policy put+commit ok" $out
            grep -q "get_imm=imm-value" $out
            grep -q "get_batch_a=1 get_batch_b=2" $out
            grep -q "get_policy_a=1 get_policy_b=2 get_policy_c=3" $out
            grep -q "missing_key=none" $out
            grep -q "contains_present=true" $out
            grep -q "contains_missing=false" $out
            grep -q "delete_get_missing=none" $out
            grep -q "delete_contains_missing=false" $out
            grep -q "iter_live_pairs=" $out
            grep -q "prefix_iter_pairs=2" $out
            grep -q "rev_iter_pairs=" $out
            grep -q "first_last_ok=1" $out
            grep -q "range_pairs=" $out
            grep -q "acid_commit_a=1" $out
            grep -q "acid_abort_a_kept=1" $out
            grep -q "acid_abort_ghost_missing=none" $out
            grep -q "get_bytes_ok" $out
            grep -q "clear_len_ok=1" $out
            grep -q "corrupt_open_fail_closed" $out
            grep -q "beastdb-rust-smoke durable immediate+batch put/get roundtrip ok" $out
            test -f ${beastdbRust}/lib/libbeastdb.rlib
            echo "beastdb-rust-smoke complete" | tee -a $out
          '';

        beastdbRustT0 =
          pkgs.runCommand "beastdb-rust-t0" {
            nativeBuildInputs = [beastdbRust beastdbLib beastdbWrapped pkgs.coreutils];
          } ''
            set -euo pipefail
            echo "=== beastdb-rust-t0 ===" | tee $out
            beastdb-rust-t0 --test-threads=1 2>&1 | tee -a $out
            grep -q "test result: ok" $out
            grep -q "8 passed" $out
            echo "beastdb-rust-t0 complete" | tee -a $out
          '';

        beastdbRustT1 =
          pkgs.runCommand "beastdb-rust-t1" {
            nativeBuildInputs = [beastdbRust beastdbLib beastdbWrapped pkgs.coreutils];
          } ''
            set -euo pipefail
            echo "=== beastdb-rust-t1 ===" | tee $out
            beastdb-rust-t1 --test-threads=1 2>&1 | tee -a $out
            grep -q "test result: ok" $out
            grep -q "26 passed" $out
            echo "beastdb-rust-t1 complete" | tee -a $out
          '';

        beastdbRustT2 =
          pkgs.runCommand "beastdb-rust-t2" {
            nativeBuildInputs = [beastdbRust beastdbLib beastdbWrapped pkgs.coreutils];
          } ''
            set -euo pipefail
            echo "=== beastdb-rust-t2 ===" | tee $out
            beastdb-rust-t2 --test-threads=1 2>&1 | tee -a $out
            grep -q "test result: ok" $out
            grep -q "8 passed" $out
            echo "beastdb-rust-t2 complete" | tee -a $out
          '';

        ffiSmoke =
          pkgs.runCommand "beastdb-ffi-smoke" {
            nativeBuildInputs = [
              beastdbFfiC
              beastdbFfiCpp
              beastdbFfiRust
              beastdbLib
              beastdbWrapped
              pkgs.coreutils
              pkgs.stdenv.cc
            ];
          } ''
            set -euo pipefail
            work=$(mktemp -d)
            mkdir -p "$work/c" "$work/cpp" "$work/rust" "$work/corrupt"
            echo "=== FFI C ===" | tee $out
            beastdb-ffi-c "$work/c" | tee -a $out
            grep -q "get=ffi-c-value" $out
            grep -q "beastdb-ffi-c durable put/get roundtrip ok" $out
            echo "=== FFI C++ ===" | tee -a $out
            beastdb-ffi-cpp "$work/cpp" | tee -a $out
            grep -q "get=ffi-cpp-value" $out
            grep -q "beastdb-ffi-cpp durable put/get roundtrip ok" $out
            echo "=== FFI Rust ===" | tee -a $out
            beastdb-ffi-rust "$work/rust" | tee -a $out
            grep -q "get=ffi-rust-value" $out
            grep -q "beastdb-ffi-rust durable put/get roundtrip ok" $out

            echo "=== FFI fail-closed corrupt ===" | tee -a $out
            beastdb init "$work/corrupt"
            beastdb put "$work/corrupt" k v
            beastdb sync "$work/corrupt"
            printf 'torn' > "$work/corrupt/MANIFEST"
            cat > "$work/probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            int main(int argc, char **argv) {
              beastdb_env *e = 0;
              int rc = beastdb_env_open(&e, argv[1], 0);
              if (rc == 0) { printf("unexpected ok\n"); return 1; }
              printf("ffi-open-corrupt rc=%d\n", rc);
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/probe"
            "$work/probe" "$work/corrupt" | tee -a $out
            grep -q "ffi-open-corrupt rc=" $out

            echo "=== FFI value fidelity (newline + large) ===" | tee -a $out
            mkdir -p "$work/fid"
            cat > "$work/fidelity.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 1;
              }
              /* Trailing newline must round-trip (CLI println framing only). */
              const char *nlv = "val\n";
              if (beastdb_put(e, "nl-key", nlv) != BEASTDB_OK) return 2;
              if (beastdb_env_sync(e) != BEASTDB_OK) return 3;
              char *got = 0;
              if (beastdb_get(e, "nl-key", &got) != BEASTDB_OK) return 4;
              if (strcmp(got, nlv) != 0) {
                fprintf(stderr, "newline mismatch want_hex=");
                for (const char *p = nlv; *p; p++) fprintf(stderr, "%02x", (unsigned char)*p);
                fprintf(stderr, " got_hex=");
                for (const char *p = got; *p; p++) fprintf(stderr, "%02x", (unsigned char)*p);
                fprintf(stderr, "\n");
                free(got);
                return 5;
              }
              free(got);
              /* 9000-byte value must not silent-truncate at 8KiB. */
              size_t big_n = 9000;
              char *big = (char *)malloc(big_n + 1);
              if (!big) return 6;
              memset(big, 'Z', big_n);
              big[big_n] = '\0';
              if (beastdb_put(e, "big-key", big) != BEASTDB_OK) { free(big); return 7; }
              if (beastdb_env_sync(e) != BEASTDB_OK) { free(big); return 8; }
              got = 0;
              if (beastdb_get(e, "big-key", &got) != BEASTDB_OK) { free(big); return 9; }
              size_t gl = strlen(got);
              if (gl != big_n || memcmp(got, big, big_n) != 0) {
                fprintf(stderr, "large mismatch got_len=%zu want=%zu\n", gl, big_n);
                free(got);
                free(big);
                return 10;
              }
              free(got);
              free(big);
              beastdb_env_close(e);
              printf("ffi-value-fidelity ok (newline + 9000Z)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/fidelity.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/fidelity"
            "$work/fidelity" "$work/fid" | tee -a $out
            grep -q "ffi-value-fidelity ok" $out

            echo "=== FFI binary bytes roundtrip ===" | tee -a $out
            mkdir -p "$work/bin"
            cat > "$work/binary.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            /* ABI max payload 16 MiB; capture allows +4 for u32be frame. */
            #define FIELD_MAX ((size_t)16 * 1024 * 1024)
            static int expect_io(int rc, const char *what) {
              if (rc != BEASTDB_ERR_IO) {
                fprintf(stderr, "%s: want ERR_IO got %d (%s)\n", what, rc,
                        beastdb_last_error());
                return 0;
              }
              return 1;
            }
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 3) {
                fprintf(stderr, "api version %d < 3\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 2;
              }
              /* Value with embedded NUL, 0xff, newline — not valid as C string. */
              unsigned char v[] = { 'a', 0x00, 0xff, '\n', 'z' };
              const char *k = "bin-key";
              if (beastdb_put_bytes(e, k, strlen(k), v, sizeof(v)) != BEASTDB_OK) {
                fprintf(stderr, "put_bytes: %s\n", beastdb_last_error());
                return 3;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 4;
              void *got = 0;
              size_t glen = 0;
              if (beastdb_get_bytes(e, k, strlen(k), &got, &glen) != BEASTDB_OK) {
                fprintf(stderr, "get_bytes: %s\n", beastdb_last_error());
                return 5;
              }
              if (glen != sizeof(v) || memcmp(got, v, sizeof(v)) != 0) {
                fprintf(stderr, "value mismatch glen=%zu\n", glen);
                free(got);
                return 6;
              }
              free(got);
              /* Binary key that is not valid UTF-8 (0xff 0xfe + payload). */
              unsigned char bk[] = { 0xff, 0xfe, 0x00, 'k' };
              unsigned char bv[] = { 0x01, 0x02, 0x00, 0x03 };
              if (beastdb_put_bytes(e, bk, sizeof(bk), bv, sizeof(bv)) != BEASTDB_OK) {
                fprintf(stderr, "put_bytes bin key: %s\n", beastdb_last_error());
                return 7;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 8;
              got = 0; glen = 0;
              if (beastdb_get_bytes(e, bk, sizeof(bk), &got, &glen) != BEASTDB_OK) {
                fprintf(stderr, "get_bytes bin key: %s\n", beastdb_last_error());
                return 9;
              }
              if (glen != sizeof(bv) || memcmp(got, bv, sizeof(bv)) != 0) {
                fprintf(stderr, "bin key value mismatch\n");
                free(got);
                return 10;
              }
              free(got);
              /* Empty key + empty value (length-0 frames). */
              if (beastdb_put_bytes(e, "", 0, "", 0) != BEASTDB_OK) {
                fprintf(stderr, "empty put: %s\n", beastdb_last_error());
                return 11;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 12;
              got = 0; glen = 99;
              if (beastdb_get_bytes(e, "", 0, &got, &glen) != BEASTDB_OK) {
                fprintf(stderr, "empty get: %s\n", beastdb_last_error());
                return 13;
              }
              if (glen != 0 || !got) {
                fprintf(stderr, "empty value mismatch glen=%zu\n", glen);
                free(got);
                return 14;
              }
              free(got);
              /* Missing key → validation. */
              const char *miss = "no-such-bin-key";
              if (beastdb_get_bytes(e, miss, strlen(miss), &got, &glen)
                    != BEASTDB_ERR_VALIDATION) {
                fprintf(stderr, "missing key should be validation\n");
                free(got);
                return 15;
              }
              /* Oversize payload refuse (field max + 1) → ERR_IO. */
              size_t huge = FIELD_MAX + 1;
              {
                int rc_huge = beastdb_put_bytes(e, k, strlen(k), v, huge);
                if (rc_huge == BEASTDB_OK) {
                  fprintf(stderr, "oversize put should fail\n");
                  return 16;
                }
                if (!expect_io(rc_huge, "oversize put"))
                  return 16;
              }
              /*
               * Near-max / multi-chunk framed capture:
               * Full FIELD_MAX product put materializes Lean List UInt8 (heavy);
               * smoke gates multi-chunk + sizes past old silent 8KiB traps with
               * 1 MiB, and max-4 / max via smaller patterned fills that still
               * exercise u32be|payload capture room (capture = FIELD_MAX+4).
               * Use 256 KiB patterned + explicit max-4 / max only if alloc ok.
               */
              size_t mid = 256 * 1024;
              unsigned char *midv = (unsigned char *)malloc(mid);
              if (!midv) return 17;
              for (size_t i = 0; i < mid; i++)
                midv[i] = (unsigned char)(i & 0xff);
              if (beastdb_put_bytes(e, "mid-key", 7, midv, mid) != BEASTDB_OK) {
                fprintf(stderr, "mid put: %s\n", beastdb_last_error());
                free(midv);
                return 18;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) { free(midv); return 19; }
              got = 0; glen = 0;
              if (beastdb_get_bytes(e, "mid-key", 7, &got, &glen) != BEASTDB_OK) {
                fprintf(stderr, "mid get: %s\n", beastdb_last_error());
                free(midv);
                return 20;
              }
              if (glen != mid || memcmp(got, midv, mid) != 0) {
                fprintf(stderr, "mid mismatch glen=%zu\n", glen);
                free(got); free(midv);
                return 21;
              }
              free(got); free(midv);
              /* Boundary: FIELD_MAX-4 and FIELD_MAX must round-trip (capture +4). */
              size_t sizes[2] = { FIELD_MAX - 4, FIELD_MAX };
              for (int si = 0; si < 2; si++) {
                size_t n = sizes[si];
                unsigned char *big = (unsigned char *)malloc(n);
                if (!big) {
                  fprintf(stderr, "oom alloc %zu (skip bound gate)\n", n);
                  return 22;
                }
                memset(big, (unsigned char)(0xA5 + si), n);
                char keybuf[32];
                snprintf(keybuf, sizeof(keybuf), "bound-%d", si);
                if (beastdb_put_bytes(e, keybuf, strlen(keybuf), big, n)
                      != BEASTDB_OK) {
                  fprintf(stderr, "bound put n=%zu: %s\n", n, beastdb_last_error());
                  free(big);
                  return 23;
                }
                if (beastdb_env_sync(e) != BEASTDB_OK) { free(big); return 24; }
                got = 0; glen = 0;
                if (beastdb_get_bytes(e, keybuf, strlen(keybuf), &got, &glen)
                      != BEASTDB_OK) {
                  fprintf(stderr, "bound get n=%zu: %s\n", n, beastdb_last_error());
                  free(big);
                  return 25;
                }
                if (glen != n || memcmp(got, big, n) != 0) {
                  fprintf(stderr, "bound mismatch n=%zu glen=%zu\n", n, glen);
                  free(got); free(big);
                  return 26;
                }
                free(got); free(big);
              }
              beastdb_env_close(e);
              printf("ffi-binary-bytes ok (nul+ff+nl; non-utf8 key; empty; missing; oversize; 256KiB; max-4; max)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/binary.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/binary"
            "$work/binary" "$work/bin" | tee -a $out
            grep -q "ffi-binary-bytes ok" $out

            echo "=== FFI bulk multi-put ===" | tee -a $out
            mkdir -p "$work/multi-store"
            cat > "$work/multi_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 3) {
                fprintf(stderr, "api version %d < 3\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 2;
              }
              /* count=0 no-op */
              if (beastdb_put_bytes_multi(e, 0, NULL, NULL, NULL, NULL) != BEASTDB_OK) {
                fprintf(stderr, "empty multi: %s\n", beastdb_last_error());
                return 3;
              }
              const void *keys[3];
              size_t klens[3];
              const void *vals[3];
              size_t vlens[3];
              unsigned char k0[] = { 'm', 0x00, '0' };
              unsigned char v0[] = { 'A', 0xff, 'Z' };
              const char *k1 = "multi-b";
              const char *v1 = "two";
              const char *k2 = "multi-c";
              unsigned char v2[] = { 0x01, 0x00, 0x02 };
              keys[0] = k0; klens[0] = sizeof(k0); vals[0] = v0; vlens[0] = sizeof(v0);
              keys[1] = k1; klens[1] = strlen(k1); vals[1] = v1; vlens[1] = strlen(v1);
              keys[2] = k2; klens[2] = strlen(k2); vals[2] = v2; vlens[2] = sizeof(v2);
              if (beastdb_put_bytes_multi(e, 3, keys, klens, vals, vlens) != BEASTDB_OK) {
                fprintf(stderr, "multi put: %s\n", beastdb_last_error());
                return 4;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 5;
              void *got = 0; size_t glen = 0;
              if (beastdb_get_bytes(e, k0, sizeof(k0), &got, &glen) != BEASTDB_OK ||
                  glen != sizeof(v0) || memcmp(got, v0, sizeof(v0)) != 0) {
                fprintf(stderr, "multi get0 fail\n"); free(got); return 6;
              }
              free(got); got = 0; glen = 0;
              if (beastdb_get_bytes(e, k1, strlen(k1), &got, &glen) != BEASTDB_OK ||
                  glen != strlen(v1) || memcmp(got, v1, strlen(v1)) != 0) {
                fprintf(stderr, "multi get1 fail\n"); free(got); return 7;
              }
              free(got); got = 0; glen = 0;
              if (beastdb_get_bytes(e, k2, strlen(k2), &got, &glen) != BEASTDB_OK ||
                  glen != sizeof(v2) || memcmp(got, v2, sizeof(v2)) != 0) {
                fprintf(stderr, "multi get2 fail\n"); free(got); return 8;
              }
              free(got);
              beastdb_env_close(e);
              printf("ffi-multi-put ok (count=0 + 3 pairs roundtrip)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/multi_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/multi_probe"
            "$work/multi_probe" "$work/multi-store" | tee -a $out
            grep -q "ffi-multi-put ok" $out

            echo "=== FFI multi truncated count ===" | tee -a $out
            mkdir -p "$work/multi-trunc-count"
            beastdb init "$work/multi-trunc-count"
            if printf '\x00\x00' | beastdb put-bytes-multi "$work/multi-trunc-count" 2>/dev/null; then
              echo "truncated multi count should fail closed" | tee -a $out
              exit 1
            fi
            echo "ffi-multi-truncated-count fail-closed ok" | tee -a $out
            grep -q "ffi-multi-truncated-count fail-closed ok" $out

            echo "=== FFI multi truncated pair ===" | tee -a $out
            mkdir -p "$work/multi-trunc-pair"
            beastdb init "$work/multi-trunc-pair"

            if printf '\x00\x00\x00\x01\x00\x00\x00\x01k\x00\x00\x00\x64xxxxxxxxxx' | \
                 beastdb put-bytes-multi "$work/multi-trunc-pair" 2>/dev/null; then
              echo "truncated multi pair should fail closed" | tee -a $out
              exit 1
            fi
            echo "ffi-multi-truncated-pair fail-closed ok" | tee -a $out
            grep -q "ffi-multi-truncated-pair fail-closed ok" $out

            echo "=== FFI multi oversize count ===" | tee -a $out
            mkdir -p "$work/multi-overcount"
            beastdb init "$work/multi-overcount"
            if printf '\x00\x0f\x42\x41' | beastdb put-bytes-multi "$work/multi-overcount" 2>/dev/null; then
              echo "oversize multi count should fail closed" | tee -a $out
              exit 1
            fi
            echo "ffi-multi-oversize-count fail-closed ok" | tee -a $out
            grep -q "ffi-multi-oversize-count fail-closed ok" $out

            echo "=== FFI multi oversize field ===" | tee -a $out
            mkdir -p "$work/multi-overfield"
            beastdb init "$work/multi-overfield"
            if printf '\x00\x00\x00\x01\x01\x00\x00\x01' | \
                 beastdb put-bytes-multi "$work/multi-overfield" 2>/dev/null; then
              echo "oversize multi field should fail closed" | tee -a $out
              exit 1
            fi
            echo "ffi-multi-oversize-field fail-closed ok" | tee -a $out
            grep -q "ffi-multi-oversize-field fail-closed ok" $out

            echo "=== FFI truncated put-bytes frame ===" | tee -a $out
            mkdir -p "$work/trunc"
            beastdb init "$work/trunc"

            if printf '\x00\x00\x00\x01k\x00\x00\x00\x64xxxxxxxxxx' | \
                 beastdb put-bytes "$work/trunc" 2>/dev/null; then
              echo "truncated put-bytes should fail closed" | tee -a $out
              exit 1
            fi
            echo "ffi-truncated-frame fail-closed ok" | tee -a $out
            grep -q "ffi-truncated-frame fail-closed ok" $out

            echo "=== FFI contains ===" | tee -a $out
            mkdir -p "$work/contains-store"
            cat > "$work/contains_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 4) {
                fprintf(stderr, "api version %d < 4\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 2;
              }
              const char *k = "has-me";
              const char *v = "yes";
              if (beastdb_put_bytes(e, k, strlen(k), v, strlen(v)) != BEASTDB_OK) {
                fprintf(stderr, "put: %s\n", beastdb_last_error());
                return 3;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 4;
              if (beastdb_contains_bytes(e, k, strlen(k)) != BEASTDB_OK) {
                fprintf(stderr, "contains present: %s\n", beastdb_last_error());
                return 5;
              }
              if (beastdb_contains(e, k) != BEASTDB_OK) {
                fprintf(stderr, "contains utf8 present: %s\n", beastdb_last_error());
                return 6;
              }
              if (beastdb_contains_bytes(e, "nope", 4) != BEASTDB_ERR_VALIDATION) {
                fprintf(stderr, "contains missing expected VALIDATION\n");
                return 7;
              }
              if (beastdb_contains(e, "nope") != BEASTDB_ERR_VALIDATION) {
                fprintf(stderr, "contains utf8 missing expected VALIDATION\n");
                return 8;
              }
              beastdb_env_close(e);
              printf("ffi-contains ok (present + missing)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/contains_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/contains_probe"
            "$work/contains_probe" "$work/contains-store" | tee -a $out
            grep -q "ffi-contains ok" $out

            echo "=== FFI delete ===" | tee -a $out
            mkdir -p "$work/delete-store"
            cat > "$work/delete_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 5) {
                fprintf(stderr, "api version %d < 5\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) return 2;
              const char *k = "del-k";
              const char *v = "del-v";
              if (beastdb_put(e, k, v) != BEASTDB_OK) {
                fprintf(stderr, "put: %s\n", beastdb_last_error());
                return 3;
              }
              if (beastdb_delete_bytes(e, k, strlen(k)) != BEASTDB_OK) {
                fprintf(stderr, "delete: %s\n", beastdb_last_error());
                return 4;
              }
              if (beastdb_delete(e, "never") != BEASTDB_OK) {
                fprintf(stderr, "delete missing: %s\n", beastdb_last_error());
                return 5;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 6;
              if (beastdb_contains_bytes(e, k, strlen(k)) != BEASTDB_ERR_VALIDATION) {
                fprintf(stderr, "contains after delete expected VALIDATION\n");
                return 7;
              }
              char *got = 0;
              if (beastdb_get(e, k, &got) != BEASTDB_ERR_VALIDATION) {
                fprintf(stderr, "get after delete expected VALIDATION\n");
                free(got);
                return 8;
              }
              beastdb_env_close(e);
              printf("ffi-delete ok (tombstone + missing idempotent)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/delete_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/delete_probe"
            "$work/delete_probe" "$work/delete-store" | tee -a $out
            grep -q "ffi-delete ok" $out

            grep -q "api_version=9" $out

            grep -q "Not OpenLDAP LMDB wire" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_put_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_put_bytes_multi" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_atomic_batch_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_contains_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_delete_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_cursor_open" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_cursor_open_ex" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_first_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_last_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_get_neighbor_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "BEASTDB_CURSOR_REVERSE" ${beastdbLib}/include/beastdb.h
            grep -q "BEASTDB_ERR_DONE" ${beastdbLib}/include/beastdb.h
            grep -q "BEASTDB_API_VERSION 9" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_len" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_clear" ${beastdbLib}/include/beastdb.h
            grep -q "beastdb_delete_range_bytes" ${beastdbLib}/include/beastdb.h
            grep -q "BEASTDB_USE_EXPORT" ${beastdbLib}/include/beastdb.h
            grep -q "BEASTDB_USE_CLI" ${beastdbLib}/include/beastdb.h
            grep -qi "dual-backend" ${beastdbLib}/include/beastdb.h
            grep -qi "package default" ${beastdbLib}/include/beastdb.h
            grep -qi "EXPORT (package default)" ${beastdbLib}/include/beastdb.h
            test -f ${beastdbLib}/lib/libbeastdb.so
            test -f ${beastdbLib}/include/beastdb.h


            echo "=== FFI export backend (package default) ===" | tee -a $out
            mkdir -p "$work/export"
            cat > "$work/export_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "export open: %s\n", beastdb_last_error());
                return 1;
              }
              const char *k = "ex-k";
              const char *v = "ex-v";
              if (beastdb_put(e, k, v) != BEASTDB_OK) {
                fprintf(stderr, "export put: %s\n", beastdb_last_error());
                return 2;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) {
                fprintf(stderr, "export sync: %s\n", beastdb_last_error());
                return 3;
              }
              char *got = 0;
              if (beastdb_get(e, k, &got) != BEASTDB_OK || !got || strcmp(got, v) != 0) {
                fprintf(stderr, "export get mismatch (%s)\n", beastdb_last_error());
                free(got);
                return 4;
              }
              free(got);
              if (beastdb_contains_bytes(e, k, strlen(k)) != BEASTDB_OK) return 5;
              const void *keys[2] = {"m0", "m1"};
              const size_t kl[2] = {2, 2};
              const void *vals[2] = {"a", "b"};
              const size_t vl[2] = {1, 1};
              if (beastdb_put_bytes_multi(e, 2, keys, kl, vals, vl) != BEASTDB_OK) {
                fprintf(stderr, "export multi: %s\n", beastdb_last_error());
                return 6;
              }
              /* Multi-put readback (export path honesty). */
              if (beastdb_contains_bytes(e, "m0", 2) != BEASTDB_OK) return 61;
              if (beastdb_contains_bytes(e, "m1", 2) != BEASTDB_OK) return 62;
              void *mv = 0; size_t ml = 0;
              if (beastdb_get_bytes(e, "m0", 2, &mv, &ml) != BEASTDB_OK || ml != 1 ||
                  !mv || ((char *)mv)[0] != 'a') {
                fprintf(stderr, "export multi m0 readback fail\n");
                free(mv);
                return 63;
              }
              free(mv); mv = 0; ml = 0;
              if (beastdb_get_bytes(e, "m1", 2, &mv, &ml) != BEASTDB_OK || ml != 1 ||
                  !mv || ((char *)mv)[0] != 'b') {
                fprintf(stderr, "export multi m1 readback fail\n");
                free(mv);
                return 64;
              }
              free(mv);
              if (beastdb_delete(e, k) != BEASTDB_OK) return 7;
              if (beastdb_contains(e, k) != BEASTDB_ERR_VALIDATION) return 8;
              void *bv = 0; size_t bl = 0;
              unsigned char bk[] = {0, 1, 2};
              unsigned char bval[] = {9, 8, 7, 0};
              if (beastdb_put_bytes(e, bk, 3, bval, 4) != BEASTDB_OK) return 9;
              if (beastdb_get_bytes(e, bk, 3, &bv, &bl) != BEASTDB_OK || bl != 4) {
                fprintf(stderr, "export get_bytes fail\n");
                free(bv);
                return 10;
              }
              if (memcmp(bv, bval, 4) != 0) { free(bv); return 11; }
              free(bv);
              /* P6-CURSOR: ordered scan + prefix + ERR_DONE + tombstone hide */
              if (beastdb_put(e, "sa", "1") != BEASTDB_OK) return 20;
              if (beastdb_put(e, "saa", "2") != BEASTDB_OK) return 21;
              if (beastdb_put(e, "sb", "3") != BEASTDB_OK) return 22;
              if (beastdb_delete(e, "sb") != BEASTDB_OK) return 23;
              if (beastdb_env_sync(e) != BEASTDB_OK) return 24;
              beastdb_cursor *cur = 0;
              if (beastdb_cursor_open(e, &cur, NULL, 0) != BEASTDB_OK || !cur) {
                fprintf(stderr, "cursor open: %s\n", beastdb_last_error());
                return 25;
              }
              int pairs = 0;
              for (;;) {
                void *ck = 0, *cv = 0; size_t ckl = 0, cvl = 0;
                int nrc = beastdb_cursor_next(cur, &ck, &ckl, &cv, &cvl);
                if (nrc == BEASTDB_ERR_DONE) break;
                if (nrc != BEASTDB_OK) {
                  fprintf(stderr, "cursor next: %d %s\n", nrc, beastdb_last_error());
                  free(ck); free(cv);
                  beastdb_cursor_close(cur);
                  return 26;
                }
                pairs++;
                free(ck); free(cv);
              }
              if (beastdb_cursor_close(cur) != BEASTDB_OK) return 27;
              if (pairs < 2) {
                fprintf(stderr, "cursor full scan expected >=2 live, got %d\n", pairs);
                return 28;
              }
              cur = 0;
              if (beastdb_cursor_open(e, &cur, "sa", 2) != BEASTDB_OK || !cur) {
                fprintf(stderr, "prefix cursor open: %s\n", beastdb_last_error());
                return 29;
              }
              int pp = 0;
              for (;;) {
                void *ck = 0, *cv = 0; size_t ckl = 0, cvl = 0;
                int nrc = beastdb_cursor_next(cur, &ck, &ckl, &cv, &cvl);
                if (nrc == BEASTDB_ERR_DONE) break;
                if (nrc != BEASTDB_OK) {
                  free(ck); free(cv);
                  beastdb_cursor_close(cur);
                  return 30;
                }
                pp++;
                free(ck); free(cv);
              }
              beastdb_cursor_close(cur);
              if (pp != 2) {
                fprintf(stderr, "prefix scan expected 2, got %d\n", pp);
                return 31;
              }
              /* P6-ACID: multi-key atomic batch (put+put+del) — before env close. */
              {
                uint8_t tags[3] = {0, 0, 1};
                const void *ak[3] = {"aa", "ab", "aa"};
                const size_t akl[3] = {2, 2, 2};
                const void *av[3] = {"1", "2", ""};
                const size_t avl[3] = {1, 1, 0};
                if (beastdb_atomic_batch_bytes(e, 3, tags, ak, akl, av, avl) != BEASTDB_OK) {
                  fprintf(stderr, "export atomic batch: %s\n", beastdb_last_error());
                  return 40;
                }
                if (beastdb_contains_bytes(e, "aa", 2) != BEASTDB_ERR_VALIDATION) return 41;
                if (beastdb_contains_bytes(e, "ab", 2) != BEASTDB_OK) return 42;
              }
              if (beastdb_env_close(e) != BEASTDB_OK) return 12;
              printf("ffi-export-backend ok (full v7 same-process export + cursor + atomic batch)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/export_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/export_probe"

            "$work/export_probe" "$work/export" | tee -a $out
            grep -q "ffi-export-backend ok" $out

            echo "=== FFI export corrupt open (package default) ===" | tee -a $out
            mkdir -p "$work/export_corrupt"
            printf 'not-a-manifest' > "$work/export_corrupt/MANIFEST"
            cat > "$work/export_corrupt_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            int main(int argc, char **argv) {
              beastdb_env *e = 0;
              int rc = beastdb_env_open(&e, argv[1], 0);
              if (rc == BEASTDB_OK) {
                fprintf(stderr, "export corrupt open unexpectedly OK\n");
                if (e) beastdb_env_close(e);
                return 1;
              }
              if (rc != BEASTDB_ERR_CORRUPT && rc != BEASTDB_ERR_IO &&
                  rc != BEASTDB_ERR_VALIDATION) {
                fprintf(stderr, "export corrupt open unexpected code %d (%s)\n",
                        rc, beastdb_last_error());
                return 2;
              }
              printf("ffi-export-corrupt-open fail-closed ok\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/export_corrupt_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/export_corrupt_probe"
            "$work/export_corrupt_probe" "$work/export_corrupt" | tee -a $out
            grep -q "ffi-export-corrupt-open fail-closed ok" $out

            echo "=== FFI CLI emergency (BEASTDB_USE_CLI=1) ===" | tee -a $out
            mkdir -p "$work/cli_emergency"
            cat > "$work/cli_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "cli open: %s\n", beastdb_last_error());
                return 1;
              }
              const char *k = "cli-k";
              const char *v = "cli-v";
              if (beastdb_put(e, k, v) != BEASTDB_OK) {
                fprintf(stderr, "cli put: %s\n", beastdb_last_error());
                return 2;
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) {
                fprintf(stderr, "cli sync: %s\n", beastdb_last_error());
                return 3;
              }
              char *got = 0;
              if (beastdb_get(e, k, &got) != BEASTDB_OK || !got || strcmp(got, v) != 0) {
                fprintf(stderr, "cli get mismatch (%s)\n", beastdb_last_error());
                free(got);
                return 4;
              }
              free(got);
              if (beastdb_env_close(e) != BEASTDB_OK) return 5;
              printf("ffi-cli-emergency ok (BEASTDB_USE_CLI=1)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/cli_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/cli_probe"
            BEASTDB_USE_CLI=1 "$work/cli_probe" "$work/cli_emergency" | tee -a $out
            grep -q "ffi-cli-emergency ok" $out

            echo "=== FFI cursor (P6-CURSOR API v6) ===" | tee -a $out
            mkdir -p "$work/cursor-store"
            cat > "$work/cursor_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 6) {
                fprintf(stderr, "api version %d < 6\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 2;
              }
              if (beastdb_put(e, "a", "1") != BEASTDB_OK) return 3;
              if (beastdb_put(e, "aa", "2") != BEASTDB_OK) return 4;
              if (beastdb_put(e, "b", "3") != BEASTDB_OK) return 5;
              if (beastdb_delete(e, "b") != BEASTDB_OK) return 6;
              if (beastdb_env_sync(e) != BEASTDB_OK) return 7;
              beastdb_cursor *c = 0;
              if (beastdb_cursor_open(e, &c, NULL, 0) != BEASTDB_OK || !c) {
                fprintf(stderr, "cursor open: %s\n", beastdb_last_error());
                return 8;
              }
              int n = 0;
              for (;;) {
                void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                int rc = beastdb_cursor_next(c, &k, &kl, &v, &vl);
                if (rc == BEASTDB_ERR_DONE) break;
                if (rc != BEASTDB_OK) {
                  fprintf(stderr, "next: %d %s\n", rc, beastdb_last_error());
                  free(k); free(v);
                  beastdb_cursor_close(c);
                  return 9;
                }
                n++;
                free(k); free(v);
              }
              if (beastdb_cursor_close(c) != BEASTDB_OK) return 10;
              if (n != 2) {
                fprintf(stderr, "full scan expected 2 live, got %d\n", n);
                return 11;
              }
              c = 0;
              if (beastdb_cursor_open(e, &c, "a", 1) != BEASTDB_OK || !c) return 12;
              int pn = 0;
              for (;;) {
                void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                int rc = beastdb_cursor_next(c, &k, &kl, &v, &vl);
                if (rc == BEASTDB_ERR_DONE) break;
                if (rc != BEASTDB_OK) {
                  free(k); free(v);
                  beastdb_cursor_close(c);
                  return 13;
                }
                pn++;
                free(k); free(v);
              }
              beastdb_cursor_close(c);
              if (pn != 2) {
                fprintf(stderr, "prefix expected 2, got %d\n", pn);
                return 14;
              }
              /* Close then next must not succeed on a freed cursor — open fresh empty. */
              c = 0;
              if (beastdb_cursor_open(e, &c, "zzz", 3) != BEASTDB_OK || !c) return 15;
              {
                void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                int rc = beastdb_cursor_next(c, &k, &kl, &v, &vl);
                if (rc != BEASTDB_ERR_DONE) {
                  fprintf(stderr, "empty prefix expected DONE, got %d\n", rc);
                  free(k); free(v);
                  beastdb_cursor_close(c);
                  return 16;
                }
              }
              beastdb_cursor_close(c);
              beastdb_env_close(e);
              printf("ffi-cursor ok (full+prefix+DONE+tomb hide)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/cursor_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/cursor_probe"
            "$work/cursor_probe" "$work/cursor-store" | tee -a $out
            grep -q "ffi-cursor ok" $out
            mkdir -p "$work/cursor-cli"
            BEASTDB_USE_CLI=1 "$work/cursor_probe" "$work/cursor-cli" | tee -a $out
            grep -c "ffi-cursor ok" $out | grep -q '^[2]$'

            echo "=== FFI atomic batch (P6-ACID API v7) ===" | tee -a $out
            mkdir -p "$work/acid-store"
            cat > "$work/acid_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 7) {
                fprintf(stderr, "api version %d < 7\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 2;
              }
              /* Seed one key, then atomic put+put+del (del seed). */
              if (beastdb_put(e, "seed", "keep") != BEASTDB_OK) return 3;
              if (beastdb_env_sync(e) != BEASTDB_OK) return 4;
              {
                uint8_t tags[3] = {0, 0, 1};
                const void *keys[3] = {"k1", "k2", "seed"};
                const size_t kl[3] = {2, 2, 4};
                const void *vals[3] = {"v1", "v2", ""};
                const size_t vl[3] = {2, 2, 0};
                if (beastdb_atomic_batch_bytes(e, 3, tags, keys, kl, vals, vl) != BEASTDB_OK) {
                  fprintf(stderr, "atomic batch: %s\n", beastdb_last_error());
                  return 5;
                }
              }
              if (beastdb_env_sync(e) != BEASTDB_OK) return 6;
              char *g = 0;
              if (beastdb_get(e, "k1", &g) != BEASTDB_OK || !g || strcmp(g, "v1") != 0) {
                fprintf(stderr, "k1 mismatch (%s)\n", beastdb_last_error());
                free(g);
                return 7;
              }
              free(g); g = 0;
              if (beastdb_get(e, "k2", &g) != BEASTDB_OK || !g || strcmp(g, "v2") != 0) {
                free(g);
                return 8;
              }
              free(g);
              if (beastdb_contains(e, "seed") != BEASTDB_ERR_VALIDATION) return 9;
              /* Empty batch is no-op success. */
              if (beastdb_atomic_batch_bytes(e, 0, NULL, NULL, NULL, NULL, NULL) != BEASTDB_OK)
                return 10;
              /* Bad tag fail-closed. */
              {
                uint8_t bad = 9;
                const void *k = "x";
                const size_t kl = 1;
                const void *v = "y";
                const size_t vl = 1;
                if (beastdb_atomic_batch_bytes(e, 1, &bad, &k, &kl, &v, &vl) == BEASTDB_OK) {
                  fprintf(stderr, "bad tag unexpectedly OK\n");
                  return 11;
                }
              }
              beastdb_env_close(e);
              printf("ffi-atomic-batch ok (put+put+del + empty + bad-tag)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/acid_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/acid_probe"
            "$work/acid_probe" "$work/acid-store" | tee -a $out
            grep -q "ffi-atomic-batch ok" $out
            mkdir -p "$work/acid-cli"
            BEASTDB_USE_CLI=1 "$work/acid_probe" "$work/acid-cli" | tee -a $out
            grep -c "ffi-atomic-batch ok" $out | grep -q '^[2]$'

            echo "=== FFI range (P6-RANGE API v8) ===" | tee -a $out
            mkdir -p "$work/range-store"
            cat > "$work/range_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 8) {
                fprintf(stderr, "api version %d < 8\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) {
                fprintf(stderr, "open: %s\n", beastdb_last_error());
                return 2;
              }
              if (beastdb_put(e, "a", "1") != BEASTDB_OK) return 3;
              if (beastdb_put(e, "aa", "2") != BEASTDB_OK) return 4;
              if (beastdb_put(e, "c", "3") != BEASTDB_OK) return 5;
              if (beastdb_env_sync(e) != BEASTDB_OK) return 6;
              /* Reverse full scan. */
              {
                beastdb_cursor *c = 0;
                if (beastdb_cursor_open_ex(e, &c, NULL, 0, BEASTDB_CURSOR_REVERSE,
                        BEASTDB_BOUND_UNBOUNDED, NULL, 0,
                        BEASTDB_BOUND_UNBOUNDED, NULL, 0) != BEASTDB_OK || !c)
                  return 7;
                int n = 0;
                for (;;) {
                  void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                  int rc = beastdb_cursor_next(c, &k, &kl, &v, &vl);
                  if (rc == BEASTDB_ERR_DONE) break;
                  if (rc != BEASTDB_OK) { free(k); free(v); beastdb_cursor_close(c); return 8; }
                  n++; free(k); free(v);
                }
                beastdb_cursor_close(c);
                if (n != 3) { fprintf(stderr, "rev expected 3, got %d\n", n); return 9; }
              }
              /* Inclusive range [a,c] → 3. */
              {
                beastdb_cursor *c = 0;
                if (beastdb_cursor_open_ex(e, &c, NULL, 0, 0,
                        BEASTDB_BOUND_INCLUSIVE, "a", 1,
                        BEASTDB_BOUND_INCLUSIVE, "c", 1) != BEASTDB_OK || !c)
                  return 10;
                int n = 0;
                for (;;) {
                  void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                  int rc = beastdb_cursor_next(c, &k, &kl, &v, &vl);
                  if (rc == BEASTDB_ERR_DONE) break;
                  if (rc != BEASTDB_OK) { free(k); free(v); beastdb_cursor_close(c); return 11; }
                  n++; free(k); free(v);
                }
                beastdb_cursor_close(c);
                if (n != 3) { fprintf(stderr, "range expected 3, got %d\n", n); return 12; }
              }
              /* first / last */
              {
                void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                if (beastdb_first_bytes(e, &k, &kl, &v, &vl) != BEASTDB_OK || !k) return 13;
                free(k); free(v); k = 0; v = 0; kl = 0; vl = 0;
                if (beastdb_last_bytes(e, &k, &kl, &v, &vl) != BEASTDB_OK || !k) return 14;
                free(k); free(v);
              }
              /* Neighbor GT a → aa */
              {
                void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                if (beastdb_get_neighbor_bytes(e, "a", 1, BEASTDB_NEIGHBOR_GT,
                        &k, &kl, &v, &vl) != BEASTDB_OK || !k || kl != 2 ||
                    memcmp(k, "aa", 2) != 0) {
                  fprintf(stderr, "neighbor GT fail\n");
                  free(k); free(v);
                  return 15;
                }
                free(k); free(v);
              }
              /* Empty neighbor → DONE (not VALIDATION).
                 Probe GT of last live key (internal-key order honesty — external-byte
                 "zzz" is not always after all keys under LSB-first embedding). */
              {
                void *lk = 0, *lv = 0; size_t lkl = 0, lvl = 0;
                if (beastdb_last_bytes(e, &lk, &lkl, &lv, &lvl) != BEASTDB_OK || !lk) {
                  fprintf(stderr, "last for empty-neighbor probe failed\n");
                  free(lk); free(lv);
                  return 16;
                }
                void *k = 0, *v = 0; size_t kl = 0, vl = 0;
                int rc = beastdb_get_neighbor_bytes(e, lk, lkl, BEASTDB_NEIGHBOR_GT,
                    &k, &kl, &v, &vl);
                free(lk); free(lv);
                if (rc != BEASTDB_ERR_DONE) {
                  fprintf(stderr, "empty neighbor want DONE got %d\n", rc);
                  free(k); free(v);
                  return 17;
                }
              }
              beastdb_env_close(e);
              printf("ffi-range ok (rev+range+first/last+neighbor)\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/range_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/range_probe"
            "$work/range_probe" "$work/range-store" | tee -a $out
            grep -q "ffi-range ok" $out
            mkdir -p "$work/range-cli"
            BEASTDB_USE_CLI=1 "$work/range_probe" "$work/range-cli" | tee -a $out
            grep -c "ffi-range ok" $out | grep -q '^[2]$'

            echo "=== FFI D1 len/clear/delete_range (API v9) ===" | tee -a $out
            mkdir -p "$work/d1-store"
            cat > "$work/d1_probe.c" <<'CEOF'
            #include "beastdb.h"
            #include <stdio.h>
            #include <stdlib.h>
            #include <string.h>
            int main(int argc, char **argv) {
              const char *dir = argv[1];
              beastdb_env *e = 0;
              if (beastdb_api_version() < 9) {
                fprintf(stderr, "api version %d < 9\n", beastdb_api_version());
                return 1;
              }
              if (beastdb_env_open(&e, dir, 1) != BEASTDB_OK) return 2;
              size_t n = 99;
              if (beastdb_len(e, &n) != BEASTDB_OK || n != 0) return 3;
              if (beastdb_clear(e) != BEASTDB_OK) return 4;
              if (beastdb_put(e, "a", "1") != BEASTDB_OK) return 5;
              if (beastdb_put(e, "b", "2") != BEASTDB_OK) return 6;
              if (beastdb_put(e, "c", "3") != BEASTDB_OK) return 7;
              if (beastdb_len(e, &n) != BEASTDB_OK || n != 3) return 8;
              if (beastdb_delete(e, "b") != BEASTDB_OK) return 9;
              if (beastdb_len(e, &n) != BEASTDB_OK || n != 2) return 10;
              /* delete_range a..a inclusive (internal-key bounds) */
              if (beastdb_delete_range_bytes(e, BEASTDB_BOUND_INCLUSIVE, "a", 1,
                                            BEASTDB_BOUND_INCLUSIVE, "a", 1) != BEASTDB_OK)
                return 11;
              if (beastdb_len(e, &n) != BEASTDB_OK || n != 1) return 12;
              char *v = NULL;
              if (beastdb_get(e, "c", &v) != BEASTDB_OK || !v || strcmp(v, "3") != 0) {
                free(v);
                return 13;
              }
              free(v);
              if (beastdb_clear(e) != BEASTDB_OK) return 14;
              if (beastdb_len(e, &n) != BEASTDB_OK || n != 0) return 15;
              if (beastdb_env_sync(e) != BEASTDB_OK) return 16;
              if (beastdb_env_close(e) != BEASTDB_OK) return 17;
              printf("ffi-d1 ok\n");
              return 0;
            }
            CEOF
            $CC -O2 -I${beastdbLib}/include "$work/d1_probe.c" \
              -L${beastdbLib}/lib -lbeastdb -Wl,-rpath,${beastdbLib}/lib \
              -o "$work/d1_probe"
            "$work/d1_probe" "$work/d1-store" | tee -a $out
            grep -q "ffi-d1 ok" $out
            mkdir -p "$work/d1-cli"
            BEASTDB_USE_CLI=1 "$work/d1_probe" "$work/d1-cli" | tee -a $out
            grep -c "ffi-d1 ok" $out | grep -q '^[2]$'
            echo "beastdb-ffi-smoke complete" | tee -a $out
          '';
      in {
        formatter = pkgs.nixfmt-rfc-style;

        packages = {
          default = beastdbWrapped;
          beastdb = beastdbWrapped;
          beastdb-release = beastdbRelease;
          beastdb-unwrapped = leanPkg.executable;
          beastdb-fsync = beastdbFsync;
          beastdb-lmdb-bench = lmdbMicrobench;
          beastdb-lmdb-compare-bench = lmdbCompareBench;
          beastdb-compare-lmdb = compareLmdbApp;
          beastdb-ycsb-harness = beastdbYcsbHarness;
          beastdb-ycsb-bench = ycsbBenchApp;
          beastdb-system-class = systemClassApp;
          beastdb-suite-report = suiteReportApp;
          beastdb-measure-charts = measureChartsApp;
        }
        // (if measureFormatSmokeApp != null then {
          beastdb-measure-format-smoke = measureFormatSmokeApp;
        } else {})
        // (if systemsLeanPkg != null then {systems-lean = systemsLeanPkg;} else {})
        // (if freestandingLibbeastdb != null then {
          libbeastdb = freestandingLibbeastdb;
        } else {})
        // (if libbeastdbThrApp != null then {
          libbeastdb-thr = libbeastdbThrApp;
        } else {})
        // (if ycsbCRef != null then {ycsb-c-ref = ycsbCRef;} else {})
        // (if beastdbYcsbc != null then {
          beastdb-ycsbc = beastdbYcsbc;
          beastdb-ycsbc-run = ycsbcRunApp;
          beastdb-ycsbc-compare = ycsbcCompareApp;
        } else {})
        // {
          beastdb-host-probe = hostProbe;
          beastdb-test-suite = testSuiteApp;
          beastdb-profile-cpu = profileCpuApp;
          beastdb-profile-mem = profileMemApp;
          beastdb-deep-cpu = deepCpuApp;
          beastdb-deep-mem = deepMemApp;
          beastdb-deep-rr = deepRrApp;
          beastdb-value-assess-harness = valueAssessHarness;
          beastdb-value-assess = valueAssessApp;
          beastdb-lib = beastdbLib;
          beastdb-export-spike = beastdbExportSpike;
          beastdb-ffi-c = beastdbFfiC;
          beastdb-ffi-c-asan = beastdbFfiCAsan;
          beastdb-ffi-c-asan-cli = beastdbFfiCAsanCli;
          beastdb-asan-smoke = asanSmokeApp;
          beastdb-ffi-cpp = beastdbFfiCpp;
          beastdb-ffi-rust = beastdbFfiRust;
          beastdb-rust = beastdbRust;
          bench = benchApp;
          namecheck = namecheck;
          beastdb-whitespace = whitespaceBin;
          install-hooks = installHooks;
          verify-signatures = verifySignatures;
          pre-commit = preCommitHook;
          pre-push = prePushHook;
        };

        apps = {
          default = {
            type = "app";
            program = "${beastdbWrapped}/bin/beastdb";
          };
          namecheck = {
            type = "app";
            program = "${namecheckApp}/bin/beastdb-namecheck";
          };
          whitespace-check = {
            type = "app";
            program = "${whitespaceBin}/bin/beastdb-whitespace";
          };
          whitespace-fix = {
            type = "app";
            program = "${whitespaceFixApp}/bin/beastdb-whitespace-fix";
          };
          install-hooks = {
            type = "app";
            program = "${installHooks}/bin/beastdb-install-hooks";
          };
          verify-signatures = {
            type = "app";
            program = "${verifySignatures}/bin/beastdb-verify-signatures";
          };
          bench = {
            type = "app";
            program = "${benchApp}/bin/beastdb-bench";
          };
          compare-lmdb = {
            type = "app";
            program = "${compareLmdbApp}/bin/beastdb-compare-lmdb";
          };
          ycsb-bench = {
            type = "app";
            program = "${ycsbBenchApp}/bin/beastdb-ycsb-bench";
          };
          system-class = {
            type = "app";
            program = "${systemClassApp}/bin/beastdb-system-class";
          };
          suite-report = {
            type = "app";
            program = "${suiteReportApp}/bin/beastdb-suite-report";
          };
          measure-format-smoke = {
            type = "app";
            program = "${measureFormatSmokeApp}/bin/beastdb-measure-format-smoke";
          };
          measure-charts = {
            type = "app";
            program = "${measureChartsApp}/bin/beastdb-measure-charts";
          };
        }
        // (
          if ycsbcRunApp != null
          then {
            ycsbc = {
              type = "app";
              program = "${ycsbcRunApp}/bin/beastdb-ycsbc-run";
            };
            beastdb-ycsbc = {
              type = "app";
              program = "${beastdbYcsbc}/bin/beastdb-ycsbc";
            };
            ycsbc-compare = {
              type = "app";
              program = "${ycsbcCompareApp}/bin/beastdb-ycsbc-compare";
            };
          }
          else {}
        )
        // {
          host-probe = {
            type = "app";
            program = "${hostProbe}/bin/beastdb-host-probe";
          };
          test-suite = {
            type = "app";
            program = "${testSuiteApp}/bin/beastdb-test-suite";
          };
          profile-cpu = {
            type = "app";
            program = "${profileCpuApp}/bin/beastdb-profile-cpu";
          };
          profile-mem = {
            type = "app";
            program = "${profileMemApp}/bin/beastdb-profile-mem";
          };
          deep-cpu = {
            type = "app";
            program = "${deepCpuApp}/bin/beastdb-deep-cpu";
          };
          deep-mem = {
            type = "app";
            program = "${deepMemApp}/bin/beastdb-deep-mem";
          };
          deep-rr = {
            type = "app";
            program = "${deepRrApp}/bin/beastdb-deep-rr";
          };
          value-assess = {
            type = "app";
            program = "${valueAssessApp}/bin/beastdb-value-assess";
          };
          asan-smoke = {
            type = "app";
            program = "${asanSmokeApp}/bin/beastdb-asan-smoke";
          };
        }
        // (if freestandingGateApp != null then {
          freestanding-gate = {
            type = "app";
            program = "${freestandingGateApp}/bin/beastdb-freestanding-gate";
          };
        } else {})
        // (if libbeastdbThrApp != null then {
          libbeastdb-thr = {
            type = "app";
            program = "${libbeastdbThrApp}/bin/beastdb-thr";
          };
        } else {})
        // (if systemsLeanPkg != null then {
          systems-lean = {
            type = "app";
            program = "${systemsLeanPkg}/bin/lean";
          };
        } else {});

        checks = {
          namecheck = namecheck;
          whitespace = whitespaceCheck;
        }
        // (if measureFormatSmokeCheck != null then {
          measure-format-smoke = measureFormatSmokeCheck;
        } else {})
        // {
          beastdb = beastdbWrapped;
          beastdb-release = beastdbRelease;
          beastdb-lib = beastdbLib;
          beastdb-export-spike = beastdbExportSpike;
          ffi-smoke = ffiSmoke;
          beastdb-rust = beastdbRust;
          beastdb-rust-smoke = beastdbRustSmoke;
          beastdb-rust-t0 = beastdbRustT0;
          beastdb-rust-t1 = beastdbRustT1;
          beastdb-rust-t2 = beastdbRustT2;
          no-sorry = noSorry;
          pre-commit = preCommitHook;
          pre-push = prePushHook;
          verify-signatures = verifySignatures;
        }
        // (if freestandingGateApp != null then {
          freestanding-gate = pkgs.runCommand "beastdb-freestanding-gate-check" {
            nativeBuildInputs = [freestandingGateApp];
          } ''
            beastdb-freestanding-gate
            touch $out
          '';
        } else {})
        // {

          demo = pkgs.runCommand "beastdb-demo-check" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb | tee $out
            grep -q "corrupt trailing junk rejected" $out
            grep -q "bad checksum trailer rejected" $out
            grep -q "unicode scalar flip rejected" $out
            grep -q "mis-routed leaf rejected" $out
            grep -q "v1 legacy snapshot accepted" $out
            grep -q "writer lock fail-closed" $out
            grep -q "wave 1 durability demo complete" $out
            grep -q "migrated whole-file snapshot" $out
            grep -q "WAL recovery restored put semantics" $out
            grep -q "only affected shard epoch advanced" $out
            grep -q "wave 2 incremental storage demo complete" $out
            grep -q "after flush: L0 size" $out
            grep -q "after mergeTop: runs" $out
            grep -q "multi-level v2 bad checksum trailer rejected" $out
            grep -q "multi-level v2 trailing junk rejected" $out
            grep -q "compactShardLevels 0 only" $out
            grep -q "multi-level shard reopen ok" $out
            grep -q "wave 3 multi-level compaction demo complete" $out
            grep -q "window policy get" $out
            grep -q "mid-window delete getPolicy missing" $out
            grep -q "finishReconcile restored SC" $out
            grep -q "splitAndReconcile preserves gets" $out
            grep -q "mid-window openManaged dual-read policy recovered" $out
            grep -q "openManaged refuses epoch/tree mismatch" $out
            grep -q "default checkpoint preserves mid-window LIFECYCLE" $out
            grep -q "putManaged WAL mid-window put survives reopen" $out
            grep -q "StoreDir beginSplitDir + putManaged + finishReconcileDir + openManaged ok" $out
            grep -q "wave 4 split lifecycle demo complete" $out
            grep -q "pure SWMR histories" $out
            grep -q "lock efficiency: get/openStore not exclusive; atomic put no excess hold (pure SWMR)" $out
            grep -q "independent shard compactOne order agrees" $out
            grep -q "reader openStore+get without exclusive LOCK" $out
            grep -q "second writer put → Error.concurrent while lease held" $out
            grep -q "reader open+get during writer lease ok" $out
            grep -q "stale post-endWrite handle put → Error.concurrent" $out
            grep -q "close releases session lease without endWrite" $out
            grep -q "closed multi-file handle put → Error.validation (fail closed)" $out
            grep -q "closed multi-file handle endWrite → Error.validation (fail closed)" $out
            grep -q "closed multi-file handle compact (non-leaf) → Error.validation (fail closed)" $out
            grep -q "closed multi-file handle exportSnapshot → Error.validation (fail closed)" $out
            grep -q "closed multi-file handle sync → Error.validation (fail closed)" $out
            grep -q "closed multi-file handle beginWrite → Error.validation (fail closed)" $out
            grep -q "closed multi-file handle delete → Error.validation (fail closed)" $out
            grep -q "wave 6 SWMR concurrency demo complete" $out

            grep -q "full scan: 3 live pairs, tombs hidden, internal-key order ok" $out
            grep -q "P6-CURSOR + P6-RANGE product scan demo complete" $out

            grep -q "write txn abort: staged put not visible" $out
            grep -q "atomic batch: put+put+del visible; reopen ok" $out
            grep -q "write txn begin/put/del/commit + abort + free-copy refuse ok" $out
            grep -q "P6-ACID product multi-key atomic batch demo complete" $out

            grep -q "len: live keys only (tombs not counted)" $out
            grep -q "deleteRange: internal-key bounds batch ok" $out
            grep -q "clear: all live keys gone; durable reopen empty" $out
            grep -q "D1 product len/clear/deleteRange demo complete" $out

            grep -q "classifyIO taxonomy: concurrent/validation/corrupt/io order locked (R16)" $out
            grep -q "resource bounds: empty ok" $out
            grep -q "wave 7 resource bounds" $out
            grep -q "compress round-trip ok" $out
            grep -q "RLE round-trip ok" $out
            grep -q "MAC accept right key / reject wrong key ok" $out
            grep -q "encrypt round-trip ok" $out
            grep -q "persist v3 compress encode/decode round-trip ok" $out
            grep -q "MAC reject wrong key ok" $out
            grep -q "encrypt-then-MAC + compress round-trip ok" $out
            grep -q "encrypt wrong key rejected" $out
            grep -q "importSnapshot wrong MAC key → Error.corrupt" $out
            grep -q "wave 8 compression + encryption demo complete" $out
            grep -q "L3 disabled → fail closed" $out
            grep -q "L2 fork-join compactSchedule order agrees" $out
            grep -q "pure MWMR disjoint-shard concurrent puts ok" $out
            grep -q "lock efficiency: MWMR disjoint leaf leases concurrent (no global exclusive for put)" $out
            grep -q "pure Structural CAS race: one publish wins" $out
            grep -q "product multi-shard compact schedule ≡ pure ForkJoin gets" $out
            grep -q "horizon 2 honesty: Workstream J pure Structural" $out
            grep -q "horizon 2 L2/L3/MWMR pure-model demo complete" $out
            grep -q "bulk FNV byte≡char on latin-1" $out
            grep -q "product Api.fingerprintBytes / keysEqual wired" $out
            grep -q "horizon 3 honesty: scalar-only; SIMD deferred" $out
            grep -q "horizon 3 honesty: Workstream I measured residual" $out
            grep -q "horizon 3 L1 portable bulk kernel demo complete" $out
            grep -q "exclusive write: at most one exclusive token" $out
            grep -q "affine snapshot: get-only; write-from-snapshot fail closed; drop ok" $out
            grep -q "buffer uniqueness: consume-on-use; align gate; Bulk fingerprint bridge" $out
            grep -q "horizon 4 honesty: encoded linear/affine via API+world+proofs; not language linear types" $out
            grep -q "horizon 4 linear/affine resource demo complete" $out
            grep -q "product AEAD encrypt-then-MAC round-trip ok" $out
            grep -q "requireAuth enc-without-MAC pure encode refused" $out
            grep -q "export requireAuth enc-without-MAC → Error.validation" $out
            grep -q "export productAead empty keys → Error.validation" $out
            grep -q "multi-process disjoint shard lock ok" $out
            grep -q "horizon 5 honesty: product multi-process put on disjoint leaves is G22" $out
            grep -q "horizon 5 G19 product AEAD + shard-lock residual demo complete" $out
          '';
          horizon2 = pkgs.runCommand "beastdb-horizon2-check" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb horizon2 | tee $out
            grep -q "L3 disabled → fail closed" $out
            grep -q "L3 drain Config.off → store unchanged" $out
            grep -q "L3 acquireShard → fail closed" $out
            grep -q "L3 message protocol deliver/drain ok" $out
            grep -q "L2 fork-join compactSchedule order agrees" $out
            grep -q "L2 leafSchedule/compactLeaves ≡ reverse schedule on gets" $out
            grep -q "L2 multi-get sequential ≡ parallel" $out
            grep -q "resource handles: double-end no-op; use-after-release fail closed" $out
            grep -q "pure MWMR same-shard second acquire → fail closed" $out
            grep -q "pure MWMR disjoint-shard concurrent puts ok" $out
            grep -q "lock efficiency: MWMR disjoint leaf leases concurrent (no global exclusive for put)" $out
            grep -q "pure Structural CAS race: one publish wins; stale gen → fail closed" $out
            grep -q "pure Structural unique publisher: second acquire → fail closed" $out
            grep -q "pure Structural session publish + generation fence ok" $out
            grep -q "pure Structural disjoint put after publish ok" $out
            grep -q "horizon 2 honesty: pure Structural concurrent publish model; product generation-fenced structural is struct-smoke" $out
            grep -q "lock efficiency: structural short cooperative LOCK required (not lock-free dual MANIFEST publishers)" $out
            grep -q "product multi-shard compact schedule ≡ pure ForkJoin gets" $out
            grep -q "product compactBySchedule mixed leaf+non-leaf → fail closed before durable work" $out
            grep -q "product compactBySchedule non-leaf id → fail closed" $out
            grep -q "horizon 2 honesty: pure L2/L3/MWMR models; product multi-process put is G22" $out
            grep -q "horizon 2 honesty: product multi-shard compact uses ForkJoin leafSchedule" $out
            grep -q "horizon 2 honesty: Workstream J pure Structural" $out
            grep -q "horizon 2 L2/L3/MWMR pure-model demo complete" $out
          '';
          horizon3 = pkgs.runCommand "beastdb-horizon3-check" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb horizon3 | tee $out
            grep -q "byte bridge: latin-1 round-trip ok" $out
            grep -q "bulk FNV byte≡char on latin-1" $out
            grep -q "product Api.fingerprintBytes / keysEqual wired" $out
            grep -q "bulk keyEq / keyCmp ok" $out
            grep -q "mergeSortedKeys length / nil-left ok" $out
            grep -q "alignment: misaligned require → none" $out
            grep -q "horizon 3 honesty: scalar-only; SIMD deferred" $out
            grep -q "horizon 3 honesty: Workstream I measured residual" $out
            grep -q "horizon 3 L1 portable bulk kernel demo complete" $out
          '';
          horizon4 = pkgs.runCommand "beastdb-horizon4-check" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb horizon4 | tee $out
            grep -q "exclusive write: at most one exclusive token; end consumes; dual begin fail closed" $out
            grep -q "affine snapshot: get-only; write-from-snapshot fail closed; drop ok" $out
            grep -q "buffer uniqueness: consume-on-use; align gate; Bulk fingerprint bridge" $out
            grep -q "resource↔Mwmr: release then mutate fail closed" $out
            grep -q "horizon 4 honesty: encoded linear/affine via API+world+proofs; not language linear types" $out
            grep -q "horizon 4 linear/affine resource demo complete" $out
          '';
          horizon5 = pkgs.runCommand "beastdb-horizon5-check" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb horizon5 | tee $out
            grep -q "horizon 5 G19 product AEAD + H5.2 shard locks + G20 methodology" $out
            grep -q "product AEAD encrypt-then-MAC round-trip ok" $out
            grep -q "product AEAD wrong MAC → none" $out
            grep -q "product AEAD wrong enc key → none" $out
            grep -q "requireAuth enc-without-MAC pure encode refused" $out
            grep -q "requireAuth refuses enc-only envelope on decode" $out
            grep -q "export/import productAead path ok" $out
            grep -q "export requireAuth enc-without-MAC → Error.validation" $out
            grep -q "export productAead empty keys → Error.validation" $out
            grep -q "multi-process same-shard lock → fail closed" $out
            grep -q "multi-process disjoint shard lock ok" $out
            grep -q "horizon 5 honesty: multi-file unencrypted by default" $out
            grep -q "horizon 5 honesty: product multi-process put on disjoint leaves is G22" $out
            grep -q "horizon 5 honesty: G9 models remain algorithms" $out
            grep -q "horizon 5 G19 product AEAD + shard-lock residual demo complete" $out
          '';
          bench = pkgs.runCommand "beastdb-bench-check" {
            nativeBuildInputs = [beastdbWrapped lmdbMicrobench];
          } ''
            work="$TMPDIR/beastdb-bench-check"
            mkdir -p "$work/beastdb" "$work/lmdb"
            beastdb bench "$work/beastdb" 200 | tee $out
            grep -q "beastdb bench complete" $out
            grep -q "put:" $out
            grep -q "get_pre_compact:" $out
            grep -q "compact_schedule:" $out
            grep -q "compact_multi_shard:" $out
            grep -q "mode=sequential" $out
            grep -q "get_post_compact:" $out
            grep -q "get_post_sync:" $out
            grep -q "get_post_reopen:" $out

            grep -q "keysUnique=all" $out
            grep -q "misses=0" $out
            grep -q "on_disk_bytes=" $out
            beastdb-lmdb-bench "$work/lmdb" 200 | tee -a $out
            grep -q "beastdb-lmdb-bench complete" $out
          '';
          layout-smoke = pkgs.runCommand "beastdb-layout-smoke" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb layout-smoke | tee $out
            grep -q "layout: encode/decode round-trip ok" $out
            grep -q "layout: bad magic → none (fail closed)" $out
            grep -q "layout: corrupt FNV trailer → none (fail closed)" $out
            grep -q "layout: apply put frame → engine get ok" $out
            grep -q "layout: product init/put/sync/open/get ok" $out
            grep -q "layout: stale free-copy syncImage → Error.concurrent" $out
            grep -q "layout: putImage after close → Error.validation" $out
            grep -q "layout: syncImage after close → Error.validation" $out
            grep -q "layout: compactImage after close → Error.validation" $out
            grep -q "layout: openImage corrupt trailer → Error.corrupt" $out
            grep -q "layout: openImage truncated magic-only → Error.corrupt" $out
            grep -q "layout: migrateDirToImage preserves get" $out
            grep -q "layout: migrateImageToDir preserves get" $out
            grep -q "layout honesty: library putImage in-memory; CLI image-put forces put+sync" $out
            grep -q "layout honesty: migrateImageToDir partial multi-file dest residual" $out
            grep -q "layout-smoke complete" $out
          '';
          crash-suite = pkgs.runCommand "beastdb-crash-suite" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb crash-suite | tee $out
            grep -q "truncated WAL last record" $out
            grep -q "corrupt WAL header → openDir none" $out
            grep -q "missing shard blob → openDir none" $out
            grep -q "stale stable LIFECYCLE → openManaged none" $out
            grep -q "orphan MANIFEST.tmp ignored" $out
            grep -q "baseline init+put+sync+reopen ok" $out
            grep -q "get-path cost unique=" $out
            grep -q "crash: image init+put+sync+reopen ok" $out
            grep -q "corrupt image trailer → openImage Error.corrupt" $out
            grep -q "torn image (magic only) → openImage Error.corrupt" $out
            grep -q "multi-put truncated per-leaf WAL → longest complete-prefix recover ok" $out
            grep -q "corrupt per-leaf WAL header → openDir none" $out
            grep -q "foreign put + compact/sync keeps sibling data" $out
            grep -q "torn last frame / mid-body image → openImage Error.corrupt" $out
            grep -q "image trailing junk → openImage Error.corrupt" $out
            grep -q "mid-migrate partial dest (corrupt MANIFEST) → openDir none" $out
            grep -q "mid-migrate leaves source image intact" $out
            grep -q "orphan image .beastdb-tmp ignored" $out
            grep -q "orphan LIFECYCLE.tmp ignored" $out
            grep -q "orphan per-leaf WAL .tmp ignored" $out
            grep -q "corrupt LIFECYCLE → openManaged none" $out
            grep -q "compact-on-publish sync truncates per-leaf WAL" $out
            grep -q "mid-checkpoint residual (WAL re-apply after publish) get equal" $out
            grep -q "orphan future shard epoch ignored" $out
            grep -q "kill-mid-write residual" $out
            grep -q "not kill-9 mid-put" $out
            grep -q "horizon 1 crash suite complete" $out
          '';
          swmr-smoke = pkgs.runCommand "beastdb-swmr-smoke" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb swmr-smoke | tee $out
            grep -q "second process put → fail closed" $out
            grep -q "reader process open+get without exclusive lock ok" $out
            grep -q "after unlock, second process put ok" $out
            grep -q "horizon 1 multi-process SWMR smoke complete" $out
          '';
          mwmr-smoke = pkgs.runCommand "beastdb-mwmr-smoke" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb mwmr-smoke | tee $out
            grep -q "two processes put on disjoint leaves both succeeded" $out
            grep -q "parent reopen get sees both disjoint puts" $out
            grep -q "same-leaf second process put → fail closed" $out
            grep -q "put while global LOCK held → fail closed" $out
            grep -q "foreign put + double sync keeps sibling data" $out
            grep -q "G22 multi-process MWMR product put smoke complete" $out
          '';
          struct-smoke = pkgs.runCommand "beastdb-struct-smoke" {
            nativeBuildInputs = [beastdbWrapped];
          } ''
            beastdb struct-smoke | tee $out
            grep -q "two processes race split-reconcile → one wins, one concurrent" $out
            grep -q "parent reopen coherent (generation bumped; gets preserved)" $out
            grep -q "stale free-copy splitAndReconcile → Error.concurrent" $out
            grep -q "durable state coherent after stale free-copy refuse" $out
            grep -q "Track 3 multi-process generation-fenced structural smoke complete" $out
          '';
          host-probe = pkgs.runCommand "beastdb-host-probe-check" {
            nativeBuildInputs = [hostProbe];
          } ''
            beastdb-host-probe | tee $out
            grep -q "beastdb-host-probe" $out
            grep -q "logical_cpus_online=" $out
            grep -q "logical_cpus_configured=" $out
            grep -q "beastdb-host-probe complete" $out

            if grep -qiE 'serial|uuid|hostname|mac address|hwaddr|machine-id' $out; then
              echo "host-probe leaked identity-like labels" >&2
              exit 1
            fi
          '';
        };

        devShells.default = pkgs.mkShell {
          packages = with pkgs.lean;
            [lean-all]
            ++ [
              pkgs.git
              pkgs.gnupg
              pkgs.ripgrep # proof-stats refresh (docs/PROOFS.md)
              beastdbFsync
              hostProbe
              pkgs.hyperfine
              pkgs.gdb
            ]
            ++ pkgs.lib.optional (linuxPerf != null) linuxPerf
            ++ pkgs.lib.optional (linuxValgrind != null) linuxValgrind
            ++ pkgs.lib.optional (linuxRr != null) linuxRr
            ++ pkgs.lib.optional (linuxFlamegraph != null) linuxFlamegraph;
        };

        devShells.systems-lean =
          if systemsLeanPkg != null
          then
            pkgs.mkShell {
              packages = [
                systemsLeanPkg
                pkgs.gcc
                pkgs.binutils
              ];
              shellHook = ''
                echo "beastdb devShell: systems-lean (freestanding lane)"
                echo "  product pin remains lean4-nix (nix develop default)"
                echo "  libbeastdb: nix build .#libbeastdb"
                echo "  gate: nix run .#freestanding-gate"
                lean --version 2>/dev/null || true
              '';
            }
          else
            pkgs.mkShell {
              shellHook = ''
                echo "systems-lean package not available on this system" >&2
                exit 1
              '';
            };
      };
    };
}