v0.1.4

Fixed

• io_uring: the worker reaps its completion before returning (#27).
  submit_one pushed an SQE and returned early when submit_and_wait
  failed — but after a successful push the SQE belongs to the kernel, so
  that dropped the caller's read buffer while the kernel could still be
  writing into it, and left the completion to be reaped by the next job,
  which read the stale result as its own. user_data was a constant per
  operation kind, so nothing could tell the two apart. EINTR is a signal
  rather than a failure and is retried; other errors are reported only
  after the completion is in hand; every SQE carries the worker's next
  submission number and a foreign completion is a hard error. Exposure was
  limited only because no session constructs this store (#24).

• GetOptions preconditions are honoured by both stores (#44).
  UringLocalFileSystem::get_opts read range and head and ignored the
  rest, while LocalFileSystem checks if_match / if_none_match /
  if_modified_since before reading a byte — so a conditional read was
  honoured or silently dropped depending on which store a caller held, of
  two the documentation calls identical. The cases live in the shared
  conformance body now. The worker's job channel is bounded too: one SQE
  is in flight at a time, so an unbounded queue only moved the backlog out
  of the callers and into memory.

• oxide sql survives a closed pipe (#34). … | head -1 exited 101
  with failed printing to stdout: Broken pipe, from println! inside
  DataFusion's DataFrame::show(). Output is formatted and written
  directly now, and BrokenPipe means success — the reader got what it
  asked for. explain and gen-data take the same path.

Added

• A proof for page-index pruning, beside the ones for statistics and
  Bloom filters (#43). The README claimed three and two had proofs. It
  needs a dataset the other two cannot touch or it restates them: a sorted
  column in a single row group, where min/max cannot exclude the row group
  and there is no Bloom filter. A 1,000-row predicate prunes 198,192 of
  200,000 rows with no row group pruned at all. The test writes that file
  with the parquet crate directly, because the 1,000-row data page limit
  it needs is a test's requirement rather than a lake's — no public API
  changed.

Changed

• CI installs termlens-cli prebuilt instead of compiling it from
  source on every run (#48), at the version Cargo.lock names. The test
  refuses a binary whose --version disagrees with the lockfile, so the
  shortcut cannot silently test a different tool.

Documentation

• README and STATUS agree about CUDA again (#36). README said the CUDA
  backend "has not yet run on a CUDA machine"; STATUS's matrix has
  recorded since 2026-09-06 that a T4 NVRTC-compiled and launched every
  kernel — and that the aggregation kernel's correctness bug was found
  there. Under-claiming breaks the ADR-0012 ledger as thoroughly as
  over-claiming. The header names the published version, says what "v1
  complete" means (the internal phase plan, not a 1.0), and the README
  leads with "query engine" and says a catalog, a metastore and
  transactions are out of scope.
• The io_uring store is documented as not wired into sessions (#24).
  SPEC §2.4 said it was "registered into the session's RuntimeEnv";
  nothing constructs it, so --features io-uring changes nothing at run
  time. Demoted rather than wired, because the 2026-09-02 audit measured
  the ring slower than LocalFileSystem here — the roadmap line is
  unticked with that measurement named as the blocker.
• Pinned memory is available, not what the operators use (#26).
  architecture.md and SPEC §2.1 described DMA without staging copies; the
  operator path uploads from pageable Arrow buffers and downloads into
  pageable Vecs, so any transfer number measured today is a pageable
  number.
• Phase 8 — production readiness in the roadmap (#23), listing every
  open issue in the v0.2.0 milestone with the acceptance criterion that
  would close it, and folding in the audit's deferred plans so there is
  one list. The Phase 6 claim of "double-buffered stream pipelines" is
  unticked: round_trip is serial per batch, as the audit itself says.
• The CI build-cache policy is measured and settled (#39). SECURITY.md
  and ADR-0016 said "no build cache" while three jobs cached; the
  exception had never been justified with a number. Measured: 7 min warm,
  19–29 min cold, against a 59 min pre-cache median. The caches stay and
  the documents say what they actually are — dependency-only, never
  restored for a release — with the run URLs in
  docs/ci-cache-measurement.md.

Changed

• termlens 0.10.1 → 0.11, with the vendored skill and the report
  action's pin in ci.yml and stress.yml. 0.11 is termlens's stability
  candidate: from it no promised item changes incompatibly before its 1.0,
  so this requirement should hold for a while.

  Its one breaking change lands here as a simplification.
  Screen::unsupported() returns a view instead of a slice of Arc<str>,
  and unsupported_overflow() folds into it — so the pinned list and "the
  record is not truncated" are one assertion, in both PTY suites: the
  dashboard's (oxidelake-tui/tests/emulation.rs) and the shipped
  binary's (oxidelake-runtime/tests/oxide_tui_pty.rs). The view compares
  equal to a slice only when the retained shapes match and nothing
  overflowed the bound, so a truncated record can no longer pass as a
  shorter list.

  The pin's known-defect caveat goes with it: termlens#320, which named
  blink and strikethrough as unsupported although the attribute shadow
  implements them, was fixed upstream in 0.10.2.

• The PTY test harness moved to termlens 0.10.1 (from 0.9). The three
  committed screen snapshots are unchanged: assert_screen_snapshot! records
  styles by default in 0.10, and the text snapshots opt out with
  styles = false so a colour change lands in one new styled snapshot rather
  than rewriting three large files. The vendored agent skill
  (.claude/skills/termlens/SKILL.md) was refreshed to match and is now
  checked against the dependency by make skill-version, a CI job — it had
  drifted two releases behind without anything noticing.

Added

• The dashboard's colours are tested. Nothing asserted them before:
  TestBackend::to_string() is text-only and the PTY snapshots were plain,
  so the focused panel's yellow border and the green/blue backend tags were
  invisible to the whole suite. [CUDA] is now green and [CPU] blue at
  every occurrence (Screen::find_all), Tab is asserted to move the
  highlight without changing one character of text, and ↓ is asserted to
  leave the telemetry gauges and the Describe table untouched
  (Screen::diff).

• crates/oxidelake-tui/tests/emulation.rs: the invariant the rest of the
  PTY suite rests on. Screen::unsupported() is pinned to exactly
  ["^[[59m"] — ratatui's underline-colour reset, which changes no cell — so
  a sequence the emulator silently drops can no longer make every screen
  assertion true against a wrong grid. Insert mode, bells, wrapped rows and
  mouse modes are pinned beside it, and a dashboard screen is round-tripped
  through the snapshot text format and through JSON.

• crates/oxidelake-runtime/tests/oxide_tui_pty.rs: oxide tui — the
  dashboard as users install it — in a real PTY. It renders the same frame
  oxidelake-tui snapshots, it gives the terminal back, and the tracing
  subscriber writing to stderr (the dashboard's own stream in a terminal)
  puts nothing on the grid, RUST_LOG=info included. assert_cmd captures
  pipes and could see none of that.

• crates/oxidelake-tui/tests/termlens_cli.rs: the committed .snap
  files read back with termlens-cli — render --text/--svg/--html keeping
  the palette, and diff's 0/1/2 exit codes on this repository's own
  screens. #[ignore]d, because a published crate's cargo test must not
  install a tool behind a contributor's back; CI runs it as
  make test-termlens-cli.

• CI renders a failing PTY screen instead of logging it. The Linux and
  macOS test lanes run with TERMLENS_ARTIFACT_DIR set, and on failure the
  pinned vyncint/termlens report action writes every screen the suite left
  behind — and every insta .snap.new — into the job summary, with SVG and
  HTML uploaded.

Fixed

• oxide tui now rejects non-interactive stdin/stdout before terminal setup.
  It prints a clear hint to use oxide sql or oxide explain for scripted output
  and exits with usage code 2 instead of leaking a raw ENXIO-style terminal error.

• The dashboard's Describe panel no longer prints a truncated percentile as
  if it were the value. approx_percentile_cont renders full precision, and
  the panel's six-character columns were clipped from the right, so the 2M-row
  demo table's P99 of id (1979969.24) displayed as 197999 — ten times too
  small and below the median in the same row. Numeric cells that do not fit
  are now rounded to the most decimals that fit, falling back to an exponent
  form (1.98e6); a value that already fits is left exactly as the query
  rendered it. Over-long text cells are marked with an ellipsis rather than
  cut silently, and the column widths now live in one constant the cell
  formatters and the layout share.