• chore(engine): publish engine bases in ci #4649 : 3 dependent PRs (#4650 , #4652 , #4666 )
• chore: lockfile lefthook #4647
• fix(rivetkit): surface native sqlite kv errors to callers #4645
• fix(rivetkit): prevent sleep races during disconnect and db work #4644
• fix(rivetkit): isolate engine envoys and propagate startup failures #4643
• test(rivetkit): remove wasm sqlite-only fixtures and coverage #4642
• chore(sqlite-vfs): remove wasm sqlite packages and workspace wiring #4641
• chore(rivetkit): remove wasm sqlite runtime #4614
• fix(sqlite-native): restore native startup kv preload #4639 👈 (View in Graphite)
• fix(sqlite-native): delete metadata before chunk range #4638
• fix(sqlite-native): keep truncate cache coherent #4637
• fix(sqlite-vfs): use delete range for truncate cleanup #4636
• fix(sqlite-native): restore kv error hook #4635
• perf(sqlite-native): avoid cloning cached read chunks #4634
• perf(sqlite-native): gate kv operation labels #4633
• perf(sqlite-native): reuse read cache for partial writes #4632
• perf(sqlite-native): remove delete file existence probe #4631
• fix(sqlite-native): gate native read cache behind env var #4630
• fix(pegboard): isolate runner config dc lookup failures #4625 : 1 other dependent PR (#4626 )
• docs(pegboard): note runner config upsert split write risk #4624
• fix(pegboard): unpack global runner config keys correctly #4623
• fix(pegboard-gateway): enforce tunnel message state #4622
• fix(pegboard-runner): clear terminal tunnel routes #4621
• fix(pegboard): skip protocol version keys in runner pool backfill #4620
• fix(pegboard): create missing normal runner configs #4619
• fix(epoxy): reuse cached optimistic value #4618
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Code Review

The PR restores the native startup KV preload that was previously a no-op (_preloaded_kv was ignored). The overall approach is sound. A few items worth addressing:

Issues from prior review (still present)

startup_preload_put silently ignores new keys without explanation

fn startup_preload_put(entries: &mut StartupPreloadEntries, key: &[u8], value: &[u8]) {
    if let Ok(idx) = startup_preload_search(entries, key) {
        entries[idx].1 = value.to_vec();
    }
    // Err(_) falls through with no insert
}

The no-insert-on-miss behavior is intentional (new pages written at runtime are already durable in KV), but without a comment a reader will assume this is a bug. Add something like: // Do not insert new keys; the preload only tracks entries fetched at startup.

kv_get appends hits after misses, not in input order

result.keys.extend(preloaded_keys);
result.values.extend(preloaded_values);

The merged result places miss keys first (from the network response), then appends hit keys. Confirm that all callers look up values by key rather than by position. If KvGetResult is consumed positionally anywhere, this silently returns wrong values.

No integration-level test for the partial-hit/miss merge in kv_get

The three new unit tests cover helper functions in isolation. Nothing exercises the mixed case: some keys in the preload, some requiring a network fetch. A test with a mock SqliteKv asserting correct key->value pairing after the merge would catch ordering bugs.

New items

Version metadata is encoded, transmitted, then dropped

bridge_actor.rs serialises entry.metadata.version into the JSON payload; database.rs discards it:

.map(|entry| (entry.key.to_vec(), entry.value.to_vec()))

If the VFS preload never needs versions this is fine, but the round-trip cost (base64-encode in Rust, base64-decode in JS, then dropped) is wasted work. Either stop encoding the version field in encode_preloaded_kv, or add a comment explaining why it is intentionally dropped.

requestedGetKeys and requestedPrefixes are decoded but appear unused in the native path

decodePreloadedKv builds the full { entries, requestedGetKeys, requestedPrefixes } object, but openDatabaseFromEnvoy/openRawDatabaseFromEnvoy only accept [Uint8Array, Uint8Array][] (key-value pairs). If these fields are consumed by the WASM path elsewhere, a brief comment would clarify. If they are genuinely unused in the native path, skip decoding them to avoid unnecessary allocations.

Mutex poison silently turns write-through updates into no-ops

fn update_startup_preload(&self, f: impl FnOnce(&mut StartupPreloadEntries)) {
    if let Ok(mut guard) = self.startup_preload.lock() { ... }
    // Err (poisoned) silently falls through
}

If a panic occurs while the lock is held, all subsequent kv_put/kv_delete preload updates are silently skipped while kv_get continues serving the pre-panic snapshot. This matches how last_error is handled elsewhere so it is not a new pattern, but it means a panic can introduce invisible inconsistency. Consider .unwrap_or_else(|e| e.into_inner()) to recover from poison.

Minor nit

wrapper.js decodePreloadedKv uses Uint8Array.from(Buffer.from(value, 'base64')). Buffer.from already returns a Uint8Array subclass; the outer Uint8Array.from iterates every byte to produce a plain copy. Returning the Buffer directly or using new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength) would be cheaper. Not a correctness issue.