feat(wasix): add PostgreSQL postmaster research runtime

docs/internal/PG18_WASIX_POSTGRES.md

@@ -32,6 +32,15 @@ experiment evidence points to persistent process/fork/shmem/socket/RSS costs
 before query execution, while the released product wins by keeping one backend,
 one host lifecycle, direct FE/BE pumping, prebuilt PGDATA, and AOT reuse.
 
+This assessment records the release-lane decision; it is not the current
+physical-memory conclusion for concurrent WASIX. The independent, non-release
+[`wasix-postmaster` research lane](../../src/runtimes/liboliphaunt/wasix-postmaster/README.md)
+now measures aliased process-tree RSS only as a diagnostic and uses Linux PSS
+plus cgroup accounting for physical-memory claims. Its
+[memory model](../../src/runtimes/liboliphaunt/wasix-postmaster/docs/rss-memory-model.md)
+and fresh-backend architecture remain research inputs and do not change the
+single-backend product or its release support boundary.
+
 The practical direction is therefore:
 
 - Keep full concurrent PostgreSQL under WASIX as upstream/runtime research and
@@ -56,12 +65,14 @@ The practical direction is therefore:
   so experiment patches cannot be copied into this runtime without a WASIX
   rationale.
 
-The immediate conclusion is that a "proper" concurrent PostgreSQL under WASIX
-is unlikely to match native PostgreSQL or released Oliphaunt-style WASM performance
-soon.  A fresh PG18 WASIX runtime can plausibly beat the released PG17.5 lane
-because it keeps the low-overhead lifecycle while inheriting newer PostgreSQL,
-newer WASIX/Wasmer fixes, tighter host ABI boundaries, and targeted hot-path
-patches from the experiment.
+For the replacement decision recorded here, the immediate conclusion is that a
+"proper" concurrent PostgreSQL under WASIX was not ready to match native
+PostgreSQL or released Oliphaunt-style WASM performance. A fresh PG18 WASIX
+runtime can plausibly beat the released PG17.5 lane because it keeps the
+low-overhead lifecycle while inheriting newer PostgreSQL, newer WASIX/Wasmer
+fixes, tighter host ABI boundaries, and targeted hot-path patches from the
+experiment. Ongoing concurrent-runtime viability work is evaluated separately
+with its own current carrier and PSS/cgroup evidence.
 
 ## PG17.5 Release-Lane Implementation Comparison
 

docs/maintainers/repo-structure.md

@@ -37,6 +37,11 @@ source lives under `src/<product>/`.
   `src/sdks/react-native/`, and `src/sdks/js/` own platform and
   runtime SDKs.
 - `src/bindings/wasix-rust/` owns the first-class WASM/WASIX product lane.
+- `src/runtimes/liboliphaunt/wasix-postmaster/` owns the independent,
+  non-release research lane for a PostgreSQL postmaster with fresh WASIX
+  backends. It may reuse the canonical WASIX build container and toolchain
+  recipe, but it does not share runtime patches, generated carriers, release
+  metadata, or support claims with the released single-backend WASIX product.
 - `src/*/moon.yml` is the canonical product graph. `tools/policy/sdk-manifest.toml`
   is a small SDK parity ownership registry and must agree with Moon metadata.
 - Tooling lives under `tools/`.
@@ -54,6 +59,10 @@ source lives under `src/<product>/`.
   toolchain pins, extension-owned source pins, and generated extension catalogs
   live under `src/postgres/versions/18`, `src/sources/third-party`,
   `src/sources/toolchains`, and `src/extensions`.
+- Research-only Wasmer and wasix-libc pins for the postmaster lane live under
+  `src/sources/third-party/wasix-postmaster/`. The default `production-all`
+  source scope excludes that directory; only the explicit research scope and
+  the repository-wide `all` scope may acquire it.
 
 There should be no tracked product source under retired roots such as
 `crates/`, `sdks/`, root `liboliphaunt/`, or root product examples.
@@ -98,6 +107,12 @@ synthetic root:
   release lane and comparison target. It should not expose native engine
   selection or link/load `liboliphaunt`; native Rust work belongs in
   `src/sdks/rust`.
+- `src/runtimes/liboliphaunt/wasix-postmaster` is a peer research product, not
+  an implementation directory of `liboliphaunt-wasix`. Its Moon project has no
+  release product, its expensive build and qualification tasks are manual, and
+  all generated checkouts, builds, carriers, caches, and reports stay under
+  `target/oliphaunt-wasix-postmaster/`. A future promotion must add an explicit
+  release boundary rather than inheriting one from another WASIX product.
 - `src/runtimes/liboliphaunt/wasix/assets/build` is source-only: scripts, patches,
   Docker inputs, and shims. Generated WASIX build and work trees live under
   `target/oliphaunt-wasix/wasix-build`.

src/extensions/generated/docs/extension-evidence.json

@@ -1347,7 +1347,7 @@
     "current-source-status": "requires-exact-candidate-ci",
     "kind": "exact-sha-ci"
   },
-  "source-digest": "sha256:d30cde83f40642f68c2dd7f2b1fe1bf1a9ca05122a7a6232fca42d624a06fed2",
+  "source-digest": "sha256:bdc96d067907df05c7c87442f89f1ef5b4d6c932d04ecf733c84e958ac445ce9",
   "source-digest-inputs": [
     "src/postgres/versions/18/source.toml",
     "src/extensions/catalog/extensions.promoted.toml",

src/extensions/moon.yml

@@ -159,7 +159,9 @@ tasks:
       - "/src/runtimes/liboliphaunt/licenses/postgresql-18.4-COPYRIGHT"
       - "/src/sdks/kotlin/oliphaunt-android-gradle-plugin/src/main/resources/dev/oliphaunt/android/extension-legal-catalog.json"
       - "/src/shared/extension-runtime-contract/**/*"
-      - "/src/sources/third-party/shared/openssl.toml"
+      - "/src/sources/third-party/shared/**/*"
+      - "/src/sources/third-party/native/README.md"
+      - "/src/sources/third-party/wasix/README.md"
       - "/src/extensions/**/*"
       - "!/src/extensions/generated/docs"
       - "!/src/extensions/generated/docs/**"
@@ -169,6 +171,8 @@ tasks:
       - "/tools/dev/capture-command-output.mjs"
       - "/tools/policy/assertions/assert-source-inputs.mjs"
       - "/tools/policy/fetch-sources.mjs"
+      - "/tools/policy/source-fetch-scopes.mjs"
+      - "/tools/policy/source-fetch-scopes.test.mjs"
       - "/tools/policy/source-fetch-core.mjs"
       - "/tools/policy/source-fetch-core.test.mjs"
       - "/tools/policy/source-archive.py"

src/extensions/tools/check-extension-model.py

@@ -351,9 +351,10 @@ def source_pin_paths() -> list[Path]:
         fail(f"{rel(THIRD_PARTY_ROOT)} must exist")
     if not EXTERNAL_ROOT.is_dir():
         fail(f"{rel(EXTERNAL_ROOT)} must exist")
+    shared_source_root = THIRD_PARTY_ROOT / "shared"
     paths = [
         path
-        for path in THIRD_PARTY_ROOT.glob("**/*.toml")
+        for path in shared_source_root.glob("**/*.toml")
         if path.is_file()
     ]
     paths.extend(
@@ -2556,6 +2557,20 @@ def run_xtask_check() -> None:
 
 def self_test() -> None:
     digest_inputs = set(source_digest_inputs())
+    for path in (THIRD_PARTY_ROOT / "shared").glob("**/*.toml"):
+        if path.is_file() and rel(path) not in digest_inputs:
+            fail(f"self-test expected shared third-party source pin in extension digest inputs: {rel(path)}")
+    unrelated_third_party_inputs = sorted(
+        path
+        for path in digest_inputs
+        if path.startswith("src/sources/third-party/")
+        and not path.startswith("src/sources/third-party/shared/")
+    )
+    if unrelated_third_party_inputs:
+        fail(
+            "self-test expected non-shared runtime source pins to stay outside extension digest inputs: "
+            + ", ".join(unrelated_third_party_inputs)
+        )
     for path in [
         "src/extensions/external/vector/.release-semantic-inputs.json",
         "src/extensions/external/vector/VERSION",

src/runtimes/liboliphaunt/wasix-postmaster/.gitattributes

@@ -0,0 +1,2 @@
+# Unified-diff artifacts preserve the source whitespace they replay.
+postgres/patches/*.patch whitespace=-trailing-space,-space-before-tab,-blank-at-eof

src/runtimes/liboliphaunt/wasix-postmaster/.gitignore

@@ -0,0 +1,16 @@
+/build/
+/builds/
+/install/
+/reports/
+/run/
+/sources/
+/tools/*
+!/tools/sealed-export-closure/
+/tools/sealed-export-closure/target/
+/work/
+*.a
+*.dylib
+*.log
+*.o
+*.so
+*.wasm