# Checkpoint — distribution

- Status: **RUNNING**
- Plan branch: `distribution-plan`  Base: `master`
- Current: A2 (pooled distd, PLAN-HTTPZ S7b) done 2026-06-12 → `74b41f5` + `c734f47`: 4 handler workers, writes serialized behind one mutex, /api/apps 5.7k → 12.0k req/s; en route the vendored sqlite flipped THREADSAFE=0→1 in sx (`3948813`) after the pool exposed heap corruption (pinned by server_http's concurrency case + sqlite_api). A1 → `48a13c4` (std.http readiness loop + keep-alive; 6 idle preconnects 3.7ms ttfb, was 3.9s behind two). sx grew time/socket-nb/kqueue/event/thread/http (PLAN-HTTPZ; issue 0131 found+fixed). Benchmark vs httpz: sx/current/BENCH-HTTPZ.md. Next: P6.2 admin UI actions; packaging (07) still blocked on sx Linux targets
- Updated: 2026-06-12   HEAD: `48a13c4`

## Progress

| step | status | attempts | merge |
|------|--------|----------|-------|
| P1.1 | merged | 1 | 331a3e06 |
| P2.1 | merged | 3 | b5529583 |
| P2.2 | merged | 2 | a2f7ad2a |
| P2.3 | merged | 3 | 882dce4f |
| P3.1 | merged | 1 | 94e24118 |
| P3.2 | merged | 1 | 1c4bba05 |
| P3.3 | merged | 1 | 20d520d0 |
| P3.4a | merged | 1 | e56a921 |
| P3.4b | merged | 1 | e56a921 |
| P3.5 | merged | 1 | e56a921 |
| P4.1 | merged | 1 | 734c00f |
| P4.2 | done | 1 | cf39589 |
| P4.3 | done | 1 | d8b7a7b |
| P4.4 | done | 1 | e2a5150 |
| P4.5 | done | 1 | 0a6fa65 |
| P4.6 | done | 1 | aea3d62 |
| P5.1 | done | 1 | afec94a |
| P5.2 | done | 1 | a1f13c4 |
| P5.3 | done | 1 | dc6908d |
| P6.1 | done | 1 | eef3d5c |

P4.2 onward is implemented directly in-session on `distribution-plan` (flow
harness retired). The sN→iN sx lang migration landed as `6c19f10`. P4.3
(token security, subplan 02 Slice 5) → `d8b7a7b`; P4.4 (bearer auth + write
endpoints, 04 Slice 2 + write half of 3/4) → `e2a5150`; P4.5 (remote
publish, 03 Slice 3) → `0a6fa65`; P4.6 (install pages + iOS modes, 04
Slice 5) → `aea3d62`. `make test` is 19/19 green at HEAD. The PLAN.md CI
contract works end-to-end against a running distd, and install pages
honor the iOS Install Policy (artifact_only / testflight / enterprise OTA
manifest). sx issue 0098 (enum literal into optional target lowers to
variant 0) bit `ua_platform`; worked around via typed locals — the sx-side
fix is still tracked as a separate followup. P5.1 → `afec94a`: SQLite
3.53.2 is VENDORED (vendor/sqlite/, API renamed dist_sqlite3_* so the
JIT's dlsym(RTLD_DEFAULT) can never bind the OS copy) with sx bindings in
src/db/sqlite.sx — SQLite is no longer blocked. The bindings then adopted
honest C integer widths (`3747c40`, 21/21 green). P5.2 → `a1f13c4`: the
store persists to `<store>/dist.db` (schema + whole-model save/load in
src/repo/db.sx, BEGIN IMMEDIATE transactions, busy_timeout for CLI/distd
interleaving); a pre-SQLite db.json imports once on first load (renamed
db.json.imported); consumers gate on `db.store_exists`; every test that
parsed db.json now queries dist.db through the bindings, plus new pinned
tests db_import.sx and the SQLite repo_roundtrip.sx. `make test` is 22/22
green at HEAD. En route, sx issue 0130 (`#library` behind two aliased
imports dropped from link/dlopen) was filed AND fixed in the sx repo
(`d739c5b`, examples/1617 regression). P5.3 → `dc6908d` (02 Slice 4,
closing subplan 02): `Channel.retention_keep` (0 = keep everything, N =
keep the newest N published lineage releases) set via `dist channel set`;
`dist store cleanup` prunes lineage-expired releases (never one ANY
channel points at — cross-promoted releases survive), GCs unreferenced
objects/ blobs, sweeps stale staging/ files, one audit event per deletion,
model saved before any unlink. En route it fixed repo.publish silently
resetting an existing channel's policy/rollout/retention on every publish
(pinned in tests/retention_cleanup.sx, which fails on the pre-fix code).
cleanup.sx carries a local opendir/readdir/closedir FFI shim — std.fs
still has no directory listing (sx wishlist). P6.1 → `eef3d5c` (subplan
06, first slice): the read-only admin console at /admin, server-rendered
from src/server/admin.sx exactly like the index/install pages (sx
strings, no client framework): apps overview, app detail (channels with
policy/rollout/retention, releases newest-first), release detail
(validation chips, serving channels, audit timeline), tokens (lifecycle
status, never secret material), audit log. Reads public per v0; writes
stay on the token-gated POSTs. The root-level index.html/styles.css/
app.js mock (rejected design, flow-harness era) is SUPERSEDED by the
real console — delete when convenient. `make test` is 24/24 green at
HEAD. Remaining for Milestone 1: admin UI actions/iteration (06),
Docker/UGREEN packaging (07, still blocked on sx Linux targets).