Consensys-Incorporated · grypez · Aug 5, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 14, 2026
@@ -252,7 +252,6 @@ test.describe('Control Panel', () => {
       `{"key":"v3.c.o+0","value":"${v3Root}"}`,
       `{"key":"v3.c.${v3Promise}","value":"R p-1"}`,
       `{"key":"v3.c.p-1","value":"${v3Promise}"}`,
-      `{"key":"${v3Root}.refCount","value":"1,1"}`,
       `{"key":"${v3Promise}.refCount","value":"2"}`,
     ];
     // Derived too: v1 imports the two roots as the bootstrap's calls are

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- The kernel worker gives the kernel store a logger, so the wasm SQLite driver's diagnostics — including the transaction aborts it reports on the kernel's dying path — reach the log rather than nowhere ([#1021](https://github.com/MetaMask/ocap-kernel/pull/1021))
 - Process platform-services RPC request handlers in the background so a request handler that fires a reentrant outbound RPC (e.g. transport handshake calling back into the kernel) cannot deadlock waiting for its response ([#948](https://github.com/MetaMask/ocap-kernel/pull/948))
 
 ## [0.6.0]

@@ -44,7 +44,10 @@ async function main(): Promise<void> {
         isJsonRpcMessage,
       ),
       PlatformServicesClient.make(globalThis as PostMessageTarget),
-      makeSQLKernelDatabase({ dbFilename: DB_FILENAME }),
+      makeSQLKernelDatabase({
+        dbFilename: DB_FILENAME,
+        logger: logger.subLogger({ tags: ['kernel-store'] }),
+      }),
     ]);
 
   setupConsoleForwarding({

@@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- `makeKernel` gives the kernel store a logger, so the SQLite driver's diagnostics — including the transaction aborts it reports on the kernel's dying path — reach the log rather than nowhere ([#1021](https://github.com/MetaMask/ocap-kernel/pull/1021))
 - The RPC socket server refuses to bind a Unix socket that has a live listener, rather than unlinking it and orphaning the previous owner; stale socket files with no listener are still cleaned up automatically ([#952](https://github.com/MetaMask/ocap-kernel/pull/952))
 
 ## [0.1.0]

@@ -1,3 +1,5 @@
+import { makeSQLKernelDatabase } from '@metamask/kernel-store/sqlite/nodejs';
+import { Logger } from '@metamask/logger';
 import { Kernel } from '@metamask/ocap-kernel';
 import { describe, expect, it, vi } from 'vitest';
 
@@ -8,7 +10,9 @@ vi.mock('@metamask/kernel-store/sqlite/nodejs', async () => {
     '../../../ocap-kernel/test/storage.ts'
   );
   return {
-    makeSQLKernelDatabase: makeMapKernelDatabase,
+    // Wrapped so that a test can see what the database was constructed with,
+    // while still getting a real store back.
+    makeSQLKernelDatabase: vi.fn(makeMapKernelDatabase),
   };
 });
 
@@ -18,4 +22,19 @@ describe('makeKernel', () => {
 
     expect(kernel).toBeInstanceOf(Kernel);
   });
+
+  // FAILING REPRO.
+  //
+  // The kernel store is the only collaborator `makeKernel` builds without
+  // handing it a logger, so every `logger?.` call inside the SQLite driver is
+  // dead code in production — including the four abort failures #1012 added
+  // logging for. `kernel-worker.ts` omits it too, which keeps the wasm driver's
+  // pair dead even once this passes.
+  it('gives the kernel store a logger', async () => {
+    await makeKernel({});
+
+    expect(vi.mocked(makeSQLKernelDatabase)).toHaveBeenCalledWith(
+      expect.objectContaining({ logger: expect.any(Logger) }),
+    );
+  });
 });
@@ -60,7 +60,10 @@ export async function makeKernel({
   });
 
   // Initialize kernel store.
-  const kernelDatabase = await makeSQLKernelDatabase({ dbFilename });
+  const kernelDatabase = await makeSQLKernelDatabase({
+    dbFilename,
+    logger: rootLogger.subLogger({ tags: ['kernel-store'] }),
+  });
 
   // Create and start kernel.
   const kernel = await Kernel.make(platformServicesClient, kernelDatabase, {

@@ -12,6 +12,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `rollbackSavepoint` discards the enclosing transaction when `ROLLBACK TO` itself fails, instead of leaving the savepoint on its stack and the transaction open ([#1005](https://github.com/MetaMask/ocap-kernel/pull/1005))
   - Nothing would ever commit or abort that transaction, so every later write on the connection silently joined it, reported success, and vanished on close. Discarding it is no wider than the caller asked for: the transaction begins with the outermost savepoint, so it holds only the work the rollback was abandoning
   - The rollback failure is still what gets thrown, even if aborting the transaction fails too
+- `releaseSavepoint` discards the enclosing transaction when `RELEASE` fails, as `rollbackSavepoint` already did for `ROLLBACK TO` ([#1021](https://github.com/MetaMask/ocap-kernel/pull/1021))
+  - Otherwise the savepoint stayed on the stack and the transaction open with nothing left to commit or abort it. The release failure is still what gets thrown
+- The wasm driver clears `_inTx` when aborting or committing a transaction throws, instead of believing it is still in one ([#1021](https://github.com/MetaMask/ocap-kernel/pull/1021))
+  - Left true, `beginIfNeeded` became a permanent no-op and later writes autocommitted — including the next savepoint, which was then created bare, where its `RELEASE` commits and no rollback could undo the delivery. The nodejs driver reads `db.inTransaction` and was never affected
+- An abort that fails while recovering from a failed savepoint operation is now logged in both drivers ([#1021](https://github.com/MetaMask/ocap-kernel/pull/1021))
 
 ## [0.6.0]
 

@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest';
+
+import { makeSQLKernelDatabase } from './nodejs.ts';
+
+/**
+ * `KernelQueue.#runLoop` calls releasing its `crank` savepoint "this crank's one
+ * commit point", on the grounds that only `delivery` is ever rolled back.
+ *
+ * `releaseAllSavepoints` releases `t0`, which is the outermost savepoint only if
+ * the crank opened the first one. Two production paths open savepoints through
+ * `KernelStore.createSavepoint`, which bypasses `ctx.savepoints` and so is
+ * invisible to the ordinal numbering: `RemoteHandle.handleRemoteMessage` (held
+ * across its `await this.#handleRedeemURLRequest(...)`) and
+ * `RemoteManager.#handlePeerIncarnation`. Neither waits for the crank, and the
+ * remote message handler is installed in `Kernel.#init` as a bare async callback,
+ * so all three orderings below are reachable while the run loop sits in
+ * `await deliver(queueItem)`.
+ *
+ * Real SQLite through the real driver: these are the savepoint semantics, not a
+ * mock's idea of them.
+ */
+describe('a savepoint the crank does not know about', () => {
+  it('outside the crank, leaves the crank release with nothing to commit', async () => {
+    const kdb = await makeSQLKernelDatabase({ dbFilename: ':memory:' });
+    const kv = kdb.kernelKVStore;
+
+    // RemoteHandle.handleRemoteMessage, parked on its await.
+    kdb.createSavepoint('receive_r1_7');
+
+    // The run loop wakes: startCrank, then the two crank savepoints.
+    kdb.createSavepoint('t0');
+    kdb.createSavepoint('t1');
+    kv.set('crankWrite', 'durable');
+
+    // endCrank -> releaseAllSavepoints -> releaseSavepoint('t0'). `t0` is not the
+    // outermost savepoint, so this releases into the remote's, not to a commit.
+    kdb.releaseSavepoint('t0');
+
+    // The remote message then fails, so RemoteHandle rolls its savepoint back.
+    kdb.rollbackSavepoint('receive_r1_7');
+
+    // If releasing `crank` were a commit point, the crank would have survived.
+    expect(kv.get('crankWrite')).toBe('durable');
+    kdb.close();
+  });
+
+  it('inside the crank, is destroyed by the delivery rollback behind its owner', async () => {
+    const kdb = await makeSQLKernelDatabase({ dbFilename: ':memory:' });
+    const kv = kdb.kernelKVStore;
+
+    // startCrank
+    kdb.createSavepoint('t0');
+    kdb.createSavepoint('t1');
+
+    // A remote message arrives during `await deliver(queueItem)`.
+    kdb.createSavepoint('receive_r1_7');
+    kv.set('remoteSeq.r1.highestReceivedSeq', '7');
+
+    // The delivery aborts: rollbackCrank('delivery') issues ROLLBACK TO t1, and
+    // SQLite cancels every savepoint started after t1 -- including the remote's.
+    kdb.rollbackSavepoint('t1');
+
+    // The remote handler, still inside its own try, reaches its release.
+    expect(() => kdb.releaseSavepoint('receive_r1_7')).not.toThrow();
+    kdb.close();
+  });
+
+  it('inside a crank that succeeds, is committed under its owner', async () => {
+    const kdb = await makeSQLKernelDatabase({ dbFilename: ':memory:' });
+    const kv = kdb.kernelKVStore;
+
+    // startCrank
+    kdb.createSavepoint('t0');
+    kdb.createSavepoint('t1');
+
+    // A remote message arrives and gets as far as its await, so the seq row it
+    // writes "at the end, within the transaction" is not written yet.
+    kdb.createSavepoint('receive_r1_7');
+    kv.set('remoteHalfDone', 'yes');
+
+    // endCrank releases t0, and with it everything stacked above.
+    kdb.releaseSavepoint('t0');
+
+    // The remote handler resumes and tries to commit its own savepoint. Whatever
+    // it decides, its half-finished work is already durable -- and it will report
+    // failure, leaving the peer to retry an effect that has landed.
+    expect(() => kdb.releaseSavepoint('receive_r1_7')).not.toThrow();
+    expect(kv.get('remoteHalfDone')).toBe('yes');
+    kdb.close();
+  });
+});
@@ -360,6 +360,45 @@ describe('makeSQLKernelDatabase', () => {
       expect(mockDb._spStack).toStrictEqual([]);
     });
 
+    // The hazard `rollbackSavepoint` guards against, by the other door.
+    it('releaseSavepoint discards the transaction when the release fails', async () => {
+      const db = await makeSQLKernelDatabase({});
+      mockDb.inTransaction = true;
+      mockDb._spStack = ['point1'];
+      mockStatement.run.mockClear();
+      mockDb.exec.mockImplementationOnce(() => {
+        throw new Error('disk I/O error');
+      });
+
+      expect(() => db.releaseSavepoint('point1')).toThrowError(
+        'disk I/O error',
+      );
+
+      expect(mockDb._spStack).toStrictEqual([]);
+      // The abort is the only prepared statement this path runs.
+      expect(mockStatement.run).toHaveBeenCalledOnce();
+      mockDb.inTransaction = false;
+    });
+
+    it('releaseSavepoint reports the release failure even if the abort fails too', async () => {
+      const db = await makeSQLKernelDatabase({});
+      mockDb.inTransaction = true;
+      mockDb._spStack = ['point1'];
+      mockDb.exec.mockImplementationOnce(() => {
+        throw new Error('disk I/O error');
+      });
+      mockStatement.run.mockImplementationOnce(() => {
+        throw new Error('cannot rollback');
+      });
+
+      expect(() => db.releaseSavepoint('point1')).toThrowError(
+        'disk I/O error',
+      );
+
+      expect(mockDb._spStack).toStrictEqual([]);
+      mockDb.inTransaction = false;
+    });
+
     it('supports nested savepoints', async () => {
       const db = await makeSQLKernelDatabase({});
       db.createSavepoint('outer');

@@ -0,0 +1,112 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+import { makeSQLKernelDatabase } from './nodejs.ts';
+
+/**
+ * Two invariants the crank layer relies on:
+ *
+ * - a failed `ROLLBACK TO` discards the whole transaction, so truncating
+ *   `ctx.savepoints` to zero still matches the database;
+ * - `commitIfNeeded` leaves no transaction behind.
+ *
+ * Both drivers catch and log an abort that fails while discarding a transaction,
+ * so "the whole transaction is discarded" holds only when that abort succeeds.
+ * This driver has no `_inTx` flag, reading `db.inTransaction` from SQLite
+ * instead, which prevents a wedged flag but does not end an ownerless
+ * transaction.
+ */
+
+/** Every statement and exec call, in order. */
+let issued: string[] = [];
+/** SQL that throws when next run. */
+let failOnce: Set<string> = new Set();
+
+const makeStatement = (text: string): Record<string, unknown> => ({
+  run: () => {
+    issued.push(text);
+    if (failOnce.delete(text)) {
+      throw new Error(`SQLITE_IOERR: ${text}`);
+    }
+    return undefined;
+  },
+  get: () => undefined,
+  all: () => [],
+  pluck: () => undefined,
+  iterate: () => [],
+});
+
+const mockDb = {
+  prepare: vi.fn((text: string) => makeStatement(text)),
+  transaction: vi.fn((fn: () => void) => fn),
+  exec: vi.fn((text: string) => {
+    issued.push(text);
+    if (failOnce.delete(text)) {
+      throw new Error(`SQLITE_IOERR: ${text}`);
+    }
+  }),
+  inTransaction: false,
+  _spStack: [] as string[],
+  close: vi.fn(),
+};
+
+vi.mock('better-sqlite3', () => ({
+  default: vi.fn(function () {
+    return mockDb;
+  }),
+}));
+vi.mock('node:fs/promises', () => ({ mkdir: vi.fn() }));
+vi.mock('node:os', () => ({ tmpdir: vi.fn(() => '/mock-tmpdir') }));
+
+describe('the nodejs driver after a failure it tolerates', () => {
+  beforeEach(() => {
+    issued = [];
+    failOnce = new Set();
+    mockDb.inTransaction = false;
+    mockDb._spStack = [];
+  });
+
+  it('discards the transaction when the rollback fails and the abort fails too', async () => {
+    const kdb = await makeSQLKernelDatabase({});
+    // A crank in progress: SAVEPOINT t0, SAVEPOINT t1.
+    mockDb.inTransaction = true;
+    mockDb._spStack = ['t0', 't1'];
+    issued = [];
+
+    // The disk fills. `ROLLBACK TO SAVEPOINT t1` fails, and so does the
+    // `ROLLBACK TRANSACTION` meant to discard the transaction instead. The driver
+    // logs that second failure and carries on, so SQLite is still in a
+    // transaction with t0 and t1 on its stack.
+    failOnce.add('ROLLBACK TO SAVEPOINT t1');
+    failOnce.add('ROLLBACK TRANSACTION');
+    expect(() => kdb.rollbackSavepoint('t1')).toThrow('SQLITE_IOERR');
+    expect(mockDb._spStack).toStrictEqual([]);
+
+    // `_spStack` now says "no savepoints, nothing to commit or abort" while
+    // SQLite says otherwise. Teardown still runs after the run loop dies --
+    // `reset`, a peer incarnation change, a remote message -- and takes a
+    // savepoint.
+    issued = [];
+    kdb.createSavepoint('teardown');
+    kdb.releaseSavepoint('teardown');
+
+    // `beginIfNeeded` saw `inTransaction` and skipped BEGIN, so `teardown` was
+    // created inside the transaction that was supposed to be gone, and releasing
+    // it committed that transaction whole -- the abandoned crank included.
+    expect(issued).not.toContain('COMMIT TRANSACTION');
+  });
+
+  it('discards the transaction when the commit fails', async () => {
+    const kdb = await makeSQLKernelDatabase({});
+    mockDb.inTransaction = true;
+    mockDb._spStack = ['t0'];
+    issued = [];
+
+    // endCrank: RELEASE SAVEPOINT t0 succeeds, the COMMIT it triggers does not.
+    failOnce.add('COMMIT TRANSACTION');
+    expect(() => kdb.releaseSavepoint('t0')).toThrow('SQLITE_IOERR');
+
+    // A failed COMMIT can leave the transaction open, and `_spStack` was already
+    // spliced empty. Nothing here ends it.
+    expect(issued).toContain('ROLLBACK TRANSACTION');
+  });
+});
@@ -298,8 +298,14 @@ export async function makeSQLKernelDatabase({
       db._spStack.length = 0;
       try {
         rollbackIfNeeded();
-      } catch {
-        // The rollback failure below is the one worth reporting.
+      } catch (abortError) {
+        // The rollback failure below is the one worth reporting, but a failed
+        // abort leaves SQLite holding a transaction the next crank would
+        // silently write into. Nothing here can repair that.
+        logger?.error(
+          'failed to discard transaction after rollback',
+          abortError,
+        );
       }
       throw error;
     }
@@ -321,7 +327,28 @@ export async function makeSQLKernelDatabase({
       throw new Error(`No such savepoint: ${name}`);
     }
     const query = SQL_QUERIES.RELEASE_SAVEPOINT.replace('%NAME%', name);
-    db.exec(query);
+    try {
+      db.exec(query);
+    } catch (error) {
+      // The hazard `rollbackSavepoint` guards against, by the other door: left as
+      // it was, the savepoint stays on the stack and the transaction open with
+      // nothing to ever commit or abort it, so every later write on this
+      // connection joins it, reports success, and vanishes on close. There is no
+      // committing this transaction now, so discard it.
+      db._spStack.length = 0;
+      try {
+        rollbackIfNeeded();
+      } catch (abortError) {
+        // The release failure below is the one worth reporting, but a failed
+        // abort leaves SQLite holding a transaction the next crank would
+        // silently write into. Nothing here can repair that.
+        logger?.error(
+          'failed to discard transaction after release',
+          abortError,
+        );
+      }
+      throw error;
+    }
     db._spStack.splice(idx);
     if (db._spStack.length === 0) {
       commitIfNeeded();