[justinjoy]

Fixes #2287.

Summary

With WIRELOG_JOIN_BATCH_BYTES=224 in the environment, three test binaries aborted.

Test	Abort site
join_spill	tests/test_join_spill.c:1133
session_cold_relation	tests/test_session_cold_relation.c:156
wirelog_advanced_spill	tests/test_wirelog_advanced_spill.c:173

wirelog_advanced_spill is not named in #2287. It comes from 280c21f and fails the same way, through the public seal call.

The session reads the knob from the environment when it is created. A nonzero batch size has two effects:

• it turns off spill JOIN selection (wirelog/columnar/join.c);
• it makes wl_columnar_session_cold_mode false, so sealing is refused.

docs/MEMORY.md documents both: the knob takes precedence, and competing JOIN batch modes are refused. So the fixtures failed under the knob by design. This is the same class as #2262 (6d74992).

Change (test-only)

• Each main() clears WIRELOG_JOIN_BATCH_BYTES and WIRELOG_JOIN_BATCH_STRICT before the first session exists.
  • The two internal tests use the _putenv_s shim from 6d74992 for MSVC.
  • wirelog_advanced_spill uses its existing environment() helper.
• The knob cases in join_spill and session_cold_relation set the session fields directly, so this change does not affect them.
• Under the knob, these binaries now show that they ignore the environment. They do not run their fixtures in batch mode.
• New meson entries *_join_batch_env run each binary with WIRELOG_JOIN_BATCH_BYTES=224. They aborted at the lines above before the change and pass after it.
  • CI's TSan legs run them too, because those legs run meson test without a suite filter.
• Clearing _STRICT is defensive: the session ignores it unless the byte count is set, so no test distinguishes it.

Validation

On bf0c978, then re-checked after rebasing onto 3ac18bc with an identical patch. The final rebase onto 81f244c is covered under "Rebase onto 81f244c" below.

Check	Result
Release, 6 entries	6/6
ASan, 6 entries	6/6
TSan debug (--timeout-multiplier 4), 6 entries	6/6
Full release suite	480 ok / 0 fail / 14 skip
Full suite with WIRELOG_JOIN_BATCH_BYTES=224	480 ok / 0 fail / 14 skip (3 failures before)
uncrustify on the three touched test files	pass

Mutants, built in a copy, per file:

• Null mutant: passes.
• Without the BYTES clear: aborts.
• Without the STRICT clear: survives. This is expected, because that line is defensive.

Review

• An independent Reviewer, the Architect and the Critic approved tree 49ab3778. The rebased commit carries the same patch.
• The Reviewer also confirmed with an LD_PRELOAD no-op unsetenv that the clears are what make the binaries pass.
• Non-blocking: the _WIN32 unsetenv shim now exists in three test files.

Second commit: public header doc

wirelog/wirelog-advanced.h did not mention WIRELOG_JOIN_BATCH_BYTES. This commit documents it.

• Options block: the session reads the knob when it is created.
  • It is on when its whole value parses as a nonzero base-10 integer the way strtoull() reads it. Leading whitespace and a sign are accepted, so "-1" turns it on.
  • An empty value, "0", "0x10", "5x", "abc" and out-of-range values leave it off.
  • When it is on, the session selects no spill JOIN even with positive join caps, and wirelog_session_seal_join_input() returns WIRELOG_ERR_EXEC.
  • Changing the environment after creation does not affect an existing session.
• Seal block: names the knob among the eligibility conditions, and says this refusal lasts for the session's lifetime.
• No runtime change.

test_wirelog_advanced_spill gains join_batch_knob, which uses the public API only. It checks:

• the off values above: the seal succeeds;
• "4096", " 5" and "-1": WIRELOG_ERR_EXEC, with no spill file open;
• clearing the environment after creation does not change a refused session;
• the source of a refused session still accepts insert and remove, and its snapshot is unchanged;
• a session created with the knob unset still seals after the variable is set.

Validation:

Check	Result
Release, ASan, TSan x4, 6 entries	6/6 each
Full release suite	480/0/14
Knob gate	480/0/14
check-advanced-header, doxygen headers, uncrustify, git diff --check	pass

• Red first: written to expect WIRELOG_OK with the knob on, the new case aborted at :443.
• Library mutants, built in a copy:
  • Dropping the knob condition from cold_mode makes the test abort.
  • Dropping the ERANGE check makes the test abort, once the out-of-range value was added on the Reviewer's finding.

An independent Reviewer, a fresh re-Reviewer, the Architect and the Critic approved tree b6e28ea7.

Rebase onto 81f244c

Main added sealed-input projection/filter support, which conflicted in three places. The conflicts were resolved by hand:

• tests/test_session_cold_relation.c: the knob clear stays the first statement of main(), before main's new session-creating calls.
• tests/test_wirelog_advanced_spill.c: join_batch_knob() runs after main's new mixed_projection() and unsupported_filters().
• wirelog/wirelog-advanced.h: main's rewritten seal eligibility paragraph is kept, and the knob condition is its own sentence after it.

After the rebase, all gates were rerun on 81f244c (rel/ASan/TSan x4 6/6, full release suite 480/0/14, knob gate 480/0/14, header gates, uncrustify). An independent Reviewer approved the conflict resolution and then the follow-up wording fix (tree 130f4466).