sqlite/sqlite2026-08-01method 2.0
Rust adoption decisionRust 采用决策 · C · embedded SQL engine · 182,029 lines of core C, 1,021,321 lines of in-repo testsC · 嵌入式 SQL 引擎 · 核心 C 代码 182,029 行，仓库内测试 1,021,321 行
STAY
keep the C engine; the verification programme is what actually ships保留 C 引擎；真正交付出去的是那套验证体系
Authorization授权 · REJECT

Gates 1 and 2 pass. SQLite is C that parses untrusted SQL and untrusted database files, and Rust would remove that defect class from any line it replaced. Gates 3 and 4 fail. Behind those 182,029 lines of C sit 100% branch and MC/DC coverage and 590 times as much test material as source. There is also a written promise: the C API and on-disk format stay backwards compatible through 2050. That is the asset. A rewrite inherits the source and none of it.G1 与 G2 通过。SQLite 用 C 解析不受信任的 SQL 和不受信任的数据库文件，Rust 换掉哪一行，就在那一行消灭这类缺陷。G3 与 G4 不通过。这 182,029 行 C 背后，是 100% 分支与 MC/DC 覆盖，以及 590 倍于源码的测试材料。还有一份书面承诺：C API 与磁盘格式向后兼容到 2050 年。资产就是这些东西。重写继承得到源码，这些一样都拿不到。

Stable. This flips only when a Rust engine shows equivalent verification: 100% MC/DC on its own core, plus byte-identical on-disk behaviour. Even then the question for consumers is whether to adopt it. The SQLite project still would not be rewriting anything.判断稳定。只有当某个 Rust 引擎拿出对等的验证证据——自己内核上 100% MC/DC，加上字节级一致的磁盘行为——这个结论才会翻。就算那天到了，使用方要决定的也只是采不采用。SQLite 项目仍然不必重写任何东西。

Scope范围 keep the C core; consumers who want Rust adopt an existing Rust engine保留 C 内核；想要 Rust 的使用方去采用现成的 Rust 引擎 Confidence置信度 HIGH Robustness稳健性 STABLE security-parser · embedded library with a 2050 compatibility promise安全解析器 · 承诺兼容到 2050 年的嵌入式库
Test code per line of source每行源码对应的测试代码
590××
sqlite.org/testing.html · 155.8 vs 92,053.1 KSLOCsqlite.org/testing.html · 155.8 对 92,053.1 KSLOC
Branch and MC/DC coverage分支与 MC/DC 覆盖率
100%%
TH3 harness on the core, measured with gcovTH3 在内核上运行，用 gcov 测量
In-repo test material仓库内的测试材料
1,021,321lines行
test/ · 1,294 tracked files, this committest/ · 本次提交，1,294 个受控文件
Core C measured here此处测得的核心 C
182,029lines行
src/ excluding test harness · 102 filessrc/ 排除测试脚手架 · 102 个文件
Compatibility horizon兼容承诺的期限
2050year年
written C-API and on-disk format promiseC API 与磁盘格式的书面承诺
Rust engine already shipped已经在跑的 Rust 引擎
23.6kstarsstars
tursodatabase/turso · ground-up rewrite, pre-1.0tursodatabase/turso · 从零重写，pre-1.0

01The options备选方案

Every option answers the same objective: remove the memory-unsafety class from SQL and database-file parsing without weakening the assurance level SQLite currently ships.每个方案对的都是同一个目标：在不削弱 SQLite 现有保证水平的前提下，从 SQL 与数据库文件解析中消除内存不安全这一类缺陷。

Option方案Scope范围Benefit收益Cost成本Time to value见效时间Compatibility / rollback兼容 / 回滚Evidence证据
Keep C + the verification programme保留 C 与那套验证体系recommended · the assurance is the product推荐 · 保证水平本身就是产品STAYclass remains possible, incidence held very low缺陷类仍然可能出现，发生率压得很低none new; existing test + fuzz budget无新增；沿用现有测试与 fuzz 预算in effect today今天已经生效native · nothing to roll back原生 · 没有东西需要回滚STRONG
Consumers adopt a Rust engine使用方改用 Rust 引擎retain · the answer for callers who want Rust保留 · 想要 Rust 的调用方该走这条ADOPTclass removed for that consumer这一缺陷类在该使用方处消失per consumer; pre-1.0 dependency每个使用方各付各的；依赖一个 pre-1.0 项目days per project每个项目几天SQLite-compatible · caller-side rollbackSQLite 兼容 · 调用方侧可回滚MODERATE
Rust tokenizer/parser behind the C APIC API 背后换成 Rust 词法/语法分析器retain · the only Rust scope worth re-examining later保留 · 以后唯一值得再看一眼的 Rust 范围EXTRACTclass removed in one front-end component一个前端组件内消除这一缺陷类coverage rebuild; second toolchain everywhere覆盖率要重建；处处多一条工具链months数月byte-exact parse behaviour · hard rollback解析行为要字节级一致 · 回滚困难WEAK
Rewrite SQLite in Rust用 Rust 重写 SQLiteexclude · fails G3 and G4排除 · G3、G4 不通过MIGRATEclass removed; assurance level unproven缺陷类消除；保证水平未经证明re-earn 92,053.1 KSLOC of tests; 2050 obligation92,053.1 KSLOC 测试重新挣一遍；还背着 2050 义务years数年whole promise · no rollback整份承诺 · 无法回滚WEAK
Sandbox the engine in the host在宿主里把引擎沙箱化retain · caller-side mitigation the report must present保留 · 调用方侧的缓解手段，报告必须列出ADOPTcontains the class instead of removing it把这一缺陷类圈住，没有消除host-side; boundary overhead宿主侧付出；有边界开销weeks数周unchanged engine · trivial rollback引擎不动 · 回滚很容易MODERATE

02Evidence ledger证据账本

States are option-scoped evidence. They do not add up. Repository line counts come from the commit named in the methodology; published ratios keep their source and date.每条状态都是针对某个方案的证据。它们不能相加。仓库行数来自方法一节写明的提交；引用的比值保留其来源与日期。

D1 · Requirement & ownership需求与归属
SUPPORTS · rust optionsSTRONG
SQLite parses untrusted SQL text and untrusted database files in C. The project funds a dedicated database-file fuzzer against exactly that surface.SQLite 用 C 解析不受信任的 SQL 文本和不受信任的数据库文件。项目专门出钱养了一个针对这块面的数据库文件 fuzzer。
src/tokenize.c · src/btree.c · dbsqlfuzz, ~1e9 mutations/day (sqlite.org/testing.html)
D2 · End-to-end reach端到端影响面
N/ASTRONG
This decision asserts no performance requirement. No Amdahl calculation is performed, because the only way to produce one here would be to invent it from line counts.这个决策没有提出任何性能要求。因此不做 Amdahl 计算——真要做，只能拿行数硬凑一个出来。
objective is safety, not latency
D3 · Tail & runtime尾延迟与运行时
N/ASTRONG
There is no managed runtime or collector in the engine, so no runtime mechanism exists in any tail to remove.引擎里没有托管运行时，也没有回收器，尾部就没有可以拿掉的运行时机制。
C library, no GC
D4 · Fleet footprint机队占用
N/ASTRONG
The engine runs inside the caller's process; this decision changes no fleet density.引擎跑在调用方进程里，这个决策不改变任何机队密度。
embedded linkage model
D5 · Startup shape启动形态
N/ASTRONG
Library initialization is not a stated constraint for any consumer in this decision.这个决策里没有任何使用方把库的初始化列为约束。
no startup requirement asserted
D6 · Safety & correctness安全与正确性
SUPPORTS · rust optionsSTRONG
Replacing manual-lifetime C removes the memory-unsafety class from whatever it replaces. That much is causal. No benchmark needed.把手工管理生命周期的 C 换掉，换掉多少，就在多少代码里消除内存不安全这一类缺陷。这一步是因果关系。不需要跑基准。
language property, applied at the scope of each option
D7 · Concurrency & invariants并发与不变量
NEUTRAL · allMODERATE
Concurrency is governed by file locking and WAL semantics that every option must reproduce identically; no option is better placed to encode them.并发由文件锁和 WAL 语义决定，每个方案都得原样复现；没有哪个方案在表达这些语义上更占优。
src/pager.c · src/os_unix.c locking model
D8 · Distribution分发
DISFAVORS · rust optionsSTRONG
SQLite's portability claim is that it runs on any platform with an 8-bit byte, 32/64-bit two's-complement integers and a C compiler. A Rust component narrows that set.SQLite 的可移植性主张是：只要平台有 8-bit byte、32/64-bit 二进制补码整数和一个 C 编译器，它就能跑。加一个 Rust 组件，这个集合就变小。
https://www.sqlite.org/lts.html — "Cross-platform Code"
D9 · Ecosystem & alternatives生态与替代品
SUPPORTS · adopt-rust-engineMODERATE
A ground-up Rust engine already exists: SQLite dialect, on-disk format and C-API compatibility, 23.6k stars, reported production use. Consumers who want Rust do not need SQLite to change.从零写的 Rust 引擎已经有了：SQLite 方言、磁盘格式、C API 都对上，23.6k stars，也有生产使用的报告。想要 Rust 的使用方，不需要 SQLite 改任何东西。
https://github.com/tursodatabase/turso — repository README
D10 · Boundary & compatibility边界与兼容
DISFAVORS · rust-fullSTRONG
The compatibility surface has three parts: the C API, the byte-level on-disk format, and legacy behavioural quirks. All three are promised backwards compatible.兼容面有三块：C API、字节级磁盘格式，以及历史遗留的行为怪癖。三块都写进了向后兼容的承诺。
https://www.sqlite.org/lts.html — API and on-disk format promise
D11 · Delivery economics交付经济性
DISFAVORS · rust-fullSTRONG
The verification programme is the majority of the project's cost: 92,053.1 KSLOC of test material, 100% branch and MC/DC coverage, and roughly one billion daily fuzz mutations. None of it transfers to a new implementation.验证体系占了项目成本的大头：92,053.1 KSLOC 测试材料、100% 分支与 MC/DC 覆盖、每天约十亿次 fuzz 变异。换一套实现，这些一样都带不走。
https://www.sqlite.org/testing.html · in-repo test/ measured at 1,021,321 lines
D12 · Counterfactual反事实对照
SUPPORTS · stay-verified, sandboxSTRONG
The current-stack answer is funded and already running at unusual intensity. Callers exposed to untrusted database files can isolate the engine without any language change.现有技术栈这条路已经有人出钱，而且强度很不寻常。要面对不受信任数据库文件的调用方，不换语言也能把引擎隔离起来。
dbsqlfuzz + TH3 + 51,445 TCL cases (sqlite.org/testing.html); host-side sandboxing

Three lenses are N/A: D3 tail latency, D4 fleet footprint, D5 startup shape. The engine links into the caller's process and carries no runtime of its own. None of them bears on memory safety.三个维度记为 N/A：D3 尾延迟、D4 机队占用、D5 启动形态。引擎链进调用方进程，自己没有运行时。这三条都够不着内存安全。

03What decided it决定性证据

The asset is the verification, not the source资产是那套验证体系，不是源码

SQLite reports 155.8 KSLOC of library code against 92,053.1 KSLOC of test code and scripts, with 100% branch and MC/DC coverage on the core. A rewrite copies the design. The assurance programme restarts at zero.SQLite 公布的数字是 155.8 KSLOC 库代码，对 92,053.1 KSLOC 测试代码与脚本，内核上分支与 MC/DC 覆盖率 100%。重写能抄走设计。保证体系要从零重来。

sqlite.org/testing.html · 590× ratio, 2023 figures onward

This commit alone carries 1,021,321 lines of tests光这一个提交就带着 1,021,321 行测试

Exclude the proprietary MC/DC harness and the public tree still ships 5.6 lines of test material for every line of core C. That ratio is what a rewrite proposal has to price. None has.把闭源的 MC/DC 脚手架排除在外，公开代码树里每一行核心 C 仍然配着 5.6 行测试材料。这个比值是重写提案必须先报价的东西。目前没有一份报过。

test/ · 1,294 tracked files vs src/ 182,029 lines

The 2050 promise is in writing2050 年那份承诺是白纸黑字

The project promises the C API and on-disk format stay fully backwards compatible, and plans support through 2050. Re-implementing that promise has no rollback. The installed base is already holding the files.项目承诺 C API 与磁盘格式保持完全向后兼容，并计划支持到 2050 年。重新实现这份承诺没有回滚路径。文件已经在装机量手里了。

sqlite.org/lts.html · API and on-disk format commitment

The Rust version already exists, and says what it still lacksRust 版本已经存在，也说了自己还差什么

A ground-up Rust engine with dialect, format and C-API compatibility has 23.6k stars and reports production deployments. Its own README says compatibility is not yet complete. Completing it is a prerequisite for 1.0. That is the adoption path for callers who want Rust.有一个从零写起的 Rust 引擎，方言、格式、C API 都对齐，23.6k stars，也有生产部署的报告。它自己的 README 写着兼容性还没做完。做完是 1.0 的前置条件。想要 Rust 的调用方，走的就是这条采用路径。

github.com/tursodatabase/turso · 18,966 commits, pre-1.0

The safety requirement here holds up这里的安全需求是站得住的

SQLite parses untrusted SQL and untrusted database files in C, and funds a fuzzer at roughly one billion mutations per day against that surface. Gates 1 and 2 pass. The rewrite loses on gates 3 and 4, not on the premise.SQLite 用 C 解析不受信任的 SQL 和不受信任的数据库文件，并出钱在这块面上跑每天约十亿次变异的 fuzzer。G1 与 G2 通过。重写栽在 G3 和 G4 上，前提本身没问题。

src/tokenize.c · src/btree.c · dbsqlfuzz

04What Rust buys here, and what it doesn'tRust 在这里买得到什么，买不到什么

Buys买得到

  • Class elimination in whatever it replaces换到哪里，哪里就没有这一类缺陷 — any Rust component stops being able to produce a memory-unsafety defect in its own code.Rust 组件在自己这段代码里，不再可能产出内存不安全缺陷。
  • A viable path for callers调用方有一条走得通的路 — an application that needs a memory-safe embedded engine can adopt one today without SQLite changing.需要内存安全嵌入式引擎的应用，今天就能采用一个，SQLite 不用改。
  • A defensible future extraction将来抽一块出来，说得过去 — if a Rust front-end component ever reaches equivalent coverage, the tokenizer/parser is the seam with the smallest compatibility share.如果哪天某个 Rust 前端组件做到对等覆盖率，词法/语法分析器是兼容面占比最小的那道缝。

Doesn't buy买不到

  • Any of the existing assurance现有的保证水平，一点也买不到 — 100% MC/DC coverage, 51,445 TCL cases and roughly one billion daily fuzz mutations, all published at sqlite.org/testing.html. Those attach to the current implementation, not to the language.100% MC/DC 覆盖、51,445 个 TCL 用例、每天约十亿次 fuzz 变异，数字都公布在 sqlite.org/testing.html。它们长在当前这份实现上，跟语言无关。
  • Freedom from the compatibility promise从兼容承诺里脱身 — the C API, the byte-level format and the legacy quirks are the contract; a rewrite owes all of it, forever.C API、字节级格式、历史怪癖，这些就是合同。重写全都要背，一直背下去。
  • Protection from the defect classes that dominate here挡住这里真正占多数的缺陷类 — logic, isolation and storage-corruption bugs are what the testing programme mostly hunts, and Rust does not remove them.测试体系主要在抓逻辑、隔离和存储损坏这三类 bug，Rust 不消除它们。

05Who has done this before同型先例

tursodatabase/turso

GREENFIELD

An independent team is rewriting SQLite in Rust from scratch rather than forking it. 18,966 commits, with reported production users. Full SQLite compatibility is the stated prerequisite for 1.0. It is not there yet.一支独立团队在用 Rust 从零重写 SQLite，而不是 fork。18,966 个提交，有生产用户的报告。完整的 SQLite 兼容是它自己写明的 1.0 前置条件。目前还没做到。

matches匹配: identical target, identical language pair, explicit compatibility goal目标相同，语言对相同，兼容目标也写明了 · differs不匹配: a new project choosing its own reliability bar, not the SQLite project accepting a migration这是一个新项目自己定可靠性标准，而非 SQLite 项目接受了一次迁移
third-party · project README

jaq vs jq

ADOPTED

A Rust reimplementation of a widely used C tool arrived from outside the original project, carrying its own test suite and audits. The original's maintainers had nothing to do.一个广泛使用的 C 工具，它的 Rust 重实现是从原项目外面冒出来的，自带测试套件和审计。原项目的维护者什么都不用做。

matches匹配: the ecosystem shipping the Rust option instead of the incumbent rewriting由生态提供 Rust 选项，原项目自己不动手 · differs不匹配: jq's compatibility surface is a CLI, not a byte-level storage format promised to 2050jq 的兼容面是一个 CLI，不是承诺到 2050 年的字节级存储格式
third-party · project README

Mozilla · Servo as Gecko replacement

CANCELLED

A whole-engine replacement was estimated at thousands of engineer-years, against a team of a handful. It was cancelled. The component extractions shipped instead.整机引擎替换的估算是几千工程师年，而团队只有几个人。项目被取消。最后交付的是拆出来的那几个组件。

matches匹配: replacement scope defeated by the size of the existing verified implementation替换范围被现有已验证实现的体量拖垮 · differs不匹配: a browser engine with far more churn than a storage format designed to be frozen浏览器引擎的变动远多于一个设计上就要冻结的存储格式
first-party · engineer account

AWS · S3 ShardStore

MIGRATED

A storage node was rewritten in Rust. The correctness claim came with roughly nine months of dedicated formal-methods work: executable reference models, property tests, Loom. That work caught 16 issues before production.一个存储节点用 Rust 重写。正确性的说法背后是大约九个月专门的形式化方法工作：可执行参考模型、性质测试、Loom。这些工作在上生产前抓出 16 个问题。

matches匹配: shows what assurance a storage rewrite actually costs说明存储系统重写要为保证水平付出多少 · differs不匹配: 40,000 lines with a private interface, not 182,029 lines under a public 2050 promise那是 40,000 行、私有接口；这里是 182,029 行，压着一份到 2050 年的公开承诺
first-party · peer-reviewed paper

06What to do next可逆路径

Say what the requirement actually is先把需求说清楚

The proposer writes down which exposure is unacceptable: untrusted SQL, untrusted database files, or a specific deployment's threat model. The statement passes only if it names a concrete scenario the current assurance programme does not cover. If the answer is 'C is unsafe in general', stop here. That is not a requirement. No codebase has changed yet.提出重写的人写下一份说明：哪一种暴露不能接受——不受信任的 SQL、不受信任的数据库文件，还是某个具体部署的威胁模型。这份说明必须点名一个当前保证体系覆盖不到的具体场景，否则不算过。如果答案是「C 总体上不安全」，到此为止。那不是需求。此时任何代码库都还没动过。

1 day1 天

Contain the exposure at the caller先在调用方把暴露圈住

The application team runs the engine inside a process or wasm sandbox on the untrusted-file paths, and measures the boundary cost. It passes when untrusted files are opened only inside the sandbox and the overhead fits the application's budget. If the boundary cost blows that budget, stop and go back to comparing options. Rolling back is easy. Delete the sandbox; the engine was never modified.应用团队把引擎放进进程沙箱或 wasm 沙箱，专门跑处理不受信任文件的那条路径，并测量边界开销。通过的标准是：不受信任的文件只在沙箱里打开，开销在应用预算之内。开销超预算就停下来，回到方案对比。回滚很轻。删掉沙箱就行，引擎从头到尾没改过。

1–3 weeks1–3 周

Evaluate the existing Rust engine on your own workload拿自己的负载去试现成的 Rust 引擎

Same team, different question. Point the Rust engine at the application's own schemas, queries and existing database files, then write up what matched. Acceptance is byte-level format compatibility and query-result parity across that corpus, with the gaps documented. Any parity failure that touches data integrity ends the evaluation. Reverting is a dependency change. The database files are unchanged by design.还是应用团队，换一个问题。把 Rust 引擎接到应用自己的 schema、查询和现有数据库文件上，再把对得上的部分写成报告。验收看两条：这份语料上的字节级格式兼容，以及查询结果一致；差异逐条记录在案。只要有一处不一致碰到数据完整性，评估就结束。回退只是换回依赖。数据库文件按设计本来就不变。

1–2 weeks1–2 周

Re-open the engine decision only on verification evidence再提这个决策，只看验证证据

Whoever proposes a rewrite next brings a comparison of assurance level, not of language: coverage measured the same way, fuzzing intensity, format-compatibility evidence. Nothing counts until the challenger publishes MC/DC-equivalent coverage on its own core and byte-identical on-disk behaviour. Without that evidence, no proposal proceeds. The C engine and its testing programme continue either way.下一个提重写的人，带来的材料要比保证水平，别比语言：用同样方法测出的覆盖率、fuzz 强度、格式兼容的证据。挑战者不在自己内核上公布与 MC/DC 对等的覆盖率、不给出字节级一致的磁盘行为，就都不算数。拿不出这些证据，提案就不往下走。无论如何，C 引擎和它的测试体系照常运行。

1 day per review每次评审 1 天

07Arguing both sides对称反证

Against migrating反驳「迁移」

PASSEnd-to-end reach端到端影响面 — No performance claim is made. D2 is left N/A rather than filled with a line-share standing in for a time-share.报告没有提出性能主张。D2 保持 N/A，没有拿行数占比冒充时间占比去填。
PASSAttribution归因 — The safety delta is attributed to the language property alone, at the scope of each option, with no redesign credited to Rust.安全收益只归因于语言属性本身，按每个方案各自的范围计算，没有把任何重新设计算到 Rust 头上。
HITBaseline and regime基线与口径 — The 590× ratio counts generated and parameterized test material, so raw line comparisons overstate the gap. The coverage claim is the load-bearing one.590× 这个比值把生成的和参数化的测试材料都算了进去，按原始行数比会夸大差距。真正承重的是覆盖率那一条。
PASSBoundary and compatibility边界与兼容 — The compatibility surface is stated in full: the C API, the byte-level on-disk format, and legacy quirks. An API alone would understate it.兼容面是完整列出来的：C API、字节级磁盘格式、历史怪癖。只说 API 会低估它。
PASSDelivery ownership交付归属 — The report names the missing artifact: MC/DC-equivalent coverage on a challenger core. It does not assert that a rewrite is impossible.报告点名了缺的那份材料：挑战者内核上与 MC/DC 对等的覆盖率。它没有断言重写不可能。

Against staying反驳「不动」

PASSFunded counterfactual有钱在投的反事实对照 — TH3, 51,445 TCL cases and a billion daily fuzz mutations are already funded and running. The staying option is not a hypothetical.TH3、51,445 个 TCL 用例、每天十亿次 fuzz 变异，都已经在花钱、在跑。「不动」这个方案不是假设。
HITCost of inaction不作为的代价 — Staying in C keeps the memory-unsafety class reachable in code that parses attacker-supplied SQL and database files. Testing intensity lowers incidence, not possibility.继续用 C，就意味着在解析攻击者提供的 SQL 和数据库文件的代码里，内存不安全这一类缺陷始终可达。测试强度降低的是发生率，不是可能性。
PASSUnsafe-surface omission遗漏不安全面 — The report grants gates 1 and 2 to the Rust options rather than hiding the unsafe surface behind the project's reputation.报告把 G1 和 G2 判给了 Rust 方案，没有拿项目声誉去挡住那块不安全面。
PASSNative-advantage denial否认原生优势 — The existing Rust engine is recorded as a retained option for consumers, with its own stated pre-1.0 caveats.现成的 Rust 引擎被记为使用方可用的保留方案，并附上它自己声明的 pre-1.0 保留条件。
PASSStop condition停止条件 — The decision has a named reopening condition: published MC/DC-equivalent coverage and byte-identical format behaviour. This is not a permanent veto.这个决策写明了重启条件：公布与 MC/DC 对等的覆盖率，以及字节级一致的格式行为。它不是永久否决。

08How this was produced方法与记录

sqlite/sqlite at f034d51 · static read-only analysis · why-not-rust method 2.0sqlite/sqlite @ f034d51 · 只读静态分析 · why-not-rust 方法 2.0

Repository: github.com/sqlite/sqlite at commit f034d51, shallow clone, 2,221 tracked files. Scope: the whole repository, with the core engine in src/ as the migration candidate. Sampling: tracked files only. src/ holds 47 test-harness files (44 .c translation units plus 3 headers); the 102 files left after excluding them carry 182,029 lines of core C. test/ carries 1,021,321 lines across 1,294 files, and ext/ carries 326,793. No build, test, benchmark or network call was run against the project. The proprietary TH3 harness behind the 100% MC/DC figure is not in this repository. That number and the 590× test-to-source ratio come from sqlite.org/testing.html and carry its 2023-onward release regime. Objective: remove the memory-unsafety class from SQL and database-file parsing without weakening the assurance level SQLite currently ships. User-supplied facts: none. No Amdahl calculation appears, because no performance requirement is asserted; treating a line share as a time share would be a method error, so D2 is recorded N/A. Gates 1 and 2 pass, gates 3 and 4 fail. The gates are non-compensatory, so a safety requirement that clears G1 and G2 still does not survive an option whose cost is the project's own assurance programme. The framework is a structured decision protocol, not a statistical predictor.仓库：github.com/sqlite/sqlite，提交 f034d51，浅克隆，2,221 个受控文件。范围：整个仓库，其中 src/ 里的核心引擎是迁移候选。采样：只统计受控文件。src/ 里有 47 个测试脚手架文件（44 个 .c 编译单元加 3 个头文件）；排除之后剩下的 102 个文件是 182,029 行核心 C。test/ 是 1,294 个文件、1,021,321 行，ext/ 是 326,793 行。没有对项目执行任何构建、测试、基准或网络调用。产出 100% MC/DC 这个数字的闭源 TH3 脚手架不在本仓库里。那个数字和 590× 的测试源码比来自 sqlite.org/testing.html，口径是它 2023 年起的发布版本。目标：在不削弱 SQLite 现有保证水平的前提下，从 SQL 与数据库文件解析中消除内存不安全这一类缺陷。用户提供的事实：无。报告里没有 Amdahl 计算，因为没有提出性能要求；把行数占比当成时间占比是方法错误，所以 D2 记为 N/A。G1、G2 通过，G3、G4 不通过。四道门不可互相补偿，所以一个已经过了 G1 和 G2 的安全需求，仍然扛不住一个代价等于项目自身保证体系的方案。这套框架是结构化的决策协议，不是统计预测器。

What we don't know证据缺口What it would change会改变什么
Root-cause classification of SQLite's advisory historySQLite 历史安全公告的根因分类Without it, the share of past defects Rust would have eliminated by construction stays an argument rather than a measurement. It would move G1's strength. The G3 and G4 failures stand.没有这份分类，Rust 本可以从构造上消除掉多少历史缺陷，就只是个说法，不是测量结果。它会影响 G1 的证据强度。G3 和 G4 的失败照旧。
Assurance level of any Rust challenger任何 Rust 挑战者的保证水平If a Rust engine publishes MC/DC-equivalent coverage on its own core and byte-identical on-disk behaviour, the adoption option strengthens for consumers. The extraction option becomes re-examinable.如果某个 Rust 引擎公布了自己内核上与 MC/DC 对等的覆盖率，以及字节级一致的磁盘行为，采用方案对使用方就更有说服力。抽取方案也值得重新看一遍。
Cost of rebuilding coverage for one extracted component为抽出来的单个组件重建覆盖率要多少钱Unpriced. Until someone estimates it, the tokenizer/parser extraction stays retained-but-unselected rather than recommended.没人报过价。在有人估出来之前，词法/语法分析器的抽取方案只能保留待议，进不了推荐。