Oxiland 0.6 API review checklist

Independent review of the 0.6 safe facade for soundness and ownership clarity (ROADMAP evidence gate). Completed 2026-07-30 against the 0.6 tip.

Checklist

• No unsafe in the oxiland library (#![forbid(unsafe_code)])
• Public ownership is RAII; inventory marks librdf_new_* / librdf_free_* as not-applicable
• Unsupported factories/plugins fail with Error::Unsupported or inventory excluded (ADR-018) — no silent success
• Stream iterators are fallible and drop-to-stop (ADR-013); no lending iterator API exposing internal borrows across threads incorrectly
• World clones share features/handler/min level via Arc (documented)
• Durable store open paths do not initialize Fjall in unrelated directories
• CLI (oxiland-cli) contains no RDF semantics beyond facade calls
• Public API snapshot regenerated; semver-checks vs 0.5.0 reviewed
• Excluded inventory rows carry impact / workaround / owner / review_date
• CLI storage types are strict (memory/fjall); unsupported types error
• CLI default output is dataset-safe (nquads); -n gates store creation

Findings

No unresolved soundness or ownership issues blocking 0.6.0.

Residual product risks (documented, not blockers): excluded storage plugins and per-object feature APIs; CLI is workflow-compatible only; C handle refcounting remains an open question for 0.8.