gburd · Oct 15, 2026 · Oct 14, 2026 · Oct 14, 2026
diff --git a/VERSIONING.md b/VERSIONING.md
@@ -85,6 +85,14 @@ the hash at the same value on both). Still pre-LTS; the gain was correctness
 (B3 on ARM) plus scalability overhead reductions, against a one-time region
 recreation.
 
+The third was **v2026.10.7**, on **macOS arm64 only**: the AArch64 hybrid mutex
+is selected there again by default (F7), moving that platform's signature
+`0xe0ad2911` → `0x2c8d3688`. Every other platform's build output is
+byte-identical to v2026.10.6 (same `db_config.h`, same `.text`, same signature,
+verified on Linux x86_64, FreeBSD x86_64 and FreeBSD aarch64), which is why the
+v2026.10.6 soak qualifies it there. This is the last region change before the
+first LTS; from the LTS tag on, the format is frozen within the line.
+
 ## Consuming code
 
 - Human / release identity → `DB_CALVER` (or the leading token of

diff --git a/build_android/Android.mk b/build_android/Android.mk
@@ -1,6 +1,6 @@
 # DO NOT EDIT: automatically built by dist/s_android.
 # Makefile for building a drop-in replacement of SQLite using
-# libdb 2026.10.6 (October 12, 2026)
+# libdb 2026.10.7 (October 15, 2026)
 ###################################################################
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)

diff --git a/build_android/db.h b/build_android/db.h
diff --git a/build_android/jdbc/jni/Android.mk b/build_android/jdbc/jni/Android.mk
@@ -1,6 +1,6 @@
 # DO NOT EDIT: automatically built by dist/s_android.
 # Makefile for building Android.JDBC for DBSQL
-# libdb 2026.10.6 (October 12, 2026)
+# libdb 2026.10.7 (October 15, 2026)
 #
 # This Makefile will generate 3 files:
 #   1. Static libdb_sql library. An internal library and users don't

diff --git a/build_windows/db.h b/build_windows/db.h
diff --git a/dist/RELEASE b/dist/RELEASE
@@ -8,7 +8,7 @@
 # Format: YYYY.0M  (append .MICRO for a same-month re-release, e.g. 2026.09.1).
 # Bump YYYY.0M for the month you cut the release; MICRO for follow-ups.
 # ---------------------------------------------------------------------------
-DB_CALVER="2026.10.6"
+DB_CALVER="2026.10.7"
 
 # ---------------------------------------------------------------------------
 # FORMAT / ABI COMPATIBILITY LEVEL -- FROZEN at 5.3.37, do NOT bump for a
@@ -30,7 +30,7 @@ DB_VERSION_FULL="$DB_VERSION_FAMILY.$DB_VERSION_RELEASE.$DB_VERSION_MAJOR.$DB_VE
 
 DB_VERSION_UNIQUE_NAME=`printf "_%d%03d" $DB_VERSION_MAJOR $DB_VERSION_MINOR`
 
-DB_RELEASE_DATE="October 12, 2026"
+DB_RELEASE_DATE="October 15, 2026"
 # User-facing string leads with the CalVer identity; the frozen 5.3.37 is kept
 # as the parenthesised format/ABI compatibility level so tools that parse it
 # and existing environments still see a stable compat number.

diff --git a/dist/aclocal/mutex.m4 b/dist/aclocal/mutex.m4
@@ -387,23 +387,20 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM(, [[
 #endif
 ]])], [db_cv_mutex="$db_cv_mutex/x86_64/gcc-assembly"])
 
-# ARM64/AArch64 gcc/clang: FreeBSD, Linux.  A HYBRID probe, so it must
+# ARM64/AArch64 gcc/clang: FreeBSD, Linux, macOS.  A HYBRID probe, so it must
 # sit here with the x86 ones, not in the TAS-only list below, which runs only
 # when no pthreads mutex was found -- i.e. never on these platforms.  It used
 # to be there, and that is why aarch64 built as plain POSIX/pthreads/library:
 # every acquire a pthread call, and on FreeBSD every multi-process attach
 # exposed to B3 at t=1 (test/KNOWN-ISSUES.md).
 #
-# Darwin/arm64 (Apple Silicon) is EXCLUDED: the AArch64 TAS primitives were
-# validated on FreeBSD/arm64 (Neoverse) and Linux, but on macOS the hybrid
-# sleep/wake path does not behave (run_mutex_stress produces no verdict -- the
-# binary crashes or hangs before progress).  macOS does not have the B3 umtx
-# defect the hybrid exists to fix, so it loses nothing by keeping the proven
-# POSIX/pthreads path, which is exactly what macOS used before the hybrid
-# landed.  See test/KNOWN-ISSUES.md (F1 / mutex-stress macOS).
+# Darwin/arm64 was excluded for one release (681026b49) on a misdiagnosis:
+# run_mutex_stress printed no verdict there, but the runner -- not the mutex --
+# was broken (F7: dyld install-name over -rpath, and no GNU timeout).  With the
+# runner fixed the hybrid passes on Apple Silicon with its teeth intact, so
+# macOS selects it again.
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM(, [[
-#if (defined(__aarch64__) || defined(_M_ARM64)) && defined(__GNUC__) && \
-    !defined(__APPLE__)
+#if (defined(__aarch64__) || defined(_M_ARM64)) && defined(__GNUC__)
 	(void)0;  /* compile-only probe; nothing is run */
 #else
 	FAIL TO COMPILE/LINK

diff --git a/dist/configure b/dist/configure
@@ -3596,11 +3596,11 @@ DB_VERSION_MINOR="0"
 
 DB_VERSION_PATCH="9"
 
-DB_CALVER="2026.10.6"
+DB_CALVER="2026.10.7"
 
-DB_VERSION_STRING='"libdb 2026.10.6 (October 12, 2026)"'
+DB_VERSION_STRING='"libdb 2026.10.7 (October 15, 2026)"'
 
-DB_VERSION_FULL_STRING='"libdb 2026.10.6 (October 12, 2026)"'
+DB_VERSION_FULL_STRING='"libdb 2026.10.7 (October 15, 2026)"'
 
 
 # Process all options before using them.
@@ -24844,29 +24844,26 @@ then :
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
-# ARM64/AArch64 gcc/clang: FreeBSD, Linux.  A HYBRID probe, so it must
+# ARM64/AArch64 gcc/clang: FreeBSD, Linux, macOS.  A HYBRID probe, so it must
 # sit here with the x86 ones, not in the TAS-only list below, which runs only
 # when no pthreads mutex was found -- i.e. never on these platforms.  It used
 # to be there, and that is why aarch64 built as plain POSIX/pthreads/library:
 # every acquire a pthread call, and on FreeBSD every multi-process attach
 # exposed to B3 at t=1 (test/KNOWN-ISSUES.md).
 #
-# Darwin/arm64 (Apple Silicon) is EXCLUDED: the AArch64 TAS primitives were
-# validated on FreeBSD/arm64 (Neoverse) and Linux, but on macOS the hybrid
-# sleep/wake path does not behave (run_mutex_stress produces no verdict -- the
-# binary crashes or hangs before progress).  macOS does not have the B3 umtx
-# defect the hybrid exists to fix, so it loses nothing by keeping the proven
-# POSIX/pthreads path, which is exactly what macOS used before the hybrid
-# landed.  See test/KNOWN-ISSUES.md (F1 / mutex-stress macOS).
+# Darwin/arm64 was excluded for one release (681026b49) on a misdiagnosis:
+# run_mutex_stress printed no verdict there, but the runner -- not the mutex --
+# was broken (F7: dyld install-name over -rpath, and no GNU timeout).  With the
+# runner fixed the hybrid passes on Apple Silicon with its teeth intact, so
+# macOS selects it again.
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
 int
 main (void)
 {
 
-#if (defined(__aarch64__) || defined(_M_ARM64)) && defined(__GNUC__) && \
-    !defined(__APPLE__)
+#if (defined(__aarch64__) || defined(_M_ARM64)) && defined(__GNUC__)
 	(void)0;  /* compile-only probe; nothing is run */
 #else
 	FAIL TO COMPILE/LINK

diff --git a/dist/meson.build b/dist/meson.build
@@ -218,11 +218,9 @@ endif
 # here is the one thing that could actually be missing: outline atomics need
 # __aarch64_swp1_acq from the compiler runtime.
 #
-# Darwin/arm64 (Apple Silicon) is excluded, mirroring mutex.m4: the hybrid
-# sleep/wake path does not behave on macOS (run_mutex_stress produces no
-# verdict), and macOS lacks the B3 umtx defect the hybrid fixes, so it keeps
-# the proven POSIX/pthreads path it used before the hybrid landed.
-if host_machine.cpu_family() == 'aarch64' and host_machine.system() != 'darwin' and cc.links('''
+# Darwin/arm64 selects it too, mirroring mutex.m4 (the one-release exclusion
+# in 681026b49 rested on a test-runner bug, F7).
+if host_machine.cpu_family() == 'aarch64' and cc.links('''
 int main(void) {
 	volatile unsigned char tsl = 0;
 	int r = __atomic_exchange_n(&tsl, 1, __ATOMIC_ACQUIRE);
@@ -333,8 +331,8 @@ cdata.set('SIZEOF_CHAR_P', cc.sizeof('void *'))
 # Package strings.
 cdata.set_quoted('PACKAGE_NAME', 'Berkeley DB')
 cdata.set_quoted('PACKAGE_TARNAME', 'db')
-cdata.set_quoted('PACKAGE_VERSION', '2026.10.6')
-cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.6')
+cdata.set_quoted('PACKAGE_VERSION', '2026.10.7')
+cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7')
 cdata.set_quoted('PACKAGE_BUGREPORT', '')
 cdata.set_quoted('PACKAGE_URL', '')
 cdata.set_quoted('LT_OBJDIR', '.libs/')

diff --git a/dist/meson/db_subs.json b/dist/meson/db_subs.json
@@ -4,9 +4,9 @@
   "DB_VERSION_MAJOR": "2026",
   "DB_VERSION_MINOR": "0",
   "DB_VERSION_PATCH": "9",
-  "DB_CALVER": "2026.10.6",
-  "DB_VERSION_STRING": "\"libdb 2026.10.6 (October 12, 2026)\"",
-  "DB_VERSION_FULL_STRING": "\"libdb 2026.10.6 (October 12, 2026)\"",
+  "DB_CALVER": "2026.10.7",
+  "DB_VERSION_STRING": "\"libdb 2026.10.7 (October 15, 2026)\"",
+  "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7 (October 15, 2026)\"",
   "DB_VERSION_UNIQUE_NAME": "",
   "DB_CONST": "",
   "DB_PROTO1": "",

diff --git a/docs_src/guides/upgrading/upgrade_2026_10_7.md b/docs_src/guides/upgrading/upgrade_2026_10_7.md
@@ -0,0 +1,45 @@
+---
+title: "Upgrading to libdb 2026.10.7"
+api-name: "Upgrading to libdb 2026.10.7"
+---
+## Upgrading to libdb 2026.10.7
+
+**On macOS on Apple Silicon (arm64), libdb 2026.10.7 changes the shared-memory environment region format.** On every other platform, nothing changes: a 2026.10.7 build produces the same region format as 2026.10.6, and environments created by either release attach to the other.
+
+Databases and log files do not change on any platform.
+
+### What changed and why
+
+Since 2026.10.6, FreeBSD and Linux on 64-bit ARM have used a hybrid mutex: a short test-and-set spin, then a sleep on a pthread primitive. Release 2026.10.6 excluded macOS from it, because a stress test produced no result there. The cause turned out to be the test runner, not the mutex. On macOS the runner could not start its test program, because the library's install name took precedence over `-rpath` and stock macOS has no `timeout` command.
+
+With the runner fixed, the hybrid was compared with the pthread mutex on Apple Silicon. Both passed the same correctness tests (mutex stress, the lock-conflict matrix, and the regression runners). The hybrid was as fast or faster in every measured case, never slower, and lock-manager throughput rose by up to 2× at two threads. libdb 2026.10.7 therefore selects the hybrid on macOS/arm64 by default, as it already did on the other arm64 platforms. See `test/bench/F7-MACOS-HYBRID-2026-10.md`.
+
+The hybrid mutex is a different shared structure from the pthread mutex, so the macOS/arm64 environment build signature changes.
+
+### Build signatures
+
+| Platform | 2026.10.6 | 2026.10.7 |
+| --- | --- | --- |
+| macOS arm64 | `0xe0ad2911` | `0x2c8d3688` |
+| Linux / FreeBSD x86_64 (LP64) | unchanged | unchanged |
+| FreeBSD / Linux aarch64 | unchanged | unchanged |
+| Windows | unchanged | unchanged |
+
+### What you will see on macOS arm64 if you do not follow the procedure
+
+A 2026.10.7 process that opens an environment created by 2026.10.6, or the other way round, fails cleanly:
+
+    BDB1539 Build signature doesn't match environment
+    DB_ENV->open: DB_VERSION_MISMATCH
+
+Nothing is read or written in that case. This includes a 2026.10.7 process and a 2026.10.6 utility such as `db_stat` or `db_recover`.
+
+To keep the 2026.10.6 region format on macOS instead, configure with `--with-mutex=POSIX/pthreads/library`.
+
+### Procedure (macOS arm64 only)
+
+1. Shut down every process using the environment, including utilities.
+2. Run recovery with the **old** release, or confirm the environment was shut down cleanly.
+3. Remove the environment region files (`DB_ENV->remove`, or delete `__db.0*`). Do not remove databases or logs.
+4. Install libdb 2026.10.7.
+5. Reopen the environment. libdb recreates the region files in the new format.
diff --git a/meson.build b/meson.build
@@ -12,7 +12,7 @@
 #   meson test -C build --suite tiers   # isolation + lock-matrix tiers
 
 project('libdb', 'c',
-  version: '2026.10.6',
+  version: '2026.10.7',
   # Sleepycat, matching LICENSE (byte-identical to Oracle's) and README.md.
   # This field previously named a copyleft licence that this fork
   # deliberately excludes: README.md explains that Berkeley DB releases from

diff --git a/test/KNOWN-ISSUES.md b/test/KNOWN-ISSUES.md
@@ -152,7 +152,7 @@ Full analysis: `rfc/0011-test-coverage-gaps.md`.
 | id | issue | status |
 |----|-------|--------|
 | **F1** | **Apple clang 15.0.0 (clang-1500.3.9.4) crashes compiling `src/env/env_register.c`** on the `macos-14` runner: `clang: error: unable to execute command: Abort trap: 6`, `clang frontend command failed due to signal`, with a "PLEASE submit a bug report" note and preprocessed source dumped to the runner's temp dir. **Not reproducible** — an unmodified rerun of the identical commit passed, and the job had succeeded on master's previous 5 runs. Most likely a resource/OOM abort on the hosted runner rather than a deterministic frontend bug. Not filed upstream: Apple's clang tracker needs the preprocessed source and run script the crash dumps, and those live on an ephemeral runner that is destroyed with the job, so there is nothing reproducible to submit. **If it recurs, capture the artifacts first** — add a step that uploads `/var/folders/**/*.c` and the `*.sh` run script from the crash note as a build artifact, then file with those attached. A crash report without the reproducer would be closed unactionable. | monitoring |
-| **F7** | **`run_mutex_stress` produced NO VERDICT on every macOS job because the runner could not start its driver there, not because of a mutex defect.**  Two runner bugs, each sufficient on its own.  (1) It linked the shared library first, and on macOS `libdb-2026.0.dylib` carries the install name `/usr/local/BerkeleyDB.2026.0/lib/libdb-2026.0.dylib`, which takes precedence over `-rpath`, so dyld aborted the uninstalled binary before `main()` (rc=134).  (2) It called bare `timeout`, which stock macOS does not have (rc=127, the gap 39b6fc6f2 fixed in the sibling runners).  `2>&1 \| grep '^VERDICT'` discarded both messages, which is why it looked like a crash inside the driver and was independent of the mutex backend.  Reproduced on an M3 Pro (macOS 27, Apple clang 21) with both the hybrid build (4a4cff4d9) and the pthreads build (v2026.10.6).  **Fixed** by linking the static library first and resolving `timeout`/`gtimeout`/none as `run_recd_handlers.sh` does; the runner also prints the driver's output when there is no verdict, and the Darwin SKIP is gone.  With the driver actually running, the AArch64 hybrid passes on Apple Silicon (20/20) and the teeth hold there: non-atomic `MUTEX_SET` and RELAXED set/unset fail counter mode 2/2, and `MUTEX_MEMBAR` reduced to a compiler barrier hangs handoff mode 2/2.  The Darwin exclusion of the hybrid (681026b49) rested on the misdiagnosis and is still in place at this commit. | **fixed (runner)** |
+| **F7** | **`run_mutex_stress` produced NO VERDICT on every macOS job because the runner could not start its driver there, not because of a mutex defect.**  Two runner bugs, each sufficient on its own.  (1) It linked the shared library first, and on macOS `libdb-2026.0.dylib` carries the install name `/usr/local/BerkeleyDB.2026.0/lib/libdb-2026.0.dylib`, which takes precedence over `-rpath`, so dyld aborted the uninstalled binary before `main()` (rc=134).  (2) It called bare `timeout`, which stock macOS does not have (rc=127, the gap 39b6fc6f2 fixed in the sibling runners).  `2>&1 \| grep '^VERDICT'` discarded both messages, which is why it looked like a crash inside the driver and was independent of the mutex backend.  Reproduced on an M3 Pro (macOS 27, Apple clang 21) with both the hybrid build (4a4cff4d9) and the pthreads build (v2026.10.6).  **Fixed** by linking the static library first and resolving `timeout`/`gtimeout`/none as `run_recd_handlers.sh` does; the runner also prints the driver's output when there is no verdict, and the Darwin SKIP is gone.  With the driver actually running, the AArch64 hybrid passes on Apple Silicon (20/20) and the teeth hold there: non-atomic `MUTEX_SET` and RELAXED set/unset fail counter mode 2/2, and `MUTEX_MEMBAR` reduced to a compiler barrier hangs handoff mode 2/2.  The Darwin exclusion of the hybrid (681026b49) rested on the misdiagnosis; **2026.10.7 selects the hybrid on macOS/arm64 again by default**, after an A/B on Apple Silicon showed identical correctness on both arms (mutex_stress 4/4, lockmatrix 55/55, db-tier 33/0) and the hybrid faster or neutral in every cell, never slower (lock manager up to 2.0× at 2 threads) — `test/bench/F7-MACOS-HYBRID-2026-10.md`. That moves the macOS/arm64 region signature `0xe0ad2911` → `0x2c8d3688`. | **fixed** |
 
 ## Why this file exists