security: gate native export review

Jaime Fournier

2450d60c8dac22c946b1b66178f6b25ac3bacd07

diff --git a/Makefile b/Makefile
index b361ff4..44b7717 100644
--- a/Makefile
+++ b/Makefile
@@ -76,7 +76,7 @@ TYPED_LLVMIR_PARITY_FN ?= sample_typed_llvmir_smoke::main
 LLVM_BIN ?= $(shell if command -v llvm-as >/dev/null 2>&1; then dirname "$$(command -v llvm-as)"; elif [ -x /opt/homebrew/opt/llvm/bin/llvm-as ]; then echo /opt/homebrew/opt/llvm/bin; elif [ -x /usr/local/opt/llvm/bin/llvm-as ]; then echo /usr/local/opt/llvm/bin; fi)
 TYPED_WRAPPER_DIR ?= build/typed/jerboa
 
-.PHONY: help chez static-supported-check chez-cross build binary binary-typed binary-typed-smoke binary-cross native-cross pure-audit typecheck typed-rust typed-llvmir typed-llvmir-check typed-llvmir-smoke typed-llvmir-parity typed-wrappers typed-build typed-wrapper-smoke typed-split-tree-smoke typed-test typed-clean test test-known-flaky test-reader test-core test-runtime test-try-debug test-stdlib test-ffi test-modules test-expanded test-contract test-ergo test-sqlite-robustness test-limits-primitives test-typed-core test-typed-parser test-typed-checker test-typed-rust test-typed-kotlin test-typed-llvmir test-typed-wrappers test-pure-audit test-features test-wrappers test-phase4a test-phase4b test-phase4c test-phase4d test-phase4e test-phase4f test-phase5 test-phase5e test-phase6 test-phase7 test-phase8 test-functional test-repl test-security test-security-profile test-native test-gaps native clean-native audit audit-native jpkg-audit vendor-jsqlite-security-check tcb-drift-check import-policy-check source-balance restrict-closure-check security-audit clean security security-production security-profile security-hardware-smoke sbom reproducibility-report reproducibility-compare verify release-evidence fuzz fuzz-smoke fuzz-deep fuzz-reader-fuzz fuzz-json-fuzz fuzz-http2-fuzz fuzz-dns-fuzz fuzz-pregexp-fuzz fuzz-csv-fuzz fuzz-base64-fuzz fuzz-hex-fuzz fuzz-uri-fuzz fuzz-format-fuzz fuzz-router-fuzz fuzz-sandbox-fuzz test-rawstring test-regex test-rx test-peg test-regex-all check-docs check-docs-strict data-check docker-build docker-push lint
+.PHONY: help chez static-supported-check chez-cross build binary binary-typed binary-typed-smoke binary-cross native-cross pure-audit typecheck typed-rust typed-llvmir typed-llvmir-check typed-llvmir-smoke typed-llvmir-parity typed-wrappers typed-build typed-wrapper-smoke typed-split-tree-smoke typed-test typed-clean test test-known-flaky test-reader test-core test-runtime test-try-debug test-stdlib test-ffi test-modules test-expanded test-contract test-ergo test-sqlite-robustness test-limits-primitives test-typed-core test-typed-parser test-typed-checker test-typed-rust test-typed-kotlin test-typed-llvmir test-typed-wrappers test-pure-audit test-features test-wrappers test-phase4a test-phase4b test-phase4c test-phase4d test-phase4e test-phase4f test-phase5 test-phase5e test-phase6 test-phase7 test-phase8 test-functional test-repl test-security test-security-profile test-native test-gaps native clean-native audit audit-native jpkg-audit vendor-jsqlite-security-check native-export-review-check tcb-drift-check import-policy-check source-balance restrict-closure-check security-audit clean security security-production security-profile security-hardware-smoke sbom reproducibility-report reproducibility-compare verify release-evidence fuzz fuzz-smoke fuzz-deep fuzz-reader-fuzz fuzz-json-fuzz fuzz-http2-fuzz fuzz-dns-fuzz fuzz-pregexp-fuzz fuzz-csv-fuzz fuzz-base64-fuzz fuzz-hex-fuzz fuzz-uri-fuzz fuzz-format-fuzz fuzz-router-fuzz fuzz-sandbox-fuzz test-rawstring test-regex test-rx test-peg test-regex-all check-docs check-docs-strict data-check docker-build docker-push lint
 .PHONY: check-cross-tools docker fuzz-websocket-fuzz jlsp jlsp-freebsd-amd64 \
         jlsp-install jlsp-linux-amd64 jlsp-portable jmcp-freebsd-amd64 \
         jmcp-freebsd-arm64 jmcp-linux-amd64 jmcp-linux-arm64 \
@@ -138,6 +138,7 @@ help:
 	@echo "  audit            Run production security/release gate checks"
 	@echo "  audit-native     Run cargo audit on Rust native library"
 	@echo "  vendor-jsqlite-security-check  Verify vendored jsqlite TCB review freshness"
+	@echo "  native-export-review-check Verify native Rust export caller review freshness"
 	@echo "  pure-audit       Scan jerboa-* repos for non-pure runtime surfaces"
 	@echo "  sbom             Write local SBOM/toolchain evidence under dist/sbom"
 	@echo "  reproducibility-report  Compare two local multicall builds"
@@ -1746,6 +1747,9 @@ jpkg-audit: build
 vendor-jsqlite-security-check:
 	@support/check-vendor-jsqlite-security.sh
 
+native-export-review-check:
+	@support/check-native-export-review.sh --check
+
 tcb-drift-check:
 	@set -eu; \
 	if git diff --quiet -- .jerboa-system support/container-dependencies.lock \
@@ -1779,7 +1783,7 @@ unsafe-deserialize-check:
 import-policy-check: build
 	@$(SCHEME) --libdirs $(LIBDIRS) --script tools/check-import-policy.ss examples
 
-audit: source-balance restrict-closure-check unsafe-deserialize-check import-policy-check security-audit audit-native jpkg-audit vendor-jsqlite-security-check tcb-drift-check data-check security-production unification-check
+audit: source-balance restrict-closure-check unsafe-deserialize-check import-policy-check security-audit audit-native jpkg-audit vendor-jsqlite-security-check native-export-review-check tcb-drift-check data-check security-production unification-check
 
 test-gaps:
 	$(SCHEME) --libdirs $(LIBDIRS) --script tests/test-gaps.ss
diff --git a/docs/ffi-audit.md b/docs/ffi-audit.md
index 291bf47..c666754 100644
--- a/docs/ffi-audit.md
+++ b/docs/ffi-audit.md
@@ -55,7 +55,11 @@ Latest summary from `tools/ffi-audit-report.ss`:
 K3-P1-01 is now started and reproducibly inventoried, but not complete. The
 current release gate has a machine-readable count of Scheme FFI sites, native
 C/Rust files, Rust C ABI exports, pointer/width-sensitive bindings, blocking
-candidate calls, and unsafe Rust sites. The full report appends a provisional
+candidate calls, and unsafe Rust sites. `make native-export-review-check`
+keeps the actual C ABI export/caller map in
+`docs/reviews/2026-07-27-native-export-review.sexp` fresh; the current map has
+225 actual exported functions, 183 tracked Scheme references, and 42 exports
+with no tracked Scheme reference. The full report appends a provisional
 `hazards` list and `verdict` to every Scheme and Rust site. Scheme verdicts
 separate blocking calls missing `__collect_safe`, pointer/GC/ownership or
 integer-width review, and lower-risk API review. Rust verdicts separate unsafe
@@ -76,8 +80,8 @@ Remaining work before closing K3-P1-01:
 - Add targeted scanner rules for null-return checks, integer width confusion,
   caller-supplied length trust, and bytevector pointer lifetime hazards.
 - Add `SAFETY:` invariant comments near Rust unsafe sites.
-- Reconcile the 231 Rust `#[no_mangle]` exports with live Scheme callers and
-  unexport or document unused exports.
+- Use the native export review's no-Scheme-reference set to unexport or
+  explicitly retain each currently unused Rust C ABI export.
 - Keep `vendor/jsqlite` in the TCB until consumers move to the Rust sqlite
   path. The accepted-risk decision is now recorded in
   `docs/reviews/2026-07-27-vendor-jsqlite-tcb.md`, and `make audit` runs
diff --git a/docs/index.md b/docs/index.md
index 08b36b1..a9f79b5 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -76,6 +76,7 @@ work.
 - [safety-guide.md](safety-guide.md) - practical secure-application guide for Jerboa programs
 - [release-security.md](release-security.md) - release gates and security evidence
 - [reviews/2026-07-27-vendor-jsqlite-tcb.md](reviews/2026-07-27-vendor-jsqlite-tcb.md) - accepted-risk review for the vendored SQLite-compatible engine
+- [reviews/2026-07-27-native-export-review.md](reviews/2026-07-27-native-export-review.md) - native Rust export/caller review and drift gate
 - [capability.md](capability.md) - object-capability model
 - [limits.md](limits.md) - resource limits, sandboxing, and capability primitives
 - [harden.md](harden.md) - binary hardening for release artifacts
diff --git a/docs/kimi3-security-recommmendations.md b/docs/kimi3-security-recommmendations.md
index cd84eaa..5d9a3fd 100644
--- a/docs/kimi3-security-recommmendations.md
+++ b/docs/kimi3-security-recommmendations.md
@@ -612,7 +612,11 @@ not started."
   decision in `docs/reviews/2026-07-27-vendor-jsqlite-tcb.md`; `make audit` now runs
   `vendor-jsqlite-security-check`, which fails stale advisory reviews or drift
   between the decision record and the vendored README compatibility target.
-  Remaining work: unsafe invariant comments and export shrinking/justification.
+  `make audit` also runs `native-export-review-check`, backed by
+  `docs/reviews/2026-07-27-native-export-review.sexp`, to keep the Rust C ABI
+  export/caller map current. Remaining work: unsafe invariant comments and
+  shrinking or explicitly retaining the 42 exports with no tracked Scheme
+  reference.
 
 ### K3-P1-02 — TOCTOU-safe filesystem capability checks
 **Serves:** G2. **Effort:** 1 week.
diff --git a/docs/release-security.md b/docs/release-security.md
index 932bc4e..041a4b7 100644
--- a/docs/release-security.md
+++ b/docs/release-security.md
@@ -162,6 +162,9 @@ The same audit gate runs `vendor-jsqlite-security-check`, which requires
 `docs/reviews/2026-07-27-vendor-jsqlite-tcb.md` to record a fresh
 accepted-risk review for the vendored pure-Jerboa SQLite-compatible engine and
 to match the pinned SQLite compatibility target in `vendor/jsqlite/README.md`.
+It also runs `native-export-review-check`, which compares
+`docs/reviews/2026-07-27-native-export-review.sexp` against the current Rust
+C ABI export set and tracked Scheme caller map.
 It also runs `support/check-release-path-leaks.sh` against `dist/jerboa` and
 requires `path_leak_status=pass` in `path-leaks.txt`. Release packaging runs
 the same checker against the final `.tar.gz`, so shipped artifacts cannot
diff --git a/docs/reviews/2026-07-27-native-export-review.md b/docs/reviews/2026-07-27-native-export-review.md
new file mode 100644
index 0000000..7080f8a
--- /dev/null
+++ b/docs/reviews/2026-07-27-native-export-review.md
@@ -0,0 +1,26 @@
+# Native Rust Export Review
+
+Review date: 2026-07-27
+Review artifact: `docs/reviews/2026-07-27-native-export-review.sexp`
+Gate: `make native-export-review-check`
+
+This review reconciles Rust `#[no_mangle] extern "C"` exports against tracked
+Scheme source references. It is intentionally machine-readable so export drift
+fails review instead of becoming stale prose.
+
+Current summary:
+
+- Actual Rust C ABI exports: 225
+- Exports referenced by tracked Scheme source: 183
+- Exports with no tracked Scheme reference: 42
+
+The broader FFI audit still reports raw `no_mangle` marker sites separately;
+this review counts only actual exported Rust functions.
+
+Release rule:
+
+`make audit` runs `support/check-native-export-review.sh --check`. The check
+fails when the committed review artifact does not match the current Rust export
+set or the tracked Scheme caller map. New exports must therefore either gain a
+Scheme caller, be removed, or remain visible in the no-Scheme-reference set for
+an explicit follow-up decision.
diff --git a/docs/reviews/2026-07-27-native-export-review.sexp b/docs/reviews/2026-07-27-native-export-review.sexp
new file mode 100644
index 0000000..cebb8e0
--- /dev/null
+++ b/docs/reviews/2026-07-27-native-export-review.sexp
@@ -0,0 +1,233 @@
+(native-export-review
+  (schema "jerboa.native-export-review/1")
+  (generated-by "support/check-native-export-review.sh")
+  (policy scheme-callers-or-documented)
+  (summary (exports 225) (scheme-referenced 183) (no-scheme-reference 42))
+  (exports
+    (export (symbol "ed25519_derive_pubkey_standalone") (file "jerboa-native-rs/src/ed25519.rs") (line 44) (scheme-callers 0 (none)))
+    (export (symbol "ed25519_sign_standalone") (file "jerboa-native-rs/src/ed25519.rs") (line 9) (scheme-callers 0 (none)))
+    (export (symbol "embed_decrypt") (file "jerboa-native-rs/src/embed_crypto.rs") (line 98) (scheme-callers 0 (none)))
+    (export (symbol "embed_encrypt") (file "jerboa-native-rs/src/embed_crypto.rs") (line 43) (scheme-callers 0 (none)))
+    (export (symbol "embed_pbkdf2_sha256") (file "jerboa-native-rs/src/embed_crypto.rs") (line 19) (scheme-callers 0 (none)))
+    (export (symbol "embed_random_bytes") (file "jerboa-native-rs/src/embed_crypto.rs") (line 157) (scheme-callers 0 (none)))
+    (export (symbol "embed_read_passphrase") (file "jerboa-native-rs/src/embed_crypto.rs") (line 180) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_aead_open") (file "jerboa-native-rs/src/crypto.rs") (line 388) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 161))))
+    (export (symbol "jerboa_aead_seal") (file "jerboa-native-rs/src/crypto.rs") (line 318) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 140))))
+    (export (symbol "jerboa_antidebug_check_all") (file "jerboa-native-rs/src/antidebug.rs") (line 147) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 46))))
+    (export (symbol "jerboa_antidebug_check_breakpoint") (file "jerboa-native-rs/src/antidebug.rs") (line 98) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 42))))
+    (export (symbol "jerboa_antidebug_check_ld_preload") (file "jerboa-native-rs/src/antidebug.rs") (line 60) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 40))))
+    (export (symbol "jerboa_antidebug_check_tracer") (file "jerboa-native-rs/src/antidebug.rs") (line 30) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 38))))
+    (export (symbol "jerboa_antidebug_ptrace") (file "jerboa-native-rs/src/antidebug.rs") (line 8) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 36))))
+    (export (symbol "jerboa_antidebug_timing_check") (file "jerboa-native-rs/src/antidebug.rs") (line 119) (scheme-callers 1 (caller (file "lib/std/os/antidebug.ss") (line 44))))
+    (export (symbol "jerboa_aproc_close") (file "jerboa-native-rs/src/aproc.rs") (line 581) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_aproc_dup") (file "jerboa-native-rs/src/aproc.rs") (line 565) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_aproc_killpg") (file "jerboa-native-rs/src/aproc.rs") (line 616) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 154))))
+    (export (symbol "jerboa_aproc_set_nonblock") (file "jerboa-native-rs/src/aproc.rs") (line 588) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 150))))
+    (export (symbol "jerboa_aproc_spawn") (file "jerboa-native-rs/src/aproc.rs") (line 132) (scheme-callers 2 (caller (file "lib/std/os/aproc.ss") (line 126)) (caller (file "lib/std/os/aproc.ss") (line 141))))
+    (export (symbol "jerboa_aproc_spawn_pty") (file "jerboa-native-rs/src/aproc.rs") (line 340) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 141))))
+    (export (symbol "jerboa_aproc_wait4") (file "jerboa-native-rs/src/aproc.rs") (line 630) (scheme-callers 1 (caller (file "lib/std/os/aproc.ss") (line 158))))
+    (export (symbol "jerboa_argon2id_hash") (file "jerboa-native-rs/src/crypto.rs") (line 714) (scheme-callers 2 (caller (file "lib/std/crypto/native-rust.ss") (line 276)) (caller (file "lib/std/crypto/password.ss") (line 35))))
+    (export (symbol "jerboa_argon2id_verify") (file "jerboa-native-rs/src/crypto.rs") (line 763) (scheme-callers 2 (caller (file "lib/std/crypto/native-rust.ss") (line 296)) (caller (file "lib/std/crypto/password.ss") (line 42))))
+    (export (symbol "jerboa_chacha20_open") (file "jerboa-native-rs/src/crypto.rs") (line 531) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 204))))
+    (export (symbol "jerboa_chacha20_seal") (file "jerboa-native-rs/src/crypto.rs") (line 462) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 182))))
+    (export (symbol "jerboa_deflate") (file "jerboa-native-rs/src/compress.rs") (line 9) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 30))))
+    (export (symbol "jerboa_duckdb_bind_blob") (file "jerboa-native-rs/src/duckdb_native.rs") (line 334) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 62))))
+    (export (symbol "jerboa_duckdb_bind_bool") (file "jerboa-native-rs/src/duckdb_native.rs") (line 386) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 66))))
+    (export (symbol "jerboa_duckdb_bind_double") (file "jerboa-native-rs/src/duckdb_native.rs") (line 272) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 58))))
+    (export (symbol "jerboa_duckdb_bind_int") (file "jerboa-native-rs/src/duckdb_native.rs") (line 251) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 56))))
+    (export (symbol "jerboa_duckdb_bind_null") (file "jerboa-native-rs/src/duckdb_native.rs") (line 365) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 64))))
+    (export (symbol "jerboa_duckdb_bind_text") (file "jerboa-native-rs/src/duckdb_native.rs") (line 293) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 60))))
+    (export (symbol "jerboa_duckdb_close") (file "jerboa-native-rs/src/duckdb_native.rs") (line 125) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 45))))
+    (export (symbol "jerboa_duckdb_column_name") (file "jerboa-native-rs/src/duckdb_native.rs") (line 673) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 76))))
+    (export (symbol "jerboa_duckdb_column_type") (file "jerboa-native-rs/src/duckdb_native.rs") (line 710) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 79))))
+    (export (symbol "jerboa_duckdb_exec") (file "jerboa-native-rs/src/duckdb_native.rs") (line 154) (scheme-callers 2 (caller (file "lib/std/db/duckdb-native.ss") (line 47)) (caller (file "lib/std/db/duckdb-native.ss") (line 69))))
+    (export (symbol "jerboa_duckdb_execute") (file "jerboa-native-rs/src/duckdb_native.rs") (line 433) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 69))))
+    (export (symbol "jerboa_duckdb_finalize") (file "jerboa-native-rs/src/duckdb_native.rs") (line 968) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 51))))
+    (export (symbol "jerboa_duckdb_free_result") (file "jerboa-native-rs/src/duckdb_native.rs") (line 955) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 96))))
+    (export (symbol "jerboa_duckdb_ncols") (file "jerboa-native-rs/src/duckdb_native.rs") (line 664) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 74))))
+    (export (symbol "jerboa_duckdb_nrows") (file "jerboa-native-rs/src/duckdb_native.rs") (line 655) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 72))))
+    (export (symbol "jerboa_duckdb_open") (file "jerboa-native-rs/src/duckdb_native.rs") (line 85) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 43))))
+    (export (symbol "jerboa_duckdb_prepare") (file "jerboa-native-rs/src/duckdb_native.rs") (line 190) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 49))))
+    (export (symbol "jerboa_duckdb_reset") (file "jerboa-native-rs/src/duckdb_native.rs") (line 980) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 53))))
+    (export (symbol "jerboa_duckdb_value_blob") (file "jerboa-native-rs/src/duckdb_native.rs") (line 903) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 92))))
+    (export (symbol "jerboa_duckdb_value_bool") (file "jerboa-native-rs/src/duckdb_native.rs") (line 790) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 87))))
+    (export (symbol "jerboa_duckdb_value_double") (file "jerboa-native-rs/src/duckdb_native.rs") (line 770) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 85))))
+    (export (symbol "jerboa_duckdb_value_int") (file "jerboa-native-rs/src/duckdb_native.rs") (line 744) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 83))))
+    (export (symbol "jerboa_duckdb_value_is_null") (file "jerboa-native-rs/src/duckdb_native.rs") (line 725) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 81))))
+    (export (symbol "jerboa_duckdb_value_text") (file "jerboa-native-rs/src/duckdb_native.rs") (line 822) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 89))))
+    (export (symbol "jerboa_duckdb_version") (file "jerboa-native-rs/src/duckdb_native.rs") (line 1002) (scheme-callers 1 (caller (file "lib/std/db/duckdb-native.ss") (line 98))))
+    (export (symbol "jerboa_epoll_close") (file "jerboa-native-rs/src/epoll.rs") (line 81) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 59))))
+    (export (symbol "jerboa_epoll_create") (file "jerboa-native-rs/src/epoll.rs") (line 6) (scheme-callers 2 (caller (file "lib/std/os/epoll-native.ss") (line 30)) (caller (file "lib/std/os/epoll-native.ss") (line 50))))
+    (export (symbol "jerboa_epoll_ctl") (file "jerboa-native-rs/src/epoll.rs") (line 22) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 53))))
+    (export (symbol "jerboa_epoll_wait") (file "jerboa-native-rs/src/epoll.rs") (line 42) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 56))))
+    (export (symbol "jerboa_eventfd_create") (file "jerboa-native-rs/src/epoll.rs") (line 94) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 293))))
+    (export (symbol "jerboa_eventfd_drain") (file "jerboa-native-rs/src/epoll.rs") (line 120) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 299))))
+    (export (symbol "jerboa_eventfd_signal") (file "jerboa-native-rs/src/epoll.rs") (line 106) (scheme-callers 1 (caller (file "lib/std/os/epoll-native.ss") (line 296))))
+    (export (symbol "jerboa_freebsd_is_traced") (file "jerboa-native-rs/src/process_ctl.rs") (line 98) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_freebsd_process_count") (file "jerboa-native-rs/src/process_ctl.rs") (line 139) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_gunzip") (file "jerboa-native-rs/src/compress.rs") (line 137) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 39))))
+    (export (symbol "jerboa_gzip") (file "jerboa-native-rs/src/compress.rs") (line 97) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 36))))
+    (export (symbol "jerboa_hkdf_sha256") (file "jerboa-native-rs/src/x25519.rs") (line 101) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_hmac_sha256") (file "jerboa-native-rs/src/crypto.rs") (line 201) (scheme-callers 2 (caller (file "lib/std/crypto/native-rust.ss") (line 109)) (caller (file "lib/std/crypto/native-rust.ss") (line 120))))
+    (export (symbol "jerboa_hmac_sha256_verify") (file "jerboa-native-rs/src/crypto.rs") (line 232) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 120))))
+    (export (symbol "jerboa_http_parse") (file "jerboa-native-rs/src/http_parse.rs") (line 25) (scheme-callers 4 (caller (file "lib/std/net/fiber-httpd.ss") (line 78)) (caller (file "lib/std/net/fiber-httpd.ss") (line 81)) (caller (file "lib/std/net/httpsd.ss") (line 28)) (caller (file "lib/std/net/httpsd.ss") (line 71))))
+    (export (symbol "jerboa_inflate") (file "jerboa-native-rs/src/compress.rs") (line 49) (scheme-callers 1 (caller (file "lib/std/compress/native-rust.ss") (line 33))))
+    (export (symbol "jerboa_inotify_add_watch") (file "jerboa-native-rs/src/inotify_native.rs") (line 22) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 65))))
+    (export (symbol "jerboa_inotify_close") (file "jerboa-native-rs/src/inotify_native.rs") (line 158) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 71))))
+    (export (symbol "jerboa_inotify_init") (file "jerboa-native-rs/src/inotify_native.rs") (line 6) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 63))))
+    (export (symbol "jerboa_inotify_read") (file "jerboa-native-rs/src/inotify_native.rs") (line 68) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 69))))
+    (export (symbol "jerboa_inotify_rm_watch") (file "jerboa-native-rs/src/inotify_native.rs") (line 49) (scheme-callers 1 (caller (file "lib/std/os/inotify-native.ss") (line 67))))
+    (export (symbol "jerboa_integrity_hash_file") (file "jerboa-native-rs/src/integrity.rs") (line 272) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 63))))
+    (export (symbol "jerboa_integrity_hash_region") (file "jerboa-native-rs/src/integrity.rs") (line 194) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 60))))
+    (export (symbol "jerboa_integrity_hash_self") (file "jerboa-native-rs/src/integrity.rs") (line 65) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 53))))
+    (export (symbol "jerboa_integrity_sign_verify") (file "jerboa-native-rs/src/integrity.rs") (line 134) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 57))))
+    (export (symbol "jerboa_integrity_verify_hash") (file "jerboa-native-rs/src/integrity.rs") (line 96) (scheme-callers 1 (caller (file "lib/std/os/integrity.ss") (line 55))))
+    (export (symbol "jerboa_kill_probe") (file "jerboa-native-rs/src/process_ctl.rs") (line 59) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_landlock_abi_version") (file "jerboa-native-rs/src/landlock.rs") (line 65) (scheme-callers 6 (caller (file "lib/std/os/landlock-native.ss") (line 78)) (caller (file "lib/std/os/landlock.ss") (line 12)) (caller (file "lib/std/os/landlock.ss") (line 56)) (caller (file "lib/std/os/landlock.ss") (line 57)) (caller (file "lib/std/os/limits/sandbox.ss") (line 455)) (caller (file "lib/std/os/sandbox.ss") (line 75))))
+    (export (symbol "jerboa_landlock_add_net_rule") (file "jerboa-native-rs/src/landlock.rs") (line 201) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 86))))
+    (export (symbol "jerboa_landlock_add_path_rule") (file "jerboa-native-rs/src/landlock.rs") (line 120) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 83))))
+    (export (symbol "jerboa_landlock_create_ruleset") (file "jerboa-native-rs/src/landlock.rs") (line 91) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 80))))
+    (export (symbol "jerboa_landlock_enforce") (file "jerboa-native-rs/src/landlock.rs") (line 234) (scheme-callers 1 (caller (file "lib/std/os/landlock-native.ss") (line 89))))
+    (export (symbol "jerboa_last_error") (file "jerboa-native-rs/src/panic.rs") (line 9) (scheme-callers 11 (caller (file "lib/std/compress/native-rust.ss") (line 42)) (caller (file "lib/std/crypto/native-rust.ss") (line 48)) (caller (file "lib/std/crypto/x509.ss") (line 24)) (caller (file "lib/std/native.ss") (line 56)) (caller (file "lib/std/net/tls-rustls.ss") (line 167)) (caller (file "lib/std/os/aproc.ss") (line 163)) (caller (file "lib/std/os/integrity.ss") (line 42)) (caller (file "lib/std/os/secure-output.ss") (line 47)) (caller (file "lib/std/pcap.ss") (line 66)) (caller (file "lib/std/regex-native.ss") (line 51)) (caller (file "lib/std/wasm/sandbox.ss") (line 196))))
+    (export (symbol "jerboa_md5") (file "jerboa-native-rs/src/crypto.rs") (line 53) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_mlockall") (file "jerboa-native-rs/src/process_ctl.rs") (line 37) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_pbkdf2_derive") (file "jerboa-native-rs/src/crypto.rs") (line 647) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 246))))
+    (export (symbol "jerboa_pbkdf2_verify") (file "jerboa-native-rs/src/crypto.rs") (line 676) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 261))))
+    (export (symbol "jerboa_pcap_close") (file "jerboa-native-rs/src/pcap_capture.rs") (line 324) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 58))))
+    (export (symbol "jerboa_pcap_list_interfaces") (file "jerboa-native-rs/src/pcap_capture.rs") (line 350) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 62))))
+    (export (symbol "jerboa_pcap_next") (file "jerboa-native-rs/src/pcap_capture.rs") (line 260) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 53))))
+    (export (symbol "jerboa_pcap_open") (file "jerboa-native-rs/src/pcap_capture.rs") (line 195) (scheme-callers 1 (caller (file "lib/std/pcap.ss") (line 49))))
+    (export (symbol "jerboa_pg_column_name") (file "jerboa-native-rs/src/postgres_native.rs") (line 310) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 41))))
+    (export (symbol "jerboa_pg_connect") (file "jerboa-native-rs/src/postgres_native.rs") (line 83) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 24))))
+    (export (symbol "jerboa_pg_disconnect") (file "jerboa-native-rs/src/postgres_native.rs") (line 132) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 26))))
+    (export (symbol "jerboa_pg_exec") (file "jerboa-native-rs/src/postgres_native.rs") (line 145) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 28))))
+    (export (symbol "jerboa_pg_free_result") (file "jerboa-native-rs/src/postgres_native.rs") (line 346) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 44))))
+    (export (symbol "jerboa_pg_get_value") (file "jerboa-native-rs/src/postgres_native.rs") (line 237) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 36))))
+    (export (symbol "jerboa_pg_is_null") (file "jerboa-native-rs/src/postgres_native.rs") (line 286) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 39))))
+    (export (symbol "jerboa_pg_ncols") (file "jerboa-native-rs/src/postgres_native.rs") (line 223) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 34))))
+    (export (symbol "jerboa_pg_nrows") (file "jerboa-native-rs/src/postgres_native.rs") (line 215) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 32))))
+    (export (symbol "jerboa_pg_query") (file "jerboa-native-rs/src/postgres_native.rs") (line 172) (scheme-callers 1 (caller (file "lib/std/db/postgresql-native.ss") (line 30))))
+    (export (symbol "jerboa_prctl_set_name") (file "jerboa-native-rs/src/process_ctl.rs") (line 6) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_proc_self_exe") (file "jerboa-native-rs/src/process_ctl.rs") (line 218) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_random_bytes") (file "jerboa-native-rs/src/crypto.rs") (line 265) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 98))))
+    (export (symbol "jerboa_regex_captures") (file "jerboa-native-rs/src/regex_native.rs") (line 275) (scheme-callers 2 (caller (file "lib/std/regex-native.ss") (line 40)) (caller (file "lib/std/regex.ss") (line 106))))
+    (export (symbol "jerboa_regex_compile") (file "jerboa-native-rs/src/regex_native.rs") (line 14) (scheme-callers 3 (caller (file "lib/std/regex-native.ss") (line 27)) (caller (file "lib/std/regex.ss") (line 81)) (caller (file "lib/std/regex.ss") (line 85))))
+    (export (symbol "jerboa_regex_compile_ex") (file "jerboa-native-rs/src/regex_native.rs") (line 170) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_regex_find") (file "jerboa-native-rs/src/regex_native.rs") (line 75) (scheme-callers 4 (caller (file "lib/std/regex-native.ss") (line 33)) (caller (file "lib/std/regex.ss") (line 89)) (caller (file "lib/std/regex.ss") (line 97)) (caller (file "lib/std/regex.ss") (line 657))))
+    (export (symbol "jerboa_regex_find_at") (file "jerboa-native-rs/src/regex_native.rs") (line 229) (scheme-callers 3 (caller (file "lib/std/regex-native.ss") (line 33)) (caller (file "lib/std/regex.ss") (line 97)) (caller (file "lib/std/regex.ss") (line 657))))
+    (export (symbol "jerboa_regex_free") (file "jerboa-native-rs/src/regex_native.rs") (line 157) (scheme-callers 2 (caller (file "lib/std/regex-native.ss") (line 48)) (caller (file "lib/std/regex.ss") (line 93))))
+    (export (symbol "jerboa_regex_group_count") (file "jerboa-native-rs/src/regex_native.rs") (line 328) (scheme-callers 2 (caller (file "lib/std/regex-native.ss") (line 37)) (caller (file "lib/std/regex.ss") (line 102))))
+    (export (symbol "jerboa_regex_is_match") (file "jerboa-native-rs/src/regex_native.rs") (line 49) (scheme-callers 1 (caller (file "lib/std/regex-native.ss") (line 30))))
+    (export (symbol "jerboa_regex_replace_all") (file "jerboa-native-rs/src/regex_native.rs") (line 112) (scheme-callers 1 (caller (file "lib/std/regex-native.ss") (line 44))))
+    (export (symbol "jerboa_scrypt") (file "jerboa-native-rs/src/crypto.rs") (line 605) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 226))))
+    (export (symbol "jerboa_seccomp_available") (file "jerboa-native-rs/src/seccomp.rs") (line 283) (scheme-callers 1 (caller (file "lib/std/os/seccomp.ss") (line 32))))
+    (export (symbol "jerboa_seccomp_lock") (file "jerboa-native-rs/src/seccomp.rs") (line 125) (scheme-callers 2 (caller (file "lib/std/os/seccomp.ss") (line 34)) (caller (file "lib/std/os/seccomp.ss") (line 36))))
+    (export (symbol "jerboa_seccomp_lock_strict") (file "jerboa-native-rs/src/seccomp.rs") (line 197) (scheme-callers 1 (caller (file "lib/std/os/seccomp.ss") (line 36))))
+    (export (symbol "jerboa_secure_alloc") (file "jerboa-native-rs/src/secure_mem.rs") (line 28) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 35))))
+    (export (symbol "jerboa_secure_dir_close") (file "jerboa-native-rs/src/secure_fs.rs") (line 463) (scheme-callers 2 (caller (file "lib/std/os/secure-output.ss") (line 33)) (caller (file "lib/std/os/secure-output.ss") (line 53))))
+    (export (symbol "jerboa_secure_dir_list") (file "jerboa-native-rs/src/secure_fs.rs") (line 633) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 62))))
+    (export (symbol "jerboa_secure_dir_mkdirs") (file "jerboa-native-rs/src/secure_fs.rs") (line 472) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 56))))
+    (export (symbol "jerboa_secure_dir_open") (file "jerboa-native-rs/src/secure_fs.rs") (line 400) (scheme-callers 2 (caller (file "lib/std/os/secure-output.ss") (line 49)) (caller (file "lib/std/os/secure-output.ss") (line 51))))
+    (export (symbol "jerboa_secure_dir_open_strict") (file "jerboa-native-rs/src/secure_fs.rs") (line 432) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 51))))
+    (export (symbol "jerboa_secure_entry_info") (file "jerboa-native-rs/src/secure_fs.rs") (line 502) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 59))))
+    (export (symbol "jerboa_secure_fd_close") (file "jerboa-native-rs/src/secure_fs.rs") (line 916) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 77))))
+    (export (symbol "jerboa_secure_free") (file "jerboa-native-rs/src/secure_mem.rs") (line 113) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 38))))
+    (export (symbol "jerboa_secure_output_abort") (file "jerboa-native-rs/src/secure_fs.rs") (line 907) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 75))))
+    (export (symbol "jerboa_secure_output_begin") (file "jerboa-native-rs/src/secure_fs.rs") (line 760) (scheme-callers 2 (caller (file "lib/std/os/secure-output.ss") (line 68)) (caller (file "lib/std/os/secure-output.ss") (line 71))))
+    (export (symbol "jerboa_secure_output_begin_checked") (file "jerboa-native-rs/src/secure_fs.rs") (line 816) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 71))))
+    (export (symbol "jerboa_secure_output_commit") (file "jerboa-native-rs/src/secure_fs.rs") (line 867) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 73))))
+    (export (symbol "jerboa_secure_random_fill") (file "jerboa-native-rs/src/secure_mem.rs") (line 169) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 44))))
+    (export (symbol "jerboa_secure_read_file") (file "jerboa-native-rs/src/secure_fs.rs") (line 673) (scheme-callers 1 (caller (file "lib/std/os/secure-output.ss") (line 65))))
+    (export (symbol "jerboa_secure_wipe") (file "jerboa-native-rs/src/secure_mem.rs") (line 156) (scheme-callers 1 (caller (file "lib/std/crypto/secure-mem.ss") (line 41))))
+    (export (symbol "jerboa_setproctitle") (file "jerboa-native-rs/src/process_ctl.rs") (line 179) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sha1") (file "jerboa-native-rs/src/crypto.rs") (line 66) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 60))))
+    (export (symbol "jerboa_sha256") (file "jerboa-native-rs/src/crypto.rs") (line 82) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 69))))
+    (export (symbol "jerboa_sha256_ctx_final") (file "jerboa-native-rs/src/crypto.rs") (line 151) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sha256_ctx_free") (file "jerboa-native-rs/src/crypto.rs") (line 174) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sha256_ctx_new") (file "jerboa-native-rs/src/crypto.rs") (line 112) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sha256_ctx_update") (file "jerboa-native-rs/src/crypto.rs") (line 128) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sha384") (file "jerboa-native-rs/src/crypto.rs") (line 179) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 78))))
+    (export (symbol "jerboa_sha512") (file "jerboa-native-rs/src/crypto.rs") (line 189) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 87))))
+    (export (symbol "jerboa_sm_add_fuel") (file "jerboa-native-rs/src/wasm_sm.rs") (line 967) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 186))))
+    (export (symbol "jerboa_sm_call") (file "jerboa-native-rs/src/wasm_sm.rs") (line 837) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 168))))
+    (export (symbol "jerboa_sm_fuel_remaining") (file "jerboa-native-rs/src/wasm_sm.rs") (line 972) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sm_get_log") (file "jerboa-native-rs/src/wasm_sm.rs") (line 981) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 180))))
+    (export (symbol "jerboa_sm_instance_free") (file "jerboa-native-rs/src/wasm_sm.rs") (line 828) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 162))))
+    (export (symbol "jerboa_sm_instance_new") (file "jerboa-native-rs/src/wasm_sm.rs") (line 818) (scheme-callers 2 (caller (file "lib/std/wasm/sandbox.ss") (line 156)) (caller (file "lib/std/wasm/sandbox.ss") (line 174))))
+    (export (symbol "jerboa_sm_instance_new_hosted") (file "jerboa-native-rs/src/wasm_sm.rs") (line 823) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 174))))
+    (export (symbol "jerboa_sm_memory_read") (file "jerboa-native-rs/src/wasm_sm.rs") (line 938) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sm_memory_size") (file "jerboa-native-rs/src/wasm_sm.rs") (line 958) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sm_memory_write") (file "jerboa-native-rs/src/wasm_sm.rs") (line 948) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sm_module_free") (file "jerboa-native-rs/src/wasm_sm.rs") (line 777) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 150))))
+    (export (symbol "jerboa_sm_module_new") (file "jerboa-native-rs/src/wasm_sm.rs") (line 697) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 144))))
+    (export (symbol "jerboa_socks5_server_port") (file "jerboa-native-rs/src/socks5_server.rs") (line 250) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_socks5_server_start") (file "jerboa-native-rs/src/socks5_server.rs") (line 111) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_socks5_server_stats") (file "jerboa-native-rs/src/socks5_server.rs") (line 270) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_socks5_server_stop") (file "jerboa-native-rs/src/socks5_server.rs") (line 223) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_sqlite_bind_blob") (file "jerboa-native-rs/src/sqlite.rs") (line 318) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 63))))
+    (export (symbol "jerboa_sqlite_bind_double") (file "jerboa-native-rs/src/sqlite.rs") (line 247) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 59))))
+    (export (symbol "jerboa_sqlite_bind_int") (file "jerboa-native-rs/src/sqlite.rs") (line 227) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 57))))
+    (export (symbol "jerboa_sqlite_bind_null") (file "jerboa-native-rs/src/sqlite.rs") (line 362) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 65))))
+    (export (symbol "jerboa_sqlite_bind_text") (file "jerboa-native-rs/src/sqlite.rs") (line 267) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 61))))
+    (export (symbol "jerboa_sqlite_changes") (file "jerboa-native-rs/src/sqlite.rs") (line 611) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 91))))
+    (export (symbol "jerboa_sqlite_close") (file "jerboa-native-rs/src/sqlite.rs") (line 86) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 46))))
+    (export (symbol "jerboa_sqlite_column_blob") (file "jerboa-native-rs/src/sqlite.rs") (line 489) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 82))))
+    (export (symbol "jerboa_sqlite_column_count") (file "jerboa-native-rs/src/sqlite.rs") (line 410) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 71))))
+    (export (symbol "jerboa_sqlite_column_double") (file "jerboa-native-rs/src/sqlite.rs") (line 442) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 77))))
+    (export (symbol "jerboa_sqlite_column_int") (file "jerboa-native-rs/src/sqlite.rs") (line 433) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 75))))
+    (export (symbol "jerboa_sqlite_column_name") (file "jerboa-native-rs/src/sqlite.rs") (line 526) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 85))))
+    (export (symbol "jerboa_sqlite_column_text") (file "jerboa-native-rs/src/sqlite.rs") (line 452) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 79))))
+    (export (symbol "jerboa_sqlite_column_type") (file "jerboa-native-rs/src/sqlite.rs") (line 422) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 73))))
+    (export (symbol "jerboa_sqlite_errmsg") (file "jerboa-native-rs/src/sqlite.rs") (line 620) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 93))))
+    (export (symbol "jerboa_sqlite_exec") (file "jerboa-native-rs/src/sqlite.rs") (line 117) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 48))))
+    (export (symbol "jerboa_sqlite_finalize") (file "jerboa-native-rs/src/sqlite.rs") (line 584) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 52))))
+    (export (symbol "jerboa_sqlite_last_insert_rowid") (file "jerboa-native-rs/src/sqlite.rs") (line 602) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 89))))
+    (export (symbol "jerboa_sqlite_open") (file "jerboa-native-rs/src/sqlite.rs") (line 46) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 44))))
+    (export (symbol "jerboa_sqlite_prepare") (file "jerboa-native-rs/src/sqlite.rs") (line 152) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 50))))
+    (export (symbol "jerboa_sqlite_reset") (file "jerboa-native-rs/src/sqlite.rs") (line 564) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 54))))
+    (export (symbol "jerboa_sqlite_step") (file "jerboa-native-rs/src/sqlite.rs") (line 385) (scheme-callers 1 (caller (file "lib/std/db/sqlite-native.ss") (line 68))))
+    (export (symbol "jerboa_timing_safe_equal") (file "jerboa-native-rs/src/crypto.rs") (line 288) (scheme-callers 1 (caller (file "lib/std/crypto/native-rust.ss") (line 131))))
+    (export (symbol "jerboa_tls_accept") (file "jerboa-native-rs/src/tls.rs") (line 808) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 86))))
+    (export (symbol "jerboa_tls_close") (file "jerboa-native-rs/src/tls.rs") (line 1679) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 144))))
+    (export (symbol "jerboa_tls_connect") (file "jerboa-native-rs/src/tls.rs") (line 154) (scheme-callers 5 (caller (file "lib/std/net/tls-rustls.ss") (line 92)) (caller (file "lib/std/net/tls-rustls.ss") (line 98)) (caller (file "lib/std/net/tls-rustls.ss") (line 107)) (caller (file "lib/std/net/tls-rustls.ss") (line 114)) (caller (file "lib/std/net/tls-rustls.ss") (line 121))))
+    (export (symbol "jerboa_tls_connect_addr_timeout") (file "jerboa-native-rs/src/tls.rs") (line 293) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 107))))
+    (export (symbol "jerboa_tls_connect_mtls") (file "jerboa-native-rs/src/tls.rs") (line 1137) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 121))))
+    (export (symbol "jerboa_tls_connect_mtls_mem") (file "jerboa-native-rs/src/tls.rs") (line 1452) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_tls_connect_mtls_pem_ca") (file "jerboa-native-rs/src/tls.rs") (line 1319) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_tls_connect_pinned") (file "jerboa-native-rs/src/tls.rs") (line 407) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 114))))
+    (export (symbol "jerboa_tls_connect_timeout") (file "jerboa-native-rs/src/tls.rs") (line 161) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 98))))
+    (export (symbol "jerboa_tls_flush") (file "jerboa-native-rs/src/tls.rs") (line 1644) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 139))))
+    (export (symbol "jerboa_tls_get_fd") (file "jerboa-native-rs/src/tls.rs") (line 1772) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 161))))
+    (export (symbol "jerboa_tls_read") (file "jerboa-native-rs/src/tls.rs") (line 1580) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 129))))
+    (export (symbol "jerboa_tls_server_free") (file "jerboa-native-rs/src/tls.rs") (line 1696) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 80))))
+    (export (symbol "jerboa_tls_server_new") (file "jerboa-native-rs/src/tls.rs") (line 635) (scheme-callers 2 (caller (file "lib/std/net/tls-rustls.ss") (line 67)) (caller (file "lib/std/net/tls-rustls.ss") (line 74))))
+    (export (symbol "jerboa_tls_server_new_mtls") (file "jerboa-native-rs/src/tls.rs") (line 977) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 74))))
+    (export (symbol "jerboa_tls_server_new_mtls_pem") (file "jerboa-native-rs/src/tls.rs") (line 863) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_tls_server_new_pem") (file "jerboa-native-rs/src/tls.rs") (line 737) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_tls_set_nonblock") (file "jerboa-native-rs/src/tls.rs") (line 1703) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 150))))
+    (export (symbol "jerboa_tls_set_timeout") (file "jerboa-native-rs/src/tls.rs") (line 1728) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 155))))
+    (export (symbol "jerboa_tls_write") (file "jerboa-native-rs/src/tls.rs") (line 1613) (scheme-callers 1 (caller (file "lib/std/net/tls-rustls.ss") (line 134))))
+    (export (symbol "jerboa_wasm_add_fuel") (file "jerboa-native-rs/src/wasm.rs") (line 295) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 118))))
+    (export (symbol "jerboa_wasm_allow_cdb_dir") (file "jerboa-native-rs/src/wasm.rs") (line 253) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_wasm_call") (file "jerboa-native-rs/src/wasm.rs") (line 343) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 94))))
+    (export (symbol "jerboa_wasm_fuel_remaining") (file "jerboa-native-rs/src/wasm.rs") (line 318) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 124))))
+    (export (symbol "jerboa_wasm_get_log") (file "jerboa-native-rs/src/wasm.rs") (line 585) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 136))))
+    (export (symbol "jerboa_wasm_instance_free") (file "jerboa-native-rs/src/wasm.rs") (line 208) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 88))))
+    (export (symbol "jerboa_wasm_instance_new") (file "jerboa-native-rs/src/wasm.rs") (line 154) (scheme-callers 3 (caller (file "lib/std/wasm/sandbox.ss") (line 82)) (caller (file "lib/std/wasm/sandbox.ss") (line 130)) (caller (file "tests/test-wasm-sandbox.ss") (line 500))))
+    (export (symbol "jerboa_wasm_instance_new_hosted") (file "jerboa-native-rs/src/wasm.rs") (line 1124) (scheme-callers 2 (caller (file "lib/std/wasm/sandbox.ss") (line 130)) (caller (file "tests/test-wasm-sandbox.ss") (line 500))))
+    (export (symbol "jerboa_wasm_memory_read") (file "jerboa-native-rs/src/wasm.rs") (line 468) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 100))))
+    (export (symbol "jerboa_wasm_memory_size") (file "jerboa-native-rs/src/wasm.rs") (line 563) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 112))))
+    (export (symbol "jerboa_wasm_memory_write") (file "jerboa-native-rs/src/wasm.rs") (line 513) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 106))))
+    (export (symbol "jerboa_wasm_module_free") (file "jerboa-native-rs/src/wasm.rs") (line 142) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 76))))
+    (export (symbol "jerboa_wasm_module_new") (file "jerboa-native-rs/src/wasm.rs") (line 104) (scheme-callers 1 (caller (file "lib/std/wasm/sandbox.ss") (line 70))))
+    (export (symbol "jerboa_wasm_set_socket") (file "jerboa-native-rs/src/wasm.rs") (line 220) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_writev2") (file "jerboa-native-rs/src/http_parse.rs") (line 99) (scheme-callers 1 (caller (file "lib/std/net/io.ss") (line 81))))
+    (export (symbol "jerboa_x25519_diffie_hellman") (file "jerboa-native-rs/src/x25519.rs") (line 62) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_x25519_generate_keypair") (file "jerboa-native-rs/src/x25519.rs") (line 10) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_x25519_public_from_private") (file "jerboa-native-rs/src/x25519.rs") (line 36) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_x509_cert_fingerprint") (file "jerboa-native-rs/src/x509.rs") (line 564) (scheme-callers 1 (caller (file "lib/std/crypto/x509.ss") (line 31))))
+    (export (symbol "jerboa_x509_generate_self_signed") (file "jerboa-native-rs/src/x509.rs") (line 124) (scheme-callers 1 (caller (file "lib/std/crypto/x509.ss") (line 27))))
+    (export (symbol "jerboa_x509_generate_self_signed_mem") (file "jerboa-native-rs/src/x509.rs") (line 263) (scheme-callers 0 (none)))
+    (export (symbol "jerboa_x509_generate_signed_by_ca_mem") (file "jerboa-native-rs/src/x509.rs") (line 388) (scheme-callers 0 (none)))
+  )
+)
diff --git a/support/check-native-export-review.sh b/support/check-native-export-review.sh
new file mode 100755
index 0000000..ee2a83e
--- /dev/null
+++ b/support/check-native-export-review.sh
@@ -0,0 +1,139 @@
+#!/bin/sh
+set -eu
+
+mode="${1:---check}"
+report="${2:-docs/reviews/2026-07-27-native-export-review.sexp}"
+
+case "$mode" in
+  --check|--write) ;;
+  *)
+    echo "usage: check-native-export-review.sh [--check|--write] [REPORT]" >&2
+    exit 2
+    ;;
+esac
+
+python3 - "$mode" "$report" <<'PY'
+import pathlib
+import re
+import subprocess
+import sys
+
+mode = sys.argv[1]
+report_path = pathlib.Path(sys.argv[2])
+repo = pathlib.Path(".")
+
+def fail(msg):
+    print(f"native-export-review: {msg}", file=sys.stderr)
+    sys.exit(1)
+
+def tracked_files():
+    out = subprocess.check_output(["git", "ls-files"], text=True)
+    return [pathlib.Path(line) for line in out.splitlines() if line]
+
+def sexp_string(value):
+    escaped = (
+        value.replace("\\", "\\\\")
+        .replace('"', '\\"')
+        .replace("\n", "\\n")
+    )
+    return f'"{escaped}"'
+
+def collect_exports(paths):
+    exports = []
+    for path in paths:
+        if not str(path).startswith("jerboa-native-rs/src/") or path.suffix != ".rs":
+            continue
+        lines = path.read_text(encoding="utf-8").splitlines()
+        for idx, line in enumerate(lines):
+            if "no_mangle" not in line:
+                continue
+            for fn_idx in range(idx + 1, min(idx + 8, len(lines))):
+                match = re.search(
+                    r"\bpub\s+(?:unsafe\s+)?extern\s+\"C\"\s+fn\s+([A-Za-z_][A-Za-z0-9_]*)\b",
+                    lines[fn_idx],
+                )
+                if match:
+                    exports.append(
+                        {
+                            "symbol": match.group(1),
+                            "file": str(path),
+                            "line": fn_idx + 1,
+                        }
+                    )
+                    break
+    exports.sort(key=lambda item: (item["symbol"], item["file"], item["line"]))
+    return exports
+
+def collect_scheme_sources(paths):
+    prefixes = ("lib/", "src/", "mcp/", "lsp/", "tools/", "tests/", "support/")
+    out = []
+    for path in paths:
+        text_path = str(path)
+        if path.suffix not in (".ss", ".sls"):
+            continue
+        if not text_path.startswith(prefixes):
+            continue
+        if text_path.startswith("vendor/"):
+            continue
+        out.append(path)
+    return out
+
+def collect_callers(exports, scheme_paths):
+    by_symbol = {item["symbol"]: [] for item in exports}
+    symbols = sorted(by_symbol, key=len, reverse=True)
+    for path in scheme_paths:
+        lines = path.read_text(encoding="utf-8").splitlines()
+        for line_no, line in enumerate(lines, 1):
+            for symbol in symbols:
+                if symbol in line:
+                    by_symbol[symbol].append((str(path), line_no))
+    return by_symbol
+
+def render(exports, callers):
+    total = len(exports)
+    referenced = sum(1 for item in exports if callers[item["symbol"]])
+    unreferenced = total - referenced
+    lines = [
+        "(native-export-review",
+        '  (schema "jerboa.native-export-review/1")',
+        '  (generated-by "support/check-native-export-review.sh")',
+        "  (policy scheme-callers-or-documented)",
+        f"  (summary (exports {total}) (scheme-referenced {referenced}) (no-scheme-reference {unreferenced}))",
+        "  (exports",
+    ]
+    for item in exports:
+        symbol = item["symbol"]
+        refs = callers[symbol]
+        caller_bits = " ".join(
+            f"(caller (file {sexp_string(path)}) (line {line_no}))"
+            for path, line_no in refs
+        )
+        if not caller_bits:
+            caller_bits = "(none)"
+        lines.append(
+            "    (export "
+            f"(symbol {sexp_string(symbol)}) "
+            f"(file {sexp_string(item['file'])}) "
+            f"(line {item['line']}) "
+            f"(scheme-callers {len(refs)} {caller_bits}))"
+        )
+    lines.extend(["  )", ")"])
+    return "\n".join(lines) + "\n"
+
+paths = tracked_files()
+exports = collect_exports(paths)
+callers = collect_callers(exports, collect_scheme_sources(paths))
+current = render(exports, callers)
+
+if mode == "--write":
+    report_path.parent.mkdir(parents=True, exist_ok=True)
+    report_path.write_text(current, encoding="utf-8")
+    print(f"native-export-review: wrote {report_path} ({len(exports)} exports)")
+else:
+    if not report_path.exists():
+        fail(f"missing report {report_path}; run support/check-native-export-review.sh --write")
+    expected = report_path.read_text(encoding="utf-8")
+    if expected != current:
+        fail(f"{report_path} is stale; run support/check-native-export-review.sh --write")
+    print(f"native-export-review: OK ({len(exports)} exports)")
+PY