Proposal: refuse ABI-mismatched extensions with a clear error

[mvanhorn]

Motivation

#903 shows INSTALL/LOAD can report success while a version-mismatched .lbug_extension later SIGSEGVs. Publish-side cache issues are being mitigated; the dangerous gap is the missing hard refusal. DuckDB-style extension version checks fail closed; Ladybug should too.

Research Summary

Evidence Vault

• 0.20.2: no published extension artifacts, and loading a version-mismatched extension segfaults instead of erroring #903 (open): mismatched extension → SIGSEGV; users pin 0.20.1.
• Extension URL embeds LBUG_EXTENSION_VERSION but load path lacks ABI/metadata refusal.
• Open PRs are planner/scan work, not this contract.

Related bug #903 is input evidence. This proposal asks for a durable compatibility contract (metadata + fail-closed LOAD), not a one-off CDN purge.

Proposed Solution

1. Embed a small version/ABI manifest in each extension artifact (or read an adjacent manifest the installer already fetches).
2. On LOAD, compare engine LBUG_EXTENSION_VERSION / ABI tag; on mismatch raise a typed error (no dlopen of incompatible code if detectable before call, or immediate version entry-point check before any other symbol use).
3. Surface status via SHOW LOADED EXTENSIONS (loaded / refused / reason).
4. Document the contract in docs/extensions.md.

Approach

Discussion-first on Ideas. Implementation touches extension loader/manager + tests that stage a mismatched stub.

Test Strategy

E2E: matching loads; mismatched refuses with stable error substring; no segfault fixture.

Alternatives Considered

• Only fix CDN publishing: necessary but insufficient (0.20.2: no published extension artifacts, and loading a version-mismatched extension segfaults instead of erroring #903 issue 2).
• Soft warn and continue: rejected (still segfaults).

PR Strategy

Ideas Discussion; PR after maintainer direction.

Related open bug: #903 (publish side is being mitigated; this proposal is the durable fail-closed LOAD contract).

Happy to open a draft PR if this shape looks right. Looking for maintainer signal before writing code.

[adsharma]

Sounds like a good idea. Allow drift between patch releases, but not between major/minor.