status.json

{
  "updated": "2026-11-01",
  "product": "KeyLoad development preview. Not production ready.",
  "concept": "Orleans owns all clustering and activation scaling. The API reaches one grain per connected client, logical database/partition grains, storage owners and bounded result aggregation. Shared volumes require one open owner per physical partition without copies; isolated volumes use typed Orleans calls between owners. Shared-volume ownership and distributed partition-query execution are not yet qualified.",
  "qualification": {
    "build": "All 21 local Debug projects pass formatting verification and build with warnings treated as errors. Published pins include ZoneTree 2.0.7, Orleans 10.4.2 with matching existing alpha.1 packages, MCPGateway 2.3.3 and StackExchange.Redis 3.4.29. Native MVCC is the sole canonical tree at data epoch 8. Build and Tests run 41106618439 passed all 21 jobs on b630b7dffa7b8ca6b48d421ad63f1f2f9d7339d0. Release run 41102214296 passed all 29 jobs on runtime source ffe03f258bd81ef1641d5059ba92b83b20f5e66d and published the server image and six platform archives.",
    "unitTests": "Linux run 41106618439 executed all 3309 reviewed functional-assembly cases and 507 analyzer cases. The reviewed operation-contributor census remains 2868 cases, with 441 mandatory controls tracked separately. The ZoneTree write-ahead-log and live-backup storage design (ADR-011) has no Linux run yet; its new and adapted StorageRecovery and BackupRestore cases are unqualified. Original failures remain retained. Numeric product coverage and full feature acceptance remain separate qualifications.",
    "processRecoveryTests": "All 215 real-process recovery cases of revision b630b7dffa7b8ca6b48d421ad63f1f2f9d7339d0 passed without skips in Linux run 41106618439; original receipts are retained. The current crash matrix over ZoneTree's own write-ahead log (MutationApplied, ApplyCompleted and WriteAheadLogSynced) has no Linux run yet. Process kill does not prove power-loss durability.",
    "aspireClusterSdkMcpTests": "Linux run 41106618439 passed all 359 current cluster cases across 13 named groups on b630b7dffa7b8ca6b48d421ad63f1f2f9d7339d0, including replicated recovery and composition. The final exact-once job validated 54 original TRX reports across analyzer, functional, process and cluster execution. Aspire owns startup, discovered endpoints, fault commands and joined cleanup. Deployed shared-volume behavior, complete partition fan-out, numeric product coverage and endurance remain separate open qualifications.",
    "coverage": "Numeric product functional coverage remains open, including the 80 line / 70 branch and 90 critical-module thresholds. Compiled inventory, coverage-selector discovery and exact-once execution do not measure this coverage. The Website workflow no longer runs analyzer or authored-website coverage gates.",
    "adminConsole": "open: Blazor Server and Fluent UI components replace the static JavaScript application; Playwright replaces the custom CDP client. Focused browser, complete suite and exact-source Linux qualification must be recorded separately.",
    "performance": "Benchmarks runs one Linux job per database, data type and node count (ADR-150), and Website renders the original result files of one run. Run 41320142728 completed with failures: KeyLoad document/relational range queries were unsupported, vector queries exceeded the Orleans response window, and full-text index creation failed. Successful cases retain their original measured values; failed cases retain their errors. Current local tuning and scalar access plans require exact-source Linux qualification and a released-image benchmark run. Figures on GitHub-hosted runners describe that run with unmatched hardware; matched-hardware competitive performance remains unqualified.",
    "benchmarkModels": "Each of the ten data types has one shared dataset, scenario and driver interface in benchmarks/KeyLoad.ComparisonHost (seed 1729, 16 clients, 1,000,000 records, 100,000 measured operations per case). Per-database drivers, the Release build of the benchmark client and the first Linux run of every job remain to be verified. KeyLoad uses one partition per job, so its 3-node results will not qualify partition fan-out. ANN, fault and endurance qualification remain separate.",
    "powerLossDurability": "Not proven; process-kill tests do not prove it.",
    "endurance": "open",
    "sharedVolumeStorage": "open: lazy single-owner sessions are in source; execution runtime, owner loss/reopen and deployed filesystem locking/flush qualification remain required",
    "distributedPartitionQueries": "open: execution logical-partition dispatch is in source; exact owner, budget, authorization and aggregation behavior requires runtime and delivered-source qualification",
    "operationLimits": "The ADR-149 implementation is included in the complete Linux test inventory executed by run 41106618439 on b630b7dffa7b8ca6b48d421ad63f1f2f9d7339d0. Its feature-specific acceptance mapping, numeric functional coverage and endurance remain open.",
    "fileStorage": "open: published ManagedCode.Storage.Server/FileSystem at the approved central pins are composed with metadata-only ZoneTree publication, persisted scope/row authorization, quotas, verified reads and bounded cleanup. Complete Debug solution build and local three-node whole-model SDK/MCP/SQL execution pass, including native HTTP file uploads, exact downloads and denied writes. Physical restore, range/cancellation/endurance and deployed shared-provider cluster qualification remain open; Linux evidence must match the exact committed source and packages."
  },
  "evidence": "Qualification evidence lives only in GitHub Actions runs and their original artifacts for the exact delivered source.",
  "implementation": "Orleans-execution runtime integration is in progress. The commit grain caches copy owners per membership version instead of reading every silo per write; KeyLoad owns no write-ahead log, backup, snapshot or archive format (ADR-011): ZoneTree's write-ahead log in AsyncCompressed mode is the only redo log, a commit is one ZoneTree transaction that also holds the store position, acknowledgements await the write-ahead log sync, and a backup is the store identity plus one native LiveBackup snapshot generation per tree, with independent cuts, restored under a new identity with dispatch paused; the SQL gateway lowers SELECT once to the typed plan and the SDK carries no parser; stateless background workers sweep persisted work with one polling activation per silo and no in-memory buffer; internal grain requests are typed Orleans envelopes validated by scope on every receiving grain, with no per-hop string token or HMAC (ADR-144); native snapshots and serializable conflict retries replace application read/write gates; native maintainers replace the custom cache and cleanup timer; non-transactional tables use a separate native plain tree whose WAL sync precedes transactional outcomes; key encoding takes typed components without boxing; the comparison harness has no warm-up phase anywhere. Request handling imposes no concurrency, request-count or reserved-byte admission on callers (ADR-145): the HTTP, command and MCP memory admission pools, the per-connection, per-silo producer and connection caps, the ANN reader caps, the per-engine analytical-read cap, the change-outbox producer quota and progress reserve, and the full-text reader and maintenance-session count caps are gone; only the server-wide request-body limit and the physical reply and protocol bounds remain, and the KeyLoad benchmark cells no longer carry an admission profile. Operations have no configured size or work limits (ADR-149): KeyLoad:DatabaseLimits keeps only the optional queue transfer attempt policies; document size, JSON depth, batch, scan, result, SQL text/depth/token, read-byte, search-token, projection and fixed-deadline refusals are gone; reads count no bytes or records and stop only on caller cancellation, internal request envelopes carry no expiry, complete ranges page through the storage range page, recursive SQL, AST and JSON walkers fail with Validation only when the execution stack runs short, and results, pages and grain request streams have no byte or frame cap (pages are bounded by their record limits). Concurrent canonical commands commit in batches (ADR-146): the reentrant commit grain queues them, every copy applies a batch as one ZoneTree commit with one write-ahead log sync and parallel copy calls, each command keeps its own canonical sequence and outcome, and a copy that missed the last batch is completed from its retained commands; the engine and store contracts have unit tests, while cluster throughput and fault qualification of the batch path remain open. Queries ordered by ascending document id continue after the last emitted id instead of an offset (ADR-147): a full scan seeks past that id and stops one row past the page, so reading a collection page by page reads each document once, and no query range read asks storage for more than its per-range maximum. Build and Tests runs as parallel jobs (ADR-148): one solution build gate, four unit shards, analyzers with process recovery, and thirteen Aspire shards of two serial lanes each with at most one cluster per lane, all from scripts/Features/TestInfrastructure/ci-test-shards.json; a final job checks that every test class ran exactly once, and Release publishes each push to main after this workflow succeeds for that commit; each source revision requires its own successful original execution and exact-once verification artifacts. IsolatedVolumes uses silo-local full copies; SharedVolume acquires one physical session through an ordinary database activation and joins its borrowers before close. PartitionQuery and DistributedSearch dispatch bounded leaves through ordinary Orleans partition grains and pin one actual owner per logical partition. Workers and durable coordinators use typed owner reads. Complete runtime and delivered-source qualification is open. Ordinary operations without progress consumers now drain the shared Communication CQRS producer on each independent ordinary request grain and return a settled Orleans Task reply; progress consumers and composed operations retain native response enumeration. Independent requests still use separate execution grains, fresh persisted authority and joined cleanup. Focused local connection checks and small real SDK diagnostics pass; exact-source Linux runtime and benchmark qualification of this transport change remain open. Published bootstrap text generations now share one native read-only index among independent readers, check only the owned file set at publication, settlement and cleanup, and join retained readers before invalidation, retirement or shutdown. A focused local batch passed 39 functional-assembly executions, 10 process-assembly recovery cases and four real Aspire SDK/MCP authorization/readiness cases, with no unobserved notices in that batch. The single staged bootstrap build and three-generation physical ceiling remain; parallel cold scopes, complete catch-up, endurance and exact-source Linux qualification remain open. Native typed command inputs, request envelopes and replies now replace private nested encoded operation/result buffers. Five auxiliary MemoryStream paths use standard .NET buffer/hash APIs; real key-format controls passed 22 cases. Selected full-text generation qualification remains open; ZoneTree rewrites its own metadata on a clean reopen (ZoneTree issue 209), so KeyLoad no longer hashes engine-owned files (docs/Features/Search/FullTextProjection.md). Commands carry no fingerprint: a retry compares the public input shape of the retained command only when a stored outcome exists (ADR-140), and a resource incarnation is the creating command GUID. A selected full-text search checks the generation's manifest sequence instead of re-reading and hashing the source corpus, reuses the validated manifest and its record maps until the manifest file changes, and keeps the native index open between searches. No competitive performance claim follows from these local changes. Scalar EXPLAIN now describes the access path selected by the same planner used for execution, with seek fields, bound presence, residual fields, read cut, ordering, retained rows and projection; it neither scans candidates nor reports invented costs. Local profiling identified repeated resource-catalog decoding in the KeyLoad storage adapter. A read operation reuses one routing decision only within its immutable native snapshot, with complete key validation. Terminal vector-only searches retain exact top-K when fusion ordering permits it; hybrid and distributed branches retain complete rankings. Graph traversal supports full, vertex-only and count output with the same visibility and traversal semantics. Ordinary HTTP/SQL operations authenticate the credential subject and authorize at their database operation owner; metadata-consuming adapters retain current authority reads. Independent request execution grains remain. These changes carry no competitive or power-loss claim; see docs/implementation/jepsen-particledb-review.md. Partition keys write typed scopes and dynamic suffixes directly into the existing key buffer, without intermediate component lists. Internal decoding reuses Orleans' registered singleton typed serializer with independently pooled sessions. Key bytes, application envelopes, aliases and versions remain unchanged; literal-byte, component-boundary and complete serialization controls retain their qualification gates."
}