status.json

{
  "updated": "2026-11-03",
  "product": "KeyLoad development preview. Not production ready.",
  "concept": "Orleans owns all clustering and activation scaling. The API reaches one grain per connected client, logical database/partition grains, storage owners and bounded result aggregation. Shared volumes require one open owner per physical partition without copies; isolated volumes use typed Orleans calls between owners. Shared-volume ownership and distributed partition-query execution are not yet qualified.",
  "qualification": {
    "build": "The current Search and remote request lifetime checkpoint passed strict Debug solution build with zero warnings and errors in 2m18.84s. Formatting verification passed for the changed C# files. Compiled discovery matched all 3,053 Functional cases and five groups, with nine CI inventory controls passing. Exact-source Linux qualification remains open; run 41522554841 passed 33 jobs for 2d2a8f560.",
    "unitTests": "All 568 analyzer cases passed for the current-contract batch. An earlier complete 3,047-case Functional run had 11 failures; the stale-contract and obsolete exclusive-reader controls were repaired. A subsequent 420-case local Functional selection passed 418 with two outdated MCP schema expectations. The corrected schema and catalog passed all 10 focused cases. The current Search checkpoint passed 11 focused cases including read-only close, corrupted manifest retry, retired-file ownership, native merge refusal and exact AND search. The actual two-silo remote owner case also passed, returning the original authorized response and joining deactivation after outliving the configured sender default. Latest full Functional execution and Linux coverage remain open.",
    "processRecoveryTests": "The ZoneTree 2.1.1/current-contract batch passed all 154 local Debug process-recovery cases. The current Search checkpoint passed all 24 search process-recovery cases in 28.969 seconds with no failures or skips, covering bootstrap, incremental Sync and online publication. Power-loss qualification is separate.",
    "aspireClusterSdkMcpTests": "Linux run 41522554841 passed all 33 Build and Tests jobs on 2d2a8f560. The local three-node Aspire SDK, MCP, SQL and discovery selection passed all 7 cases after adding typed AND matching and updating discovery expectations. Exact-source Linux and deployed shared-volume, partition fan-out and endurance gates remain open.",
    "coverage": "Numeric product functional coverage remains open, including the 80 line / 70 branch and 90 critical-module thresholds. Compiled inventory, coverage-selector discovery and exact-once execution do not measure this coverage. The Website workflow no longer runs analyzer or authored-website coverage gates.",
    "adminConsole": "open: Blazor Server and Fluent UI components replace the static JavaScript application; Playwright replaces the custom CDP client. Focused browser, complete suite and exact-source Linux qualification must be recorded separately.",
    "performance": "Only canonical Linux Benchmarks artifacts supply website figures. Run 41528796049 used released 2d2a8f560: vector/n1 and analytics/n1 returned 503 OwnershipLost, events/n3 received a runner shutdown signal, search/n3 failed and search/n1 hit the 220-minute session deadline after index and term-query BudgetExceeded. The old benchmark suppressed backend container logging; current source restores Warning/Error output. Native ZoneTree 2.1.1 benchmarks completed 126 rows and 40,320,000 groups; all 84 transactional after-reopen invariants passed. Matched local analytics captures examined 200,000 versus 10,000 events and allocated 321,314,655 versus 20,535,957 bytes. A fixed-work full-text pair verified 24,000 cold postings: allocations fell from 1,217,010,256 to 69,167,416 bytes and registered-root censuses fell from 145,893 to 2,523. The construction checkpoint verified all 11,999,937 cold postings for one million documents within 240 seconds. A full authorized Core query on that checkpoint verified exact top ten and full JSON at an unchanged cut, allocated 2,980,286,984 bytes and failed shutdown while staging a second manifest under the generation quota. The sealed read-only close verifies the existing manifest after joining the native index. A replay on the repaired checkpoint verified exact top ten and JSON for one million documents, exited successfully after joined close and retained the byte-identical published manifest. A matched 200,000-document warm query comparison reduced managed allocations by 15.76%, from 538.12 MB to 453.31 MB per query, by moving two write-only closures out of the read path. All 16 queries on each producer returned exact results and both runs joined shutdown. Full-corpus capture and tokenization remain under investigation. Exact-source Linux qualification and released-image benchmarks remain open. See docs/implementation/zonetree-native-measurements.md, analytics-performance.md and fulltext-performance.md.",
    "benchmarkModels": "Each of the ten data types has one shared dataset, scenario and driver interface in benchmarks/KeyLoad.ComparisonHost (seed 1729, 16 clients, 1,000,000 records, 100,000 measured operations per case). Per-database drivers, the Release build of the benchmark client and the first Linux run of every job remain to be verified. KeyLoad uses one partition per job, so its 3-node results will not qualify partition fan-out. ANN, fault and endurance qualification remain separate.",
    "powerLossDurability": "Not proven; process-kill tests do not prove it.",
    "endurance": "open",
    "sharedVolumeStorage": "open: lazy single-owner sessions are in source; execution runtime, owner loss/reopen and deployed filesystem locking/flush qualification remain required",
    "distributedPartitionQueries": "open: execution logical-partition dispatch is in source; exact owner, budget, authorization and aggregation behavior requires runtime and delivered-source qualification",
    "operationLimits": "The ADR-149 implementation is included in the complete Linux test inventory executed by run 41106618439 on b630b7dffa7b8ca6b48d421ad63f1f2f9d7339d0. Its feature-specific acceptance mapping, numeric functional coverage and endurance remain open.",
    "fileStorage": "open: published ManagedCode.Storage.Server/FileSystem at the approved central pins are composed with metadata-only ZoneTree publication, persisted scope/row authorization, quotas, verified reads and bounded cleanup. Complete Debug solution build and local three-node whole-model SDK/MCP/SQL execution pass, including native HTTP file uploads, exact downloads and denied writes. Physical restore, range/cancellation/endurance and deployed shared-provider cluster qualification remain open; Linux evidence must match the exact committed source and packages."
  },
  "evidence": "Qualification evidence lives only in GitHub Actions runs and their original artifacts for the exact delivered source.",
  "implementation": "Orleans-execution runtime integration is in progress. The commit grain caches copy owners per membership version instead of reading every silo per write; KeyLoad owns no write-ahead log, backup, snapshot or archive format (ADR-011): ZoneTree 2.1.1 owns Shared WAL for MVCC and SyncCompressed WAL for direct resource data, a commit is one ZoneTree transaction that also holds the store position, acknowledgements require synchronous process-persistent WAL publication, opened native writers are checked before admission, and ZoneTree owns periodic disk sync, and a backup is the store identity plus one native LiveBackup snapshot generation per tree, with independent cuts, restored under a new identity with dispatch paused; the SQL gateway lowers SELECT once to the typed plan and the SDK carries no parser; stateless background workers sweep persisted work with one polling activation per silo and no in-memory buffer; internal grain requests are typed Orleans envelopes validated by scope on every receiving grain, with no per-hop string token or HMAC (ADR-144); native snapshots and serializable conflict retries replace application read/write gates; native maintainers replace the custom cache and cleanup timer; non-transactional tables use a separate native plain tree whose process-persistent WAL publication precedes transactional outcomes; key encoding takes typed components without boxing; the comparison harness has no warm-up phase anywhere. Request handling imposes no concurrency, request-count or reserved-byte admission on callers (ADR-145): the HTTP, command and MCP memory admission pools, the per-connection, per-silo producer and connection caps, the ANN reader caps, the per-engine analytical-read cap, the change-outbox producer quota and progress reserve, and the full-text reader and maintenance-session count caps are gone; only the server-wide request-body limit and the physical reply and protocol bounds remain, and the KeyLoad benchmark cells no longer carry an admission profile. Operations have no configured size or work limits (ADR-149): KeyLoad:DatabaseLimits keeps only the optional queue transfer attempt policies; document size, JSON depth, batch, scan, result, SQL text/depth/token, read-byte, search-token, projection and fixed-deadline refusals are gone; reads count no bytes or records and stop only on caller cancellation, internal request envelopes carry no expiry, complete ranges page through the storage range page, recursive SQL, AST and JSON walkers fail with Validation only when the execution stack runs short, and results, pages and grain request streams have no byte or frame cap (pages are bounded by their record limits). Concurrent canonical commands commit in batches (ADR-146): the reentrant commit grain queues them, every copy applies a batch as one process-persistent ZoneTree commit with parallel copy calls, each command keeps its own canonical sequence and outcome, and a copy that missed the last batch is completed from its retained commands; the engine and store contracts have unit tests, while cluster throughput and fault qualification of the batch path remain open. Queries ordered by ascending document id continue after the last emitted id instead of an offset (ADR-147): a full scan seeks past that id and stops one row past the page, so reading a collection page by page reads each document once, and no query range read asks storage for more than its per-range maximum. Build and Tests first completes one strict solution build (ADR-148), then test jobs consume its compiled artifact without rebuilding. Each Aspire lane runs on its own runner with native discovered ports. The final job requires exact compiled test coverage without duplicate execution, and Release publishes a push to main only after this workflow succeeds for that commit. Each source revision retains its own qualification boundary. IsolatedVolumes uses silo-local full copies; SharedVolume acquires one physical session through an ordinary database activation and joins its borrowers before close. PartitionQuery and DistributedSearch dispatch bounded leaves through ordinary Orleans partition grains and pin one actual owner per logical partition. Workers and durable coordinators use typed owner reads. Complete runtime and delivered-source qualification is open. Ordinary operations without progress consumers now drain the shared Communication CQRS producer on each independent ordinary request grain and return a settled Orleans Task reply; progress consumers and composed operations retain native response enumeration. Independent requests still use separate execution grains, fresh persisted authority and joined cleanup. Focused local connection checks and small real SDK diagnostics pass; exact-source Linux runtime and benchmark qualification of this transport change remain open. Published bootstrap text generations now share one native read-only index among independent readers, check only the owned file set at publication, settlement and cleanup, and join retained readers before invalidation, retirement or shutdown. A focused local batch passed 39 functional-assembly executions, 10 process-assembly recovery cases and four real Aspire SDK/MCP authorization/readiness cases, with no unobserved notices in that batch. The single staged bootstrap build and three-generation physical ceiling remain; parallel cold scopes, complete catch-up, endurance and exact-source Linux qualification remain open. Native typed command inputs, request envelopes and replies now replace private nested encoded operation/result buffers. Five auxiliary MemoryStream paths use standard .NET buffer/hash APIs; real key-format controls passed 22 cases. Selected full-text generation qualification remains open; ZoneTree rewrites its own metadata on a clean reopen (ZoneTree issue 209), so KeyLoad no longer hashes engine-owned files (docs/Features/Search/FullTextProjection.md). Commands carry no fingerprint: a retry compares the public input shape of the retained command only when a stored outcome exists (ADR-140), and a resource incarnation is the creating command GUID. A selected full-text search checks the generation's manifest sequence instead of re-reading and hashing the source corpus, reuses the validated manifest and its record maps until the manifest file changes, and keeps the native index open between searches. No competitive performance claim follows from these local changes. Scalar EXPLAIN now describes the access path selected by the same planner used for execution, with seek fields, bound presence, residual fields, read cut, ordering, retained rows and projection; it neither scans candidates nor reports invented costs. Local profiling identified repeated resource-catalog decoding in the KeyLoad storage adapter. A read operation reuses one routing decision only within its immutable native snapshot, with complete key validation. Terminal vector-only searches retain exact top-K when fusion ordering permits it; hybrid and distributed branches retain complete rankings. Graph traversal supports full, vertex-only and count output with the same visibility and traversal semantics. Ordinary HTTP/SQL operations authenticate the credential subject and authorize at their database operation owner; metadata-consuming adapters retain current authority reads. Independent request execution grains remain. These changes carry no competitive or power-loss claim; see docs/implementation/jepsen-particledb-review.md. Partition keys write typed scopes and dynamic suffixes directly into the existing key buffer, without intermediate component lists. Internal decoding reuses Orleans' registered singleton typed serializer with independently pooled sessions. Key bytes, application envelopes, aliases and versions remain unchanged; literal-byte, component-boundary and complete serialization controls retain their qualification gates."
}