Explicit, all the way down.

One ordered writer. Immutable snapshots. A checksummed journal. Every layer has a named job, a bounded input and a visible failure. That is how an engine stays understandable for decades.

Follow a write Built for fifty years
Cross-section of the engineIllustrative · layers, not a deployment diagram
Soil layers as engine layers Five stacked soil layers from the surface down: interfaces, authority and schema, the state engine, journal and checkpoints, and storage profiles. Roots run down through all of them. Interfaces SQL · documents · graph · MCP · embedded API Authority & schema permission at delivery and at commit · typed schemas State engine persistent immutable AVL map · structural sharing · branch heads Journal & checkpoints 64-byte frames · SHA-256 · checkpoints · compaction Storage profiles RAM · native paged (PG3) · WebAssembly SURFACEGATEMEMORYEVIDENCEBYTES
Today

Local foundations with functional evidence: state engine, journal, recovery, document and bounded query paths.

Aim

All of these shapes served by one engine, from a phone to dedicated server nodes. Native and browser profiles differ in guarantees.

The write path

A commit earns its acknowledgement.

Nothing is reported as done until the exact intent is on storage. If the outcome is unknown, RURAL says so. It never guesses.

Walk through one commitIllustrative sequence · autoplays in view

  1. The caller sends a change with the branch's expected head and a scoped request identity.

  2. Schema, limits, authority and the expected head are checked. A stale or oversized request is refused here. Nothing has changed.

  3. Candidate roots and the receipt are built off to the side. Visible state is untouched, and the work can still be cancelled safely.

  4. The exact intent is appended at its expected sequence and synchronized through the operating system. A write or sync error is an unknown outcome: normal use stops and the first uncertain boundary is recorded.

  5. The prepared roots become current in one allocation-free step. Readers already holding a root keep theirs.

  6. The caller gets the receipt. If the reply was lost, retrying the same scoped identity returns the original result and repeats no effect.

The write path as six stages Six stages in a row: request, validate, prepare, journal with OS sync, publish, receipt. Below them, a journal strip gains a new frame at stage four, the visible root advances at stage five, and a dashed branch from stage four shows the unknown-outcome path. 1Request 2Validate 3Prepare 4Journal + sync 5Publish 6Receipt JOURNAL VISIBLE ROOT head 41 head 42 Unknown outcome: reported, never guessed receipt #42
Step 1 of 6

Order and boundaries follow the documented design. The durable owner's complete native acceptance is still open, and one local copy cannot survive loss of its only disk.

Snapshots & branches

Readers get a stable world.

Records live in a persistent, immutable balanced map. A new version copies only the path that changed and shares the rest.

Two roots, one shared treeIllustrative
Structural sharing between two versions of a tree An older root with seven nodes. A newer root copies only the root, one child and one leaf on the path to a changed record, and points to the untouched nodes of the older tree. ROOT v1 · READER ROOT v2 · NEW SHAREDCOPIED PATH
  • Retaining a root is constant workCloning a map keeps its root. No records are copied, so retaining a snapshot is constant structural work however large the map.
  • Fork, evolve, mergeA fork starts at an explicit source head. Parent, child and grandchild evolve independently; a bounded three-way document merge reconciles them at a checked target head.
  • Tested against a model1,024 insert/delete balance tests, and 2,400 randomized operations over 12 snapshots compared with an independent model.

Retained history still uses memory, and releasing the last owner of a large snapshot can take linear time. These are structural properties, not throughput claims.

Journal & recovery

A damaged tail stops recovery.

An unreadable suffix could be an interrupted append, outside truncation or damage to something already acknowledged. The bytes alone cannot say. So RURAL keeps them and stops.

Anatomy of a frame, and of a stopIllustrative · widths not to scale
Journal frame header and a recovery stop A 64-byte frame header containing magic, version, kind, reserved bytes, sequence, length and a SHA-256 digest, followed by a payload. Below it, a row of journal frames where intact frames are replayed and a damaged frame halts recovery with its bytes preserved. magicversionkindreservedsequencelengthSHA-256payload (bounded) 64-BYTE HEADER · LITTLE-ENDIAN seq 38seq 39seq 40seq 41digest mismatchnot read VALID PREFIX STOP · BYTES PRESERVED · RECOVERY REQUIRED

Never silently truncated

A malformed reopened suffix is preserved and reported at its first problem boundary. A valid prefix is evidence, not permission to serve a half-rebuilt database.

Checkpoints and compaction

Open from a checkpoint and stream only the bounded suffix. Offline rural compact writes a verified store to a new directory and leaves the source untouched.

Restore into private staging

Backup archive v3 carries the current pointer, a manifest and a checkpoint image. Restore replays in an exclusive staging directory and publishes only to an absent destination.

Where this stopsIn development
  • On macOS the journal uses ordinary fsync, not F_FULLFSYNC.
  • Fault injection and process-kill tests establish specific behaviour. They are not power-loss certification.
  • One local copy cannot survive loss of its only host or disk. Replication and off-host backup need their own work and evidence.
  • An unkeyed checksum catches accidental damage. It is not encryption or writer authentication.
Authority

Data cannot grant itself authority.

Imported text, analytics payloads and model output are records. Storing them never turns them into instructions or permissions.

Two checks, not oneIllustrative
Permission is checked at delivery and again at commit A request travels left to right through a delivery gate, preparation, and a commit gate before it changes state. A revoked permission is stopped at either gate. request check 1delivery prepare check 2commit state REVOKED · STOPPED AT EITHER GATE

Both checks are named invariants in the TLA+ authority model. The application owner still authenticates the actor; an epoch number is not an access-control system.

  • Mandates name one exact actionNo wildcards, and an expiry: valid only while now is before the expiry time. Today this is a local, synthetic test-credit exercise.
  • History does not restore revoked powerOpening an old branch never revives credentials. A child has no broader capability than its creation scope allows.
  • Copying grants nothingCopied action history cannot start jobs, resend a transaction or launch a process.
Today

Bounded parsers, local authority checks, model-checked invariants.

In development

Public transport, rate limits and an independent boundary review. No security certification is claimed.

Growth rings from 2026 toward 2077 Concentric growth rings. The centre is 2026. Inner rings are solid, standing for design properties that exist today. The outermost ring is dashed and marked 2077, a continuity target and an aim. FORMATSNO FOREIGN ENGINERECEIPTSBOUNDEDMODELLED 2077 · CONTINUITY TARGET · AN AIM 2026 ILLUSTRATIVE
Longevity design

Built for fifty years.

Fifty years is the horizon we design toward. The project's formal target is continuity through 2077 by compatibility, migration, recovery and bounded resources. It is an aim, not a lifetime guarantee.

<1 MiB

Working memory, bounded case

A paged proof held 4 MiB values in under 1 MiB accounted working memory. Correctness and resource bound, not speed.

9 / 25

TLA+ models / configurations

10 positive and 15 deliberate counterexamples. Bounded model checking, not an unbounded proof.

0

Foreign engines underneath

No SQLite or RocksDB inside. Zig standard library and OS APIs only.

2077

Continuity target

A direction we build toward, with no lifetime reliability claim.

  • First-party only TodayThe engine and its shipped runtime libraries are our own code. No dependency rot, no upstream database to be abandoned. Compliance across every surface is still being audited.
  • Versioned, portable formats TodayExplicit field widths and byte order. No pointers, no padding, no host endianness. Bytes written on one machine read the same on another.
  • Obsolete formats are refused TodayEvery format carries a version. Before 1.0, obsolete readers are removed, old bytes are preserved and nothing migrates silently.
  • Immutable history and receipts TodayAccepted changes are appended, not overwritten. Receipts are never silently evicted, so a retry months later still gets the original answer.
  • Bounded resources TodayEvery boundary admits a stated amount of work. Process-wide memory and disk budgets still need integration across layers.
  • Formal TLA+ models TodayAcknowledged implies durable. Receipt identity is exact. Branches stay isolated. Permission is checked at delivery and commit. Byte corruption and memory safety are outside these models.
  • Destructive maintenance off by default TodayAny path that deletes or overwrites data as a side effect ships disabled. Checkpoint reclaim stays off unless enabled, and every deletion is logged. Compaction and restore write to a new place and leave the source alone.
  • Continuity to 2077 AimSuccession, crypto agility and key custody are design work. The target guides decisions; it is not a promise about any single copy of your data.
Check the claims

Read the evidence, then the design.

Every number on this page has a scope and a limit. See what was measured, and read the architecture in full.

See the evidence Architecture docs