Ambition, with receipts.

Root 2.1 kernel API freeze (I-01, R-10/R-10f): ABI 1.4 (0x00010004) freezes 34 symbols. The annotated root-2.1 tag points to 4e84fec244a29f348946ec006894c51df87290b7; signature review remains pending after the history rewrite. Process-crash evidence does not qualify power-loss durability. See the frozen contract.

RN-01b packages the offline rural-grove-fsck checker alongside the Grove library with reproducible checksums. Complete, clean checks return 0; incomplete/refused checks return 3 and corruption/unacknowledged data return 6.

RN-02a/RN-02b move service probes to rural.prototype/2 with explicit receipt epochs and retained retry bodies. RN-03 maps InvalidProtocol to invalid_request. RN-04 repairs the crash-child builds; MAIN reports 537 abrupt-kill checks passing. This does not renew full-profile qualification.

RN-11b sends protocol 2 from CLI backup and wires create, get, query, delete, batch and fork through the existing request routes. Short patch refuses with guidance to use request command with merge_patch.

README quick start writes and reads a document across a clean local-service restart, with an executable check of the documented commands.

The website serves the rebuilt solarpunk static site (website/site, generated from website/site-src) and the Murmur game at /murmur/, alongside /aquarium/. The markdown/template pages, /api/meta and the old /assets routes are retired; moved pages redirect. The image now ships the static site and the Murmur web client, and the aquarium client files missing from the build-context allowlist are admitted. Product VERSION is unchanged.

VERSION 0.0.44: adds bounded first-party paged storage and retained transaction history, maintained document-index custody, explicit receipt lifecycle controls and whole-transaction feeds. The native visual client uses macOS system window, drawing and font APIs; website navigation and search use first-party browser code. Profile limits remain explicit; distributed security and hosted production operation are not qualified. Bounded migration planning/replay/readback, local maintenance decision models, primitive-vector checks and hosted-cost/operator tooling remain scoped foundations with explicit incomplete production gates.

The product website explains six connected uses of one engine: typed queries, documents, relationships, exact numeric/RAM work, retained history/recovery and embedding/application workflows. Current profile limits and future sharing, security and distributed work are distinct. Public documentation links to the existing aquarium now open its standalone runtime through full navigation.

VERSION 0.0.43: adds maintained indexed document reads, bounded SELECT and filtered COUNT, exact signed-integer SUM, scalar membership, grouped COUNT, owner-only inner equality joins and explicit document path updates. RAM consumers support expiring exact numeric values, logical-image transfer, typed maintenance and branch custody. Native owner-only collection-feed polling preserves whole batches and cached transitions. Native recovery reads journals incrementally and decodes checkpoint files through a bounded serialized window. Browser numeric traces remain ephemeral.

Removes obsolete pre-v1 admission formats and unused ServicePort v1. Existing DetailedServicePort2 and current transaction/replay/authority contracts remain canonical. Unsupported historical bytes remain intact; no automatic migration or broader SQL, distributed security, paging or whole-phase qualification follows.

VERSION 0.0.42: adds nested typed schemas, ephemeral document sessions, exact integer key-values and owner-local quantity summaries. The existing aquarium exposes portable capability and numeric tours with lossless decimal values; native synthetic authenticated envelopes remain local and do not encrypt stored databases. New bounded consumers support coherent projection reads and replay of original integer intents after an uncertain acknowledgement.

A synthetic integer recovery consumer records a private original RURALTX3 intent before publish, then replays its exact identity after an owned process exit before acknowledgement. Independent observation proves the receipt and values were already committed before replay; wrong-store, corrupt and stale capsules refuse without publication. This is a bounded process-cut proof.

The existing aquarium adds an exact integer tour: actual native/WASM i64/u64 extrema and values above 2^53, atomic transfer, checked addition, CAS/overflow refusals and original-plan receipt replay. Decimal strings stay lossless in the presentation. Matching desktop WK focus, finite playback and close pass; device and reduced-motion visual acceptance remain pending.

A bounded explicit-ID UBI projection reader keeps source/type/shape/lens reads on one lease and fails closed on expiry, identity, delivery or release failure. Structural output is the default; row artifacts require explicit private creation.

A local embedded integer key-value facade preserves full signed/unsigned64-bit values and lowers bounded CAS/checked-add batches through existing receipts. Immutable-plan retry, durable/RAM recovery and raw-writer limits are explicit; no faster storage or additional service authorization is claimed.

Add opt-in nested typed schema rules with unchanged legacy encodings, explicit ephemeral document sessions and owner-local integer summaries with revision-bound provenance and ordinary document receipts. A native synthetic authenticated-envelope prototype uses generated ephemeral keys; it does not encrypt stored databases or provide post-quantum custody. The existing aquarium can run these real bounded capabilities and replay their observed outcomes; portable runs explicitly report native encryption unavailable. Native WK desktop playback and keyboard focus are qualified; IAB/mobile, reduced-motion and physical-device visual qualification remain pending. A bounded synthetic notebook CLI demonstrates the actual owner request/retry/restart flow.

VERSION 0.0.41: adds an actual-frame aquarium preview to the homepage, touch pan/pinch controls and visible mobile panel buttons. Browser-local current and previous checkpoints restore through core validation; bounded database pages bind both tick and request revisions. Owner comparison, mesh outcomes and recipient-record witnesses distinguish actual state from retained observations. Optional command rehearsal executes a separate bounded WASM engine and checks typed outcomes and semantic content while preserving the live world.

VERSION 0.0.40: the living aquarium adds a route to the product website through the same real Zig WebAssembly engine. Optional records, transactions and portable local correctness checks remain inspectable; native durability/process testing stays local and is unavailable on the hosted page.

Aquarium optional database showcase: inspect actual creature records and Engine metadata; run a disposable real RAM safety tour or an optional exact-binary native durability/recovery tour. Ordered operation histories, observed assertions, serial checking, corrupted-read negative controls and seed replay/export make local correctness evidence inspectable. These are Jepsen-inspired bounded local checks, not actual Jepsen-framework or distributed linearizability verification. Existing game art/audio/ecology and resource ceilings remain unchanged.

Aquarium demo: a shared Zig core runs a procedural spectator world through browser WebAssembly and a local native macOS app. Creatures inherit bounded mojo, keep real RURAL RAM records, form nearby mesh views and exchange typed messages that drive their behavior, individual voices and readable transcripts. Seamless pixel scenery and quiet settlement growth accompany optional care controls and an independent database observatory. Checkpoints are versioned game state; large-number scenes are labeled projections. Bounded native/WASM lifecycle and final browser visuals pass; final-package native GUI save/load remains unqualified after UI automation rejected changed bundle state. This demo does not qualify production federation, encryption, durability or hardware throughput. See the aquarium and its contract.

Local development lab: a portable deterministic colony model supports seeded replay, virtual time and resource profiles, bounded faults and recovery. An original Thronglets-inspired 2D world provides interactive care and simulation controls. A separate loopback adapter exercises real RURAL snapshot writes, exact retries and recovery; scoped housekeeping preserves evidence and active work. Model results remain distinct from actual-engine functional evidence and hardware performance qualification. See the lab and its contract.

VERSION 0.0.39: explicit local contributed-work profile adds bounded grants, exact integer chunk jobs, lease/outbox identity and independently checked synthetic TEST_CREDIT accounting in one protected engine transaction. Unknown execution retains reservations; completion replay cannot duplicate accepted contributions. Reopened/restored work is quarantined. Remote transport, encryption, private-data exchange and real rewards remain future gates.

VERSION 0.0.38: owner-authorized snapshot inventory supports bounded HTTP and additive typed open/page/release, exact retained bytes, safe retries and expiry cleanup. Typed branch fork/drop preserve existing layouts and receipt identities. Independent reconciliation and read-only export tools compare source mappings, schemas, relations, content chunks and original receipts. Native application and actual-corpus acceptance remain open.

Website: describe checkpoint-aware recovery, validated import receipts and internal snapshot pages, with public inventory, complete corpus reconciliation and native acceptance still open. Query documentation states the implemented conjunction, missing-field and numeric comparison rules; the recovery illustration shows refusal on an incomplete journal tail.

VERSION 0.0.37: internal snapshot inventory adds bounded collection membership and authoritative relation pages, preserving empty/orphan/tombstone membership and exact relation bytes. Complete terminal pages use their full byte allowance; partial pages retain a safe exclusive continuation. Public cursor authority, service/native integration and entire-corpus acceptance remain open.

VERSION 0.0.36: Application ports support revision-checked set/unset patches and deletes through the existing v1/v2 interfaces. Strict bounded wrapper validation preserves exact JSON numbers; original seven-field receipts remain replayable across HTTP, restart and restore (restore part superseded since 0.0.44: restore binds a fresh store identity with an empty retry ledger and receipt floor captured sequence + 1; original receipts stay valid only on the source store. Current: docs/prototype/features/backup-recovery.md:114-120). Public inventory, native hosting and complete corpus acceptance remain open.

VERSION 0.0.35: checkpoint-dependent stores use version-3 backups containing the selected checkpoint and frozen journal prefix. Restore replays privately before exclusive destination publication, retains v1/v2 compatibility and preserves a published destination on uncertainty. Compacted stores refuse incompatible checkpoint replacement; journal, memory and receipt limits remain unchanged.

VERSION 0.0.34: curated imports advance only after complete matching receipts and retain compact original receipt witnesses. Resume validates frozen-action payloads, source-bound custody records and complete action coverage; legacy completed progress without receipts refuses safely.

VERSION 0.0.33: internal document pages enumerate one retained collection snapshot with bounded rows and bytes, canonical exclusive continuation, tombstones, and owned response buffers. Public inventory cursors and complete corpus reconciliation remain unavailable.

Website: refresh the homepage news box and status date with shipped bounded Application requests, detailed retry/refusal records, lossless numeric JSON and functional verifier classification. Native acceptance, packaging and handoff remain open.

Application port bounds complete requests, responses and retained views. A separate v2 interface preserves structured refusal proof and retry details, keeps uncertain post-forward outcomes conservative, and validates original seven-field receipts. Owned get/list records preserve numeric JSON tokens; the legacy v1 interface remains available.

Application ServicePort close drains admitted calls and release callbacks while preserving held results until explicit release. Finalization refuses outstanding views; competing calls refuse before dispatch. Query allocation failures retain their OutOfMemory class.

VERSION 0.0.32: historical reconstruction sizes temporary receipt and retained-result tables from the requested journal prefix, preserving original caps and reducing small-history allocation within bounded requests. Larger histories can still exhaust the request allocator.

Sprint-77G / D05-C: real loopback HTTP listener/client composition crossed with wired ServicePort create/get (not a second dispatch labeled HTTP).

Website: full synchronization after D05 A–C — project-status notes wired ServicePort + loopback HTTP composition without companion/corpus claims.

Sprint-77F / D05-B: wire typed ApplicationServicePort via six Eris-authorized scoped handoffs (wiring.zig only); preserve LocalDocumentService; remove unimplementedPort placeholder.

Sprint-77E / D05-A: Application ServicePort contract hardening — create/get/list matrix, explicit unsupported refusals, CredentialScope enforcement, owned query results + release, truthful view stamps; NG77A enrolled; C1-NATIVE-PILOT-1 adopted (not implemented). Wiring and real HTTP remain B/C.

Sprint-77D′ / docs: prepare D05-unblock/2 packet and C1-NATIVE-PILOT-1 proposal (#121).

Website: full synchronization after D04 lens cadence — project-status notes ordinary type, shape, and lens definition store/read without companion or corpus claims.

Sprint-76I / D04: ordinary Application store/read of ubi_lens_defs with independent digest consume (forged mismatch); live lens UI remains D09.

Sprint-76H / D04: definition delete returns missing on get; shared type_def export closure enumerable once; referencing records retained without reinterpretation.

Sprint-76G / D04 U-local: expand rural-definition-check to ubi_shape_defs (demo.card, 6 checks total); remains unstaged under MVP runbook.

Website: full synchronization after D04 shape cadence — project-status notes ordinary type and shape definition store/read without companion or corpus claims.

Sprint-76F / D04: ordinary Application store/read of ubi_shape_defs with independent digest consume oracle (forged mismatch); deep shape validation remains UBI.

Sprint-77D / D05: dual isolated-profile ServicePort oracle — distinct store identities with matching semantic create/get; wiring still unimplemented.

Sprint-77C / D05: ServicePort capacity (limit 201) and unknown-outcome (journal sync fault) oracle coverage; wiring still unimplementedPort.

Sprint-77B / D05: expand ServicePort adapter oracle — stale/conflict mapping, schema mismatch, protected branch, limited query list, reopen; still not wired through unimplementedPort.

Sprint-76E / D04 U-local: isolated RURAL ubi_type_defs round-trip + U digest consume (rural-definition-check, 3 checks); remains unstaged under MVP runbook.

Sprint-83C′ / D17 U-local: ubi-baby default kind views + mapping check (14/14); remains unstaged under the MVP runbook; RURAL tip 817e1c1.

Sprint-77A / D05: Application-backed ServicePort adapter (NEW files) with direct-dispatch create/get/replay/deny/close tests; wiring.unimplementedPort unchanged until Eris-authorized scoped handoff.

Website: full synchronization after D05 adapter — project-status notes typed Application port without companion, corpus, or wiring-cutover claims.

Sprint-76C / D04: ordinary Application store/read of ubi_type_defs with independent digest consumption oracle; deep shape validation remains UBI.

Website: full synchronization after D01–D04 cadence — project-status reflects PF12 inactive codecs and data-defined freezes without companion/corpus ship claims; classify W19/D04 Zig orphans in verify-policy inventory.

Sprint-76D / D03: U-local pure shape interpreter recorded (awaiting acceptance; UBI artifacts remain unstaged under the MVP runbook).

Sprint-83A / D16: reusable source-corpus inventory copy tool with disposable fixtures (credential/symlink/hot-LOCK refusals).

Sprint-83B / D16: S-owner canonical-backup freeze of store-v2 (sequence 215, snapshotHash recorded privately under ignored local inventory); Surreal excluded.

Sprint-83C / D17: curated source->RURAL kind/envelope mapping freeze with synthetic fixtures; private bodies unpublished; artifact custody deferred to D18.

Sprint-98 / D18: content-lifecycle contract + ubi_content_manifest local-custody proof; D16 freeze selects oversized inline content (artifacts/ empty; dangling ids missing).

Sprint-83D / D19: curated import capacity preflight planner (freeze plan feasible; 2021 actions; no mutation).

Sprint-83E / D20: resumable curated import loader (durable pending sync, lost-reply cmd0 recovery, staged_nonpublished; smoke + unit regressions).

Sprint-83F: planner/loader admit chunking when base64 expansion exceeds envelope field/document bounds; private freeze load complete (687/1227, head 2088, staged_nonpublished).

Website: full synchronization after D19–D20 cadence — project-status notes curated import planning/loader tools; still no shipped companion or curated application corpus.

Sprint-75G: scoped cross-family handoff validator (empty active set; Eris authorization required before D05 Application lease exemption).

Docs: D05 ready-to-activate handoff packet + blank C1 decision sheet (no invented grants).

Website: full synchronization after D16–D18 cadence — project-status notes inventory freeze, kind mapping and content-custody without companion/corpus ship claims.

Sprint-76B / D02: freeze UBI data-contract collection names, ubi.shape/2 grammar, digest codec, finite limits and independent golden fixtures. Companion aggregate budgets remain C1 open.

Sprint-75F / D01: reconcile RURAL/UBI tip identities, active owners, build caps and C1 open gates for the data-defined MVP; no runtime change.

Sprint-48B / W19: implement inactive PF12 segment/manifest/partition codecs against independent golden vectors; functional selector green; still unqualified (PF10 qualification retained).

Sprint-48A / W19: freeze inactive PF12 segment/manifest/partition codec semantics and golden refuse vectors; registry ready on PF00/PF05 implementation deps while PF10 qualification remains. No warehouse activation.

Sprint-84B / W18: complete scoped-grants normative dimension tables and admission/delivery fence without inventing clock or delegation answers. Implementation remains sprint 85.

Sprint-43 / W16: outside-checkout package survival probe — CRUD, restart, live backup, restore and credential rotation on a /tmp bundle; launcher and package unit suites re-run. Native GUI remains W17.

Sprint-44 / W15: P28 documentation preparation — CAPABILITIES.md, DEVELOPMENT.md and evidence/docs.md map operations to proofs without claiming packet done or acceptance verified.

Sprint-44B / W14: cookbook matrix completes batch, fork isolation, stale-head conflict and exact-body idempotent retry on packaged rural. Compaction backup remains W05-gated.

Sprint-44A / W14: operator CLI inventory and finite packaged cookbook — schema/create/get/query/backup examples via request, G12 ReleaseSafe build recipe, MCP query+changes wording. Short-verb FeatureUnavailable hooks and checkpoint-dependent backup remain explicit non-goals.

Sprint-41E / W13: freeze normative schemas and durable-fixture expectations for deferred MCP catalog, context and expand without advertising them; map five golden plans to sole-owner gaps and one bundled owner question. No invented golden arithmetic; transact stays write-deferred.

Sprint-41D / W12: sole-owner MCP probe completes advertised query+changes functional coverage — deletion-to-empty replacement pages, foreign-plan cursor refusal, packaged-bundle re-run, and harness unit tests. Catalog/context/ expand/transact stay unadvertised. No production MCP repair this unit.

Sprint-75E / W11: bridge-wire golden marks executable vs deferred cases; proves 2^53−1/2^53/2^53+1 decimal round-trip, member-order create retry, and unknown-critical refuse with zero mutation. Colliding numeric lease reuse stays non-executable (store never reuses tokens). No UBI files invented.

Sprint-40C / W10: finite lifetime proofs — cross-connection snapshot-lease borrow/release while a retained clone is used, leaf-drop pin survival with expiry reclaim, parent-drop with merge_base pin and readable descendant, create-receipt replay after deletion without a second effect, and overlapping backup BackupBusy refusal without staging. Mid-copy/checkpoint-aware backup cancel remains W05-gated. Not a soak or power-loss claim.

Sprint-40 / W09: freeze authority schedules (revoke-before-prepare vs committed-receipt replay) and prove a bounded live-socket hostile corpus on owned rural serve (check_hostile_service.py) with zero durable mutation and a subsequent valid create. Listener on-disk token rewrite is not admitted. Not a fuzz-throughput or power-loss claim.

Sprint-39 abrupt-kill matrix closed on a packaged shipping rural with separately identified unshipped crash helpers: helper digests rehashed before/after, package bin/ excludes crash-helper binaries, and --package-bundle asserts that exclusion.

Abrupt-kill harness gains a service pre-reply cut: an unshipped child wraps real Application dispatch, hangs after the response is built and before listener send, and the parent compares a pipe-observed seven-field receipt to the post-restart idempotent retry (not an HTTP acknowledgment).

Local package-prototype source payload includes tests/fixtures/prototype/v1/bridge-wire-golden.json so copied bridge-wire tests can load their fixture; package tests assert manifest closure.

Checkpoint-dependent (compacted) stores refuse journal-only RURALBK1 backup before staging: CheckpointDependentBackupUnsupported / checkpoint_dependent_backup_unsupported. Non-compacted v1/v2 backup/restore is unchanged; full checkpoint-aware archives remain a later contract.

VERSION 0.0.31: sole-owner rural mcp advertises process-local changes polling. Successful query calls return a session plan_id; changes re-runs that saved plan and returns unchanged or a complete changed page when the matching row count is ≤ limit. Overflow refuses without advancing the poll cursor (resnapshot via query); entries are a replacement view, not a CDC delta. Plans die with the adapter; this is not a durable feed and not Application /v1/changes.

VERSION 0.0.30: offline compact copies table.limits when present, and backup format version 2 embeds the source receipt-table cap so restore writes that cap before open. Restore cuts the journal from validated journal_bytes so legacy version 1 (76-byte header) still restores with the default 100,000 cap. Default caller options can no longer replace a 4,096-cap source through compact or backup->restore.

Prototype test inventory includes offline compaction and pinned-read cases.

VERSION 0.0.29: the owning service publishes retained-history checkpoints on the D1 trigger (≥ 8,192 commits or ≥ 16 MiB of journal since the last generation, one in flight, ≥ 60 s between attempts, skipped while a backup runs, and on clean shutdown when the trigger is met). Service options can override the thresholds. Status reports last generation, sequence, duration and failures.

VERSION 0.0.21: rural compact writes a verified compacted store into a new directory. Journals gain version 3 with base sequence and offset so reopen imports the checkpoint and replays only the retained suffix. Source store bytes are never modified.

VERSION 0.0.25: a pending checkpoint, backup or history capture gets the writer gate after at most one more commit. Capture hold p99 at 1,024 branches stays under 1 ms without a persistent branch list.

VERSION 0.0.24: connected rural-visual records frame telemetry (optional --telemetry path). The P26 service driver can attach the native client during baseline (--native-visual, --native-telemetry-dir, --native-automation). Measured native evidence requires load-phase samples. On Apple M3, baseline with native attached kept 500 ev/s; input-to-visible and frame p95 medians were 17.04 ms (L02 -> partial).

VERSION 0.0.22: service clients can pin_snapshot a (branch, head) lease (TTL 30 s, at most 64 leases per connection and 1,024 per service), release it, and repeat reads by lease_id against the pinned root. Expired leases return lease_expired; full connection or service caps return lease_limit. Leases are process-local and are not persisted. rural serve allows 1,024 HTTP requests per keep-alive connection so a Session can hold a lease across sustained pinned reads.

VERSION 0.0.23: a store chooses its receipt and result table cap at create (default 100,000; allowed range 1,024–1,000,000), persists it as table.limits, and reuses that value on every open. Checkpoint encode and load limits follow the persisted cap.

VERSION 0.0.19: checkpoint open verifies prefix_sha256 against the journal prefix and returns RecoveryRequired on mismatch. Database.publishCheckpoint is serialized per database and retains only CURRENT plus one previous generation after CURRENT is durable. A post-backup checkpoint publish failure is counted in service status (checkpoint.publish_failures, checkpoint.last_error) instead of being swallowed. rural version prints the released VERSION. scripts/p26_phase_summary.py summarizes phase-only P26 driver JSON.

VERSION 0.0.18: while probing a document, a scalar collection query that finds a falsified equality predicate skips the rest of that document's body. Results, ordering and sort-value validation are unchanged.

VERSION 0.0.17: collection queries whose predicates are all scalar comparisons or exists checks, naming at most sixteen body fields across predicates and sort, read identity, deletion state and those fields with a non-allocating JSON token probe instead of decoding each document. Documents the probe cannot represent, such as those with escaped tokens, fall back to the full borrowed decoder. Results and ordering are unchanged.

VERSION 0.0.16: collection queries seek directly to document/<collection>/ and stop at the first key outside it, so max_visited counts only entries of that collection. Every matching sort value is still validated. On the Apple M3 the frozen filter_sort20 target (p95 ≤ 5 ms at 4,096 records) is not met; the last quiet-host median before these query changes was 19.97 ms.

VERSION 0.0.15: Database.open loads a published checkpoint when CURRENT is present: import the image, then replay only the journal suffix. Corrupt or mismatched checkpoint metadata fails closed (RecoveryRequired) and never falls back to an older generation. Database.publishCheckpoint captures, encodes and publishes the next generation into the store directory (generation 1 when CURRENT is absent). Successful profile backups best-effort publish a checkpoint afterward; rural checkpoint <parent> <store> publishes explicitly. Full journal bytes remain; no reclamation. On Apple M3, a 20,000-record / 313-sequence profile opened in about 17–30 ms by full replay versus about 15–16 ms via checkpoint with an empty suffix (three trials each). P26 is not qualified.

VERSION 0.0.14: checkpoint capture no longer takes a second table writer. Database.captureCheckpoint returns a read-only frozen view (state.Frozen): a copy of the branch catalog, shared map roots, the receipt and result tables retained as a reader, and floors fixed at capture. The live engine keeps appending in place, so any number of commits can follow a held capture; before, the 129th commit after a capture failed with OutOfMemory. The writer gate covers one fstat, the in-memory boundary and the catalog copy (O(branches), at most max_branches); the journal header is verified after the gate with the recovery validator, and a failure there poisons the journal as a corrupt frozen backup prefix does. Checkpoint captures now count in last_capture_hold_ns. Recovery and streaming backup share one journal validator; a sub-64-byte header or frame tail with invalid leading bytes is now reported by streaming backup as invalid, as recovery already did, instead of incomplete. Checkpoints are still not used by Database.open or the service. On the Apple M3 the hold is 2.5–16 µs at sequence 2 and at 10,002, and 174 µs at 1,001 branches; a capture held across 10,000 commits adds no RSS. Against main in the same session: C = 161,759 against 162,322 events/s, overload goodput 0.960 C against 0.958 C, and a 10-minute soak RSS slope median of 0.0443% against 0.0317%. Linux is not measured.

VERSION 0.0.13: the rural executable chooses its process allocator explicitly with the -Dallocator build option (libc, smp or debug) instead of inheriting Zig start code's choice. Debug builds keep the leak-reporting DebugAllocator. Release builds link libc and use its malloc on macOS and on glibc Linux; musl Linux and other targets use SmpAllocator. Linux release builds were previously on DebugAllocator, which serializes every allocation behind one lock; they are now dynamically linked against glibc. rural version names the allocator. A new build-rural step installs only the service. On the Apple M3, SmpAllocator matched libc malloc on throughput (C about 295k events/s) but grew RSS at 0.73% of the mean over the 10-minute soak against about 0.04% for libc malloc, so libc malloc is the release default. Linux performance with the new allocator is not measured yet.

VERSION 0.0.12: backup capture freezes the journal prefix under the writer gate and streams that prefix afterward, so admitted writers are not held for the copy. The RURALBK1 format and the 64 KiB streaming buffer are unchanged. A corrupt prefix found during the unlocked copy poisons the source, as before. The capture-hold counter is atomic. On the Apple M3 reference host the old in-gate copy of a full 64 MiB journal takes 116 ms, over the 50 ms admission deadline; the production hold is about 1 µs at every size, including while another writer and a second backup run. The P26 service driver now records the 40 s baseline and 100 fork/edit/drop cycles (median of three, same variation rule as calibration); during the cycles a second connection keeps reading the pinned window while main ingests outside it. Native timing stays unmeasured because it needs a GUI. On the Apple M3 the baseline acknowledges all 20,000 events at 500/s (batch-ack p95 about 4 ms, read p95 about 70 ms) with exact totals after restart; the branch cycles keep every pinned read equal and grow RSS by under 0.4 MB; C = 182,416 events/s, overload goodput 0.961 C, drain 175,696 events/s; the 10-minute soak RSS slope median is 0.052% of the mean. Linux VM figures are recorded separately in the performance evidence. P26 is not qualified.

VERSION 0.0.11: receipts and intake-request results are preallocated append-only tables capped at max_receipts (default 100,000). A full receipt table returns ReceiptLimit. A full result table returns RecordLimit. Nothing is evicted, and a matching replay still works at the cap. The event-accounting hint is one 512-byte buffer per branch. A fork copies that hint and freezes which parent result slots stay visible; a dropped branch keeps that link for its descendants. Unique-owner commits of those keys allocate nothing after init. Snapshots read and release the shared tables without the publication lock, so their reference counts are atomic and index cells are published with release/acquire ordering. The tables add about 60 MB of resident memory per open store at the default cap. On the Apple M3 reference host the 10-minute soak's current-RSS slope is 0.031% of the mean (median of three; 2.43% before), with C = 181,590 events/s (CV 0.19%), overload goodput 0.958 C and drain 174,440 events/s. On the Linux VM the slope is 1.244% of the mean (15.3% before) and peak RSS under overload drops from 300 MB to 218 MB at a matched offer; overload goodput and drain at 4× C miss their floors there on both the old and the new build.

VERSION 0.0.10: backup capture streams the journal through a fixed 64 KiB buffer under the writer gate instead of allocating the image. Budget failure still happens before the staging file exists. Header write, plain fsync, and no-replace rename stay after the gate. The RURALBK1 format is unchanged, and a streamed artifact restores like any other capture. The service driver samples a Linux child from /proc (current VmRSS, threads, fd count); macOS proc_pidinfo sampling is unchanged. A Linux cloud VM 10-minute soak no longer shows a journal-sized RSS spike at backup, but current RSS still grows with the live receipt and record maps (about 40 KB/s on that host), so the frozen 5% slope misses there. On the Apple M3 reference host the 10-minute soak now meets every L06 criterion, including the 5% current-RSS slope (2.4% of the mean, down from 29%), with no per-backup RSS step; C = 165,958 ev/s and overload goodput 0.937 C. L06 stays partial pending coordinator re-review, and P26 is not qualified (baseline, native and branch sections unmeasured).

VERSION 0.0.9: P26 admission control and calibrated load evidence. Overload is now HTTP 503 busy (rejection_proven, retry: "same_identity", retry_after_ms, Retry-After) on a kept-alive connection, with 429 reserved. rural serve gets 16 workers within a 112 MiB buffer budget, a kernel backlog of 128, and queue limits of 12 jobs / 2 MiB with a 50 ms wait deadline, early refusal before parsing, and admission/resource metrics in status. ingest_events accepts an omitted expected_head (backward compatible), and the producer writes head-free intents and retries proven busy with the same identity. Also: a decode scratch hoist in sky/events.zig, and the intake proof now carries across document commits (a ≈50 ms rescan per CRUD at 20k events is gone). New separate-process driver tools/prototype/service_driver.zig (build-service-driver) and checker schema rural-p26-mixed-load/v2. Measured: C = 176,325 ev/s (CV 2.2%); overload goodput 0.974 C with 7,480 typed 503s, admitted p95 5.8 ms, drain 168.7k ev/s, restart exact. The 10-minute soak passes every check except the current-RSS slope (backup allocator high-water plus store growth), so L06 stays partial. The overload window is cap-safe (21 s instead of 30 s; see performance.md). P26 is not qualified.

VERSION 0.0.8: bounded P26 service load harness slice in tests/prototype/service_load.zig (build case service-load) — real loopback listener + Application + commit queue over HTTP/JSON: L04 30 s at 4× with exact 20,000 end state, measured drain and restart; saturation probe showing explicit stale_head/connection refusals (QueueFull unreachable via HTTP); L06 groundwork (backup, rolling-window expiry, resource sampling) with a 20 s smoke. L04 -> partial; L02/L06 remain missing. README VERSION wording corrected for 0.0.x. No production code changed. P26 not qualified.

VERSION 0.0.7: headless ReleaseSafe P26 slices in tests/prototype/fairness.zig — L05 pinned reader + 100 fork/edit/drop cycles with bounded retained bytes, restart and explicit BranchLimit; L03 durable batch64/CRUD/read latency after 5 s warm-up with restart identity check. L03/L05 -> partial; L02/L04/L06 remain missing (native / P26 harness). P26 not qualified.

VERSION 0.0.6: bounded P24 durable V06 — Compass retire, two-plan compare without score, personal/shared mandate privacy and revoked-mandate dispatch refusal via Application.dispatch in tests/prototype/scenarios.zig; refresh native-functional evidence and PROGRESS (V06 partial); P24 remains running.

VERSION 0.0.5: bounded P24 durable V10 — local-only offline workflow (launcher profile rules, CRUD, branch, backup/restore) without MCP/model/registry in tests/prototype/scenarios.zig; refresh native-functional evidence and PROGRESS (V10 partial); P24 remains running.

VERSION 0.0.4: bounded P24 durable V05 — intake accept/duplicate/second-event drain with exact analytics and empty-batch rejection in tests/prototype/scenarios.zig; refresh native-functional evidence and PROGRESS (V05 partial); P24 remains running.

VERSION 0.0.3: bounded P24 durable V09 — five Oracle MCP stdio queries with discovery, exact fixture answers, unchanged delta, transfer bound, and scoped denial in tests/prototype/scenarios.zig (build.zig wires mcp_client/oracle_bench into scenarios); refresh native-functional evidence and PROGRESS (V09 partial); P24 remains running.

VERSION 0.0.2: bounded P24 durable scenarios — V07 TEST_CREDIT reserve/capture/release + lost-reply hold, and V08 backup-during-use restore into a new directory in tests/prototype/scenarios.zig; refresh native-functional evidence and PROGRESS (V07/V08 partial); P24 remains running.

VERSION 0.0.1: bounded P24 durable scenario evidence — V01 reopen survival and V04 child/grandchild isolation with stale-head refusal in tests/prototype/scenarios.zig; refresh native-functional evidence and PROGRESS ledger; mark P24 running (not done).

License the repository under Apache License 2.0; product VERSION uses 0.0.x until an explicit 1.0.0 release.

Park PF10/PF11/PF15 performance-program status as deferred: integrated work remains on main, open numerical/optional qualification is not claimed complete.

Decode immutable query documents with borrowed plain JSON tokens, preserving the existing parser and result ownership; projected results still copy their returned bytes. This reduces parser allocation but does not establish a latency improvement.

Add the directory-edition embedded API over a caller-owned directory, with admission, drain, and close, committed and replayed receipts, and group-unknown cause metadata. This is not a performance qualification or a main-file edition.

The intent read captures control and main together using snapshotPair(2, 1), and a deleted main is reported before intent-disabled. The command gate stays with the turn except across a fresh prepared append. Merge planning uses branch-history capture, while compare does not take that gate.

Add opt-in scalar index generations, bounded backfill and exact-root verification; default application routes still use their authoritative validation.

Add validated logical checkpoint import/export, writer-ordered capture, immutable publication and bounded streaming replay; live checkpoint recovery and journal reclamation remain pending.

Reuse bounded authenticated HTTP connections with per-request credentials, strict frame boundaries, idle/lifetime/request caps and cancelable connection establishment. The validated Zig product client can opt into persistent sessions; existing CLI callers remain one-shot.

Sequence owner-only Application commands through a bounded caller-led queue. Adjacent document writes can share one durable sync while retaining individual receipts and rejections; control, merge, branch and backup commands remain ordered barriers. Group-only preappend capacity failures fall back to serial commits, and uncertain outcomes retain their original retry identity.

Reuse one lazy 8 MiB group-preparation buffer per open database under writer admission, releasing it on close and refusing allocation for closed or recovery-fenced owners. The source change passed frozen full correctness verification; the memory tradeoff and open grouped-latency gate remain explicit.

Audit graph relations once per traversal, then expand bounded sorted adjacency; reject malformed authoritative relations as store corruption.

Validate homogeneous unique-field document batches against one snapshot-owned scalar view, with bounded parsing and the existing scan fallback for legacy values.

Reuse verified analytics totals between exact committed heads, with invalidation on raw writes, catalog changes, reopen or uncertain outcomes; keep authoritative history audits on misses and original retry counts.

Open up the homepage hero illustration by removing its panel border and background and adding space around the existing animation.

Add opt-in measurement v2 with prebuilt requests, bounded scheduled arrivals, visible refusals and a separate native durable CRUD probe; retain the historical v1 benchmark.

Bound sorted query selection to the requested page and materialize winners only, fixing large-document request-arena exhaustion while preserving sort, projection and error semantics.

Add allocation-free, snapshot-owning forward/reverse key ranges to the immutable ordered map.

Publish the bounded local performance report with raw synthetic observations and explicit comparison limits.

Add an animated, branded social preview with a static fallback and Open Graph metadata for public pages.

Improve the public website's diagrams and motion across the database story, including responsive knowledge-base illustrations, a restored interactive mechanism explorer, and accessible reduced-motion behavior.

Connect the public knowledge base to repository-authored mathematical foundations and verified local import evidence, with explicit website source and image allowlists.

Add a private, one-way SurrealDB projection import from a real project, with exact RURAL readback, paged graph reads, bounded large-collection queries, native collection launch and a mathematical prototype whitepaper.

Replaced all interface arrow glyphs with SVG vectors and added a reusable source and rendered-page glyph check.

Stabilized the mobile first paint and replaced API playground arrows with consistent inline SVG icons.

Replaced device-dependent interface symbols with inline SVG vectors and added a rendered-page emoji regression.

Reframed the public website around RURAL as a database, synchronized its implementation status, and added interactive write, graph, recovery and data-flow diagrams.

Package the public Go website for Dokploy, with explicit public binding and a canonical www.rural.internet.technology redirect.

Native plan comparison and explicit local proposal prepare/apply/cancel/reconcile, with principal-bound pending8 recovery.

Deterministic two-plan comparison and durable local task proposals with separate consent grants, explicit apply and restart quarantine.

Native TEST_CREDIT wallet controls with principal-bound pending7 recovery; no real-money rails.

Add explicit profile4 wallet activation, conserved TEST_CREDIT reservations/capture/release and scoped intention reads.

Hold unknown outcomes and quarantine unfinished intentions after restart/restore until explicit local reconciliation.

Inspect personal/shared terms and explicitly create, consent, revoke or retire mandates in the Zig client.

Preserve principal-bound control commands across uncertain replies and restart without moving document navigation to control storage.

Add consent format2 with authenticated self-consent, revocation and owner retirement; historical participant records remain passive.

Bind eligibility to current canonical Compass state, disclosure, expiry and complete consent; retain original receipts through restart. No dispatch or real-money endpoint is introduced.

Add personal/shared fixture Compass views and explicit create, priority edit/retire, state and disclosure commands.

Bind pending native commands to their authenticated principal across restart; clear private projections on identity changes.

Add explicit profile3 activation, fresh fixed fixture credentials, and durable owner-scoped Compass commands.

Restrict shared views to disclosed shared-project records; preserve original receipts across retries and restarts.

Mandate consent, proposal execution and native V06 remain pending.

Add strict versioned Compass and mandate record codecs that retain exact values, stable identities and explicit canonical-main references.

Add priority replacement and retirement with retained history; reject revision overflow before any state change and preserve revisions for semantic no-ops.

These are domain and persistence foundations; profile3, shared-principal service operations and native V06 remain pending.

Add a Zig launcher that authenticates existing local services and owns only the children it starts.

Add an exclusive-output bundle with bounded source copies, retained notices and a sorted SHA-256 inventory; compiler, SDK and populated dependency cache remain explicit rebuild prerequisites.

Add owner-authenticated, bounded live backups with stable artifact identities and explicit publication uncertainty.

Restore a validated backup into a new directory without starting services or copying runtime credentials; preserve the original store.

Bind mandate permission to an exact nonempty action, matching Compass owner/context and an unexpired deadline.

Preserve simulated-credit operation identity across retries and check bounded capacity before effects; funding cannot spend held credit.

Make the Compass presentation reuse the mandate permission predicate so expiry and owner/context mismatches cannot appear current.

These corrections harden the existing models; durable wallets and shared-principal service authorization remain unimplemented.

Add native three-way body previews, explicit conflict choices and target confirmation from the branch panel.

Preserve the original pending merge through uncertain delivery and validate the target receipt while retaining active branch selection.

Add authenticated comparison and atomic body-only merge for an existing collection from a descendant branch into its ancestor, with durable fork bases and explicit conflict choices.

Preserve exact merge intentions in pending format4 and expose a strict owned comparison client; native conflict controls use the same frozen comparison and pending formats.

Refuse unsupported membership, metadata, schema, relationship and unique-field changes without writes.

Add caller-bounded, fully validated durable history capture and isolated historical snapshot reconstruction; used by the bounded document merge integration.

Omit identical source/target changes and reject extraneous or duplicate conflict resolutions in the pure merge decision module.

Add bounded durable branch lineage inventory and explicit native selection, fork and drop controls over journal-backed data branches.

Preserve pending fork/drop identity through restart and validate receipts against the fork target. Branch merges remain separate work.

Add a native analytics panel over the local service, with snapshot-pinned catalog pagination, exact metric totals and explicit observed-source coverage.

Refresh rolling views through a separate background reader, retain visibly historical results across failures, and reject stale selections or foreign store identities.

Add immutable source and metric configuration, durable raw-event batches, stable event deduplication and exact scalar analytics to the local owner service. Original batch counts survive request replay and restart; observed source coverage remains distinct from exhaustive delivery.

Upgrade the service control profile to format2 on first configuration; preserve format1 initialization receipts and reject unknown control records. Older binaries cannot open format2 profiles.

Add a Zig fixture producer with a pinned store, lifetime spool lock, synchronized pending requests and receipt-verified acknowledgements. Only a proven stale-head rejection permits a fresh transport identity; uncertain delivery preserves the original request.

Public intake, event correction/deletion and sustained-load qualification remain pending.

Add native outgoing-relation inspection, creation and deletion through the shared service and retained-intent workflow.

Correct analytical observed-source coverage, bounded bucket allocation cleanup and timestamp overflow.

Preserve precise JSON decimals in relation properties through encoding, reads and restart.

Add immutable shared field semantics, schema discovery and authoritative outgoing relation reads; unsupported critical semantics block document writes.

Add a schema-derived native editor for custom collections, exact typed fields and hidden-field-preserving patches, including explicit restart retry.

Prove pre-commit rejection after receipt absence so invalid native intents can be cleared without discarding uncertain commits.

Extend native intents to a versioned general-command envelope while preserving exact legacy retry bytes.

Bound MCP startup probing to one record so large default pages do not prevent smaller valid queries.

Add a local read-only MCP process for one configured collection, with pinned session identity and supported-tool discovery.

Embed a licensed Latin font for native Croatian text and disable the graphics library’s automatic F12 screenshot capture.

Add native service title create/patch/delete, receipt display and explicit retry of synchronized pending commands after client restart.

Add atomic relation creation/deletion and bounded graph queries to the local service and CLI.

Added read-only native --connect service lenses with background reads, pinned store identity and shared CLI session handling.

Add an executable owner-only loopback service with private runtime credentials, session/store binding, durable create-only schemas, document and branch commands, bounded queries, and a first-party HTTP request client. Scoped grants, migrations, intake routing and native-client integration remain unqualified.

Encode document address components without slash collisions and reject stored-envelope/address mismatches; legacy ambiguous slash keys require a separately qualified migration.

Add cooperative query cancellation through bounded evaluation/sort checkpoints and same-service mutation admission, preserving immutable query snapshots during writes.

Unify document lowering with ordered batch validation, tombstone restoration/hiding, required replacement revisions, incident-edge deletion protection, metadata preservation and pre-lowering logical receipt replay.

Validate integer schemas without float conversion, constrain schema definitions and uniqueness scans, and share literal field-name/numeric rules across queries and schemas.

Write versioned RURALTX3 optional logical hashes with an explicit presence tag; read strict legacy TX2 and mixed journals without rewriting prior records. Old binaries cannot read TX3 writes.

Add executable progress accounting that separates packet labels from reviewed acceptance evidence; neither count estimates remaining development effort.

Execute query projection and stable scalar sorting, compare supported integer values numerically, reject snapshot/plan branch mismatches, count every traversed record against the visit budget, and bound retained candidates before allocation; unsupported numeric query operands fail explicitly.

Release the encoded document buffer when complete envelope size exceeds 64 KiB; preserve exact-limit acceptance.

Save producer outboxes by synchronized atomic replacement, retain published files on uncertain directory sync, and reject oversized or torn spools.

Separate generated package caches and named local stores from source listings while retaining verification logs and all existing local data.

Count backup framing in artifact limits; clean operation-owned unpublished staging after failed capture while preserving existing files and uncertain published captures.

Release partially constructed query, graph, branch, outbox and visual results on allocation failure. Query/graph allocation failures now report errors rather than silently omitting valid results.

Reclaim expired cursor snapshots with caller-supplied time and exhaust tokens safely without consuming tokens on failed retention.

Select exact registered test roots; reject empty selections and detect unregistered test files. Add one verification entry point and executable dependency-boundary checks.

Adopt compact repository governance with explicit ownership, lock release, cancellation/drain and memory cleanup obligations.

Explored local-file RURAL cells that carry schemas, relationships and declarative lenses, with separate embedded, served, replicated and federated roles.

Added a sourced comparison, architecture diagram, clone/authority rules, proposed mathematical obligations and future delivery gates. The active prototype contracts and task statuses are unchanged; no cell synchronization, embedded edition or distributed guarantee is implemented by this research.

Corrected the documentation index's stale planning-only status to follow the authorized implementation and task registry.

Added six TLA+ specifications, pinned SANY/TLC tooling, seven bounded positive checks and nine deliberate counterexamples.

Documented mathematical assumptions, conditional progress and mapping to Zig implementation acceptance.

Reproduced an optional logical-hash receipt encoding mismatch in a focused Zig regression witness; the later TX3 repair is recorded above. These checks do not establish a fully verified database implementation.

Defined 30 dependency-ordered Zig prototype packets, shared contracts and native visual/runtime acceptance, with a separate gate for integration into an existing application.

Adopted compact project governance, low-reasoning worker dispatch and pinned third-party prototype dependencies; archived superseded policies and elaboration.

Recorded the current failing engine baseline. This planning revision does not implement or release a working prototype.

Added conceptual research chapters on storage, privacy, visible operations, agent wallets and batched external settlement.

Read and retained the official Quilibrium whitepaper; compared current primary documentation and pinned source with AO and Morpheus, proposing owned world capsules, typed situations and explicit remote-effect contracts.

Added the Go + HTMX product website and public documentation workspace.

Introduced RURAL's connected-fields identity, original visual assets and locally hosted typography.

Connected version, changelog and allowlisted documentation to repository sources.

Added five selectable homepage mechanism diagrams and the Why RURAL guide.

Added interactive technology walkthroughs for immutable branches, durable intake progress and Oracle computation with inspectable evidence.

Added automatic in-view motion, visible pause/manual controls, reduced-motion alternatives and an animated six-stage transaction story.

Added the browser-only API playground with editable JSON, CRUD, isolated branches, atomic failure, event retry identities and bounded Oracle results.

Expanded the database philosophy and original visual design; retained responsive layouts, static explanations, HTMX navigation and browser-asset regression coverage.

Added immutable persistent maps, checksummed log frames, bounded protocol parsing and prepared branch transactions.

Added a local journal with exclusive ownership, synchronization before success and explicit recovery states.

Began durable integration and a development protocol. Local application integration and a product release remain unfinished.

Paused database-engine development at the Operator's request while the website is completed.

Adopted the MDAAI repository foundation with project-specific research scope.

Investigated a dependency-free Zig alternative to SurrealDB.

Initial research baseline; no database product release.