Exact to the last unit.

We aim to build a database that is as fast and as exact as a financial ledger, and that stays that way for fifty years. This page shows what is real today, and what is still an aim.

Today: checked 64-bit numerics Aim: qualified double-entry ledger
Try the model Read the numeric docs
Terraced ledger rows under a balanced beam Illustration: a balance beam rests level above five terraced ledger rows. A receipt with a perforated edge sits at the lower right and a sun rises behind the terraces. 103 103 0001+ 9 223 372 0002- 1 000 000 0003+ 42 0004= exact receipt
Illustrative. Not a recorded ledger.
Why exact matters

Fifty years is a long time to be off by one.

Small errors do not stay small. They compound, they replay, and they hide behind a network timeout. A database for long-lived work has to refuse them at the door.

Rounding drift

An ordinary JavaScript number loses whole units above 253. RURAL keeps 64-bit integers in their declared domain.

Number(2^53 + 1) gives 9007199254740992. One unit gone.

Retries

Networks repeat requests. A repeated payment must not become two payments. Retries carry an identity, and a replay returns the original answer.

Unknown outcomes

A crash can land between "written" and "told you". RURAL treats an unknown outcome as its own state and makes it explicit. It does not guess.

Try it

Checked arithmetic, in your browser.

Two accounts hold signed 64-bit balances. Move units between them. Push past a limit. Press the same idempotency key twice.

Transfer modelIllustrative browser model, not the engine
Digits only. Maximum 9223372036854775807.
Same key, same request: replay. Press Transfer twice.
Shortcuts
Account A
5000
Account B
1200
Total
6200
Ready. Press Transfer.

Receipts 0 of 6

SeqKeyMoveA afterB after
No receipts yet.

The model checks every step with BigInt in your browser. Refusals change nothing. The receipt table is capped at 6 here to show bounded tables: a full table refuses, it never evicts. Nothing is stored or sent.

Replay, not repeat

Replacing a report of 100 with 103 must produce 103, not 203.

A report is replaced by value, and a retried replacement returns the original receipt. A scalar analytics report works this way today.

Blind retry

100 + 103

203

The retry ran twice. The books are wrong and nothing says so.

Receipt replay

same identity

103

The second request finds its receipt and gets the original answer.

The commit path

A commit earns its acknowledgement.

The engine says "done" only after the change is on disk. Prepare, journal, sync, publish, receipt. In that order, every time.

Write pathIllustrative diagram
Commit path in five stages Admit, validate, journal and sync, publish, receipt. A flowing line connects the stages. The acknowledgement only leaves after the sync stage has finished. Admitbounded Validateprepare Journal+ sync Publishvisible Receiptreplayable 12345 no ack before sync
  1. Validate and prepare TodayChecked arithmetic, expected head and request identity are verified before anything is written.
  2. Journal and sync TodayThe exact intent is appended and the operating system sync completes. If that fails, the outcome is marked unknown and normal use is blocked.
  3. Publish and receipt TodayThe new state becomes visible, then a receipt is committed. Replaying the same identity returns that receipt.
  4. Admission and group commit DesignBatching many writers into shared I/O, while each keeps its own atomicity, is designed and not yet claimed as a result.
Today and aim

What is real, and what we are working toward.

TigerBeetle is a reference point for the aim. RURAL does not reuse its code and does not claim to match it.

CapabilityTodayAim
Exact numbersToday Checked signed and unsigned 64-bit values; overflow is refused.Aim u128 amounts and identifiers.
Atomic transferToday Checked add, compare-and-set and atomic transfer between numeric values.Aim Immutable accounts and transfers as first-class records.
RetriesToday Durable receipts bound to the request; replay returns the original. Tables are bounded (default 100,000) and never evict.Aim The same guarantee at ledger scale.
Pending, posted, voidNot available.Aim Two-phase transfers.
Linked eventsToday Atomic document batches only.Aim Linked ledger events that succeed or fail together.
Double-entryNo qualified double-entry ledger exists today.Aim A qualified double-entry ledger.
Test ledgerToday A synthetic TEST_CREDIT ledger on a control branch: 16 accounts, 128 postings, no real money.Aim A qualified ledger profile, kept apart from the synthetic one.
ThroughputNo throughput or latency win over any incumbent has been shown.Aim Targets stated only after they are measured.

The commit-path invariants (acknowledged implies durable, exact receipt identity) are covered by bounded TLA+ models. That is not a certification and not a performance result.

Next

See the numbers hold.

Run checked arithmetic against the real engine in the playground, or read what the numeric profile does and does not promise.

Open the playground Numeric and RAM docs