KynetraDB engine log
Changelog
Transcribed from the dated benchmark ledger committed alongside the engine. Newest first. Each entry carries its commit, and where a slice was recorded as functional-only — no performance number measured — it says so instead of implying one.
-
9-slice engine deployed to the live DigitalOcean demo
Tideline, Bulkhead, Ferry, Tidewater, Ebb, Meridian, Lodestar, Ledger and Watermark shipped together. The headline result is that data survived: the boot log shows a checkpoint loaded at checkpoint_seq=30018 with log_seq=38423, replaying the tail only — exactly the path the Tideline fix hardened, on 38k sequences of real data. log_seq was up from the previous deploy, so nothing was lost and writes continued throughout.
-
Equality-index projection-lag guard; leftover benchmark toggles removed
The equality index could silently lose rows: consulted while its projection lagged the log, a posting list under-reports, and under-reporting is unrepairable because a downstream re-check can only remove ids, never add back rows the index failed to return. Every persisted index arm now checks one shared, single-sourced predicate before trusting its postings and otherwise falls back to the exact scan. Three leftover benchmark toggles were removed, one a genuine footgun — scaffolding that disables index maintenance must never survive into shipped code behind an environment variable.
-
vector_search filter fidelity; two Disk-tier tests made deterministic
extract_kind_eq is a last-wins loop that keeps only the last Kind and last Eq of a conjunction and silently drops the rest. filter_root was safe because it re-fetches each candidate and re-checks the predicate — that re-check is what made it safe — but the vector path consumed the same lossy candidate set without re-checking, and so returned hits violating conjuncts the resolver had dropped. The repair is structural: a candidate type that carries the re-check obligation, discharged when owed and a no-op when not, so a future caller cannot consume a resolution without meeting it.
-
SPANN large-filter scan — covering the path the engine actually uses
SPANN filtered search dispatches on filter size, and because the engine resolves small filters with its own scan, the large branch is the only one production reaches — yet it was the one without coverage. The committed matrix test sat entirely under the dispatch threshold, so its 0.99 bar validated brute force rather than the new scan. Measured on the real path: recall@10 0.80 native versus 0.14 for equal-budget post-filtering, holding across both RaBitQ and Caustic.
-
Per-kind index — tenant-scoped reads go O(tenant)
A bare Filter::Kind was not index-answerable, so listing one tenant fell through to a full-corpus scan. A per-kind id posting index now answers it directly: measured 4.5 → 3.0 ms flat on Ram as the background corpus grew 10k → 1M, versus 5.0 → 82.5 ms unindexed (~28x at 1M); and 6.8 → 13.6 ms versus 9.1 → 443 ms on Disk (~33x). Write regression from the extra posting: 0.1% (33,153 vs 33,112 puts/s, median of 3 interleaved rounds at 100k puts/arm).
-
Honest tenant erasure
A purge tombstones every t_{pid}___* entity, destroys the tenant’s keys, then compacts — idempotent and resumable by construction, with kinds re-listed after each sweep and an honest live recount deciding completion rather than the loop’s own counter. Cross-tenant safety is structural: because the cascade scans a kind prefix, project ids are rejected unless underscore-free on every path.
-
SPANN postings served from mmap at query time
Settled postings are served zero-copy from mmap at query time, so the page cache is the tier and the heap holds only the centroid navigator, centroid vectors, per-posting headers and the live memtable. Resident memory went from ~16.4% of raw f32 to 0.13% — 16,400 bytes for 50,000 × 64 vectors, ~125x less — with byte-identical search results. Enabled by replacing the serialized posting blob with a raw fixed-stride layout, since offset-addressable rows are the precondition for zero-copy.
-
Per-tenant export with auth-material redaction
A tenant’s namespace streams as integrity-hashed NDJSON from one pinned snapshot — no writer quiesce, no torn output. Adversarial review blocked the merge over an account-takeover vector: the prefix scan is right for isolation but wrong for sensitivity, and auth_otp stores an unsalted SHA-256 of a 6-digit code, so 10^6 hashes take milliseconds. auth_otp and auth_refresh are now excluded outright and password_hash emptied. A second bug: HttpSink counted a non-2xx as a successful write, so a restore that wrote zero rows reported full success.
-
Tenant-isolation hardening — ProjectStatus, quotas, and the plane fence
ProjectStatus lifecycle (Active/Paused/Suspended, fail-closed at resolve), per-project QPS limits and entity quotas, and a structural platform/project plane fence. One root cause closed across three routes: a project-plane credential asserting platform-plane authority. A platform_identity bool on AuthCtx, set once at resolution, is now checked before any role or uid comparison; AuthCtx derives only Debug+Clone so it cannot be set from untrusted input. Suite: 215 tests, 0 failed.
-
Durability hardening — two silent-data-loss bugs closed
Bug 1, WAL-tail loss: entities written after the last checkpoint but before a restart vanished after the next delta checkpoint plus a second restart. Reproduced as 5 puts → restart → 2 puts → restart → 5 puts → restart, where the count was 10 and should have been 12. Bug 2, restore-path resurrection and drop: stale on-disk checkpoint artifacts let a later delta link onto a stale base, so restored-away entities resurrected AND new writes with reused sequence numbers were silently dropped. Both landed with red-to-green regression tests across the row and columnar checkpoint formats.
-
Session engine deployed to the live DigitalOcean demo
Beacon slices 4–5, Caustic, ACORN filtered search, the columnar-checkpoint format, the D1 migrator and the Raft crate shipped to the live demo droplet.
-
Sub-bit residual quantization at 768 dimensions
The sub-bit tier of the Prism ladder: k-means residual coding where the Beacon centroid doubles as the compression predictor, orthonormal projection to dim/shrink, and a RaBitQ-style 1-bit sign code with unbiased estimation. Measured at 768-dim on a 10k clustered corpus over 100 queries: recall@10 0.9950 at 57.5 B/vector amortized, 53.4x versus f32 at shrink=2 — a figure of merit 1.76x better per-byte recall than RaBitQ.
-
Beacon/SPANN slice 2 — incremental writes
SPANN takes live inserts and deletes: a memtable makes writes searchable immediately, then they settle into epoch-versioned postings on a crash-safe flush (write and fsync, install, durable manifest commit, delete old). A write is visible without a rebuild.
-
Beacon/SPANN slice 1 — disk-resident ANN
Static SPANN: an in-RAM HNSW centroid navigator routes to RaBitQ postings on disk, and a query navigates to the nprobe nearest centroids and scans only those postings. Measured recall@10 1.0 at nprobe=2/20, about 10% of postings — routing, not coverage, carries the recall.
-
Lens slice 1 — exact filtered fallback
High-selectivity filtered vector search collapsed, because the graph traversed unfiltered then discarded. When the eligible set is small, the graph is now skipped and every filter member is scored exactly, giving recall 1.0 precisely where the graph path would collapse — the recall oracle for the ACORN traversal that followed.
-
Lens slice 2 — ACORN traversal wired into the hot search path
A filtered-out node stays in the traversal frontier as a stepping stone to reach accepted neighbours beyond it, never itself returned, instead of being discarded the moment it fails the predicate; sparse neighbourhoods get a bounded 2-hop look-through. Measured recall@10 at mid-selectivity: 10% went 0.9067 → 1.0000 and 5% went 0.5200 → 1.0000 against the naive discard-on-reject baseline. Landed alongside Raft slice 4, a real HTTP transport.
-
Aether slice 2 — replay floor and incremental upload
Boot skips segments below the replay floor, so cold-start cost tracks the tail rather than the corpus. The companion uploaded-floor watermark is verified by size rather than mere presence, because a truncated store object is not trusted, and trim barriers all uploads before any local removal.
-
Aether slice 1 — object-storage-native log
The WAL’s source of truth moves to an object store, with the local log as an NVMe write-through cache; sealed segments are immutable objects. Recorded as functional — no performance number was measured for this slice.
-
Prism-R slice 2 — persistence, boot from disk
A RaBitQ HNSW index persists as { seed, dim, codes } and reloads without re-encoding the corpus, because the orthonormal rotation is deterministic in (dim, seed). A seed mismatch is refused outright, since the wrong seed yields garbage codes.
-
Prism-R in HNSW — graph-integrated, plus Refract
RaBitQ now drives HNSW graph traversal rather than only brute force: the query is refracted through the shared orthonormal rotation and distance becomes the unbiased estimator. Measured recall@10 0.996 graph-integrated at 32x, matching int8 at 4x its density.
-
Prism-R (RaBitQ) codec and packed API
Error-bounded vector quantization measured on clustered data. Prism-R reached recall@10 0.96 brute-force against the ad-hoc binary codec’s ~0.10 — which is why Prism-1 is now deprecated rather than offered as a density tier.
-
Mnemos slices 1–5 — agent memory as a view over the log
Three-tier agent memory built as views over the one log: Echo (episodic, bi-temporal), Lore (semantic property graph) and Craft (procedural), with recall fused from graph, vector and BM25 by reciprocal-rank fusion. Consolidation writes content-hash ids so WAL replay never re-invokes the LLM. All five slices recorded as functional — no performance numbers were measured.
-
Beacon slices 4–5 close out the original 6-subsystem build
Posting replication, mmap-based posting reads, and LIRE split/merge/reassign rebalancing, so incremental writes cannot grow a posting unboundedly. Rebalancing is replica-aware and navigator-atomic: the centroid graph updates inside the same lock as the posting install, so a concurrent query never sees new postings paired with a stale navigator.
Provenance
The measured results in full are on benchmarks; the guarantee names used as entry tags are defined on the glossary.