The database engine
engineered to the laws of physics.
A planetary-scale, off-heap δ-CRDT database with tri-temporal state, H3 spatial indexing, and a zero-allocation hot path — convergence proven by a chaos harness, not a marketing claim.
A product of Sovereign Systems
Not workflow rules. Physics.
The engine is governed by five laws, each enforced by a named test gate and each tied to a measured failure mode that made it non-optional.
Memory law
0 allocs/op on the hot path. One make() on the write path at the core rate (50.7–57.6M ops/s) = stop-the-world ~every 4ms.
Cache law
128-byte stride for every contended atomic. Two atomics on one cache line at 32 cores = a HITM storm = 1.1M ops/s, 1.6% efficiency vs the 50.7–57.6M core range.
Lock law
No sync.Mutex on the write path. CAS + EBR only. A futex is a scheduler stall, and a stall at the core rate (50.7–57.6M ops/s) is a cliff.
WAL law
Replay starts at LamportHigh − len(Mutations), not LamportHigh. Replay re-runs the minting — change this and you get double-minting.
Honesty law
Report numbers, not adjectives — and report the layer. “50,736,038 ops/s @32c is the CRDT CORE microbench gate-passing floor (range 50.7–57.6M; the 57.6M is a residency high, not sustained; production ingest is 1.0–3.1M δ/sec)” is a fact. Quoting 57.6M alone as “sustained throughput” is a hero-number round-up the post-mortem forbids.
A moat built from mechanisms, not marketing.
Every differentiator is grounded in a real package, type, and test — and where a feature is preview, stub, or dormant, it is labeled as such.
Tri-temporal CRDT state
Keyed by system_time × valid_time × assertion_time, materialized as a 40-byte composite key + 9-field Arrow IPC rows. A query a mutable-row or log-only model cannot answer without an auxiliary history store.
CRDTEntry @hamt.go · internal/databaseOff-heap, zero-GC hot path
State lives in a mmap’d segregated-slab HamtArena (17 size classes, 256-way sharded Treiber free-lists). NodePtr is a GC-invisible uintptr — the foundation of true zero-GC.
pkg/sync/hamt_arena.goCAS + EBR, no futex on the write path
Join, InsertLocal, NextDot use compare-and-swap and epoch-based reclamation with hazard pointers. The only sync.Mutex guards disk fsync in a decoupled background worker.
pkg/sync/reclamation.goH3 spatial CRDT
H3Index on every CRDTEntry, geocoding offloaded to an isolated C++ worker over a memfd-backed SPSC shared-memory ring — no syscalls or futexes on the hot path.
internal/spatial/h3_spsc_ring.goPost-quantum from day one
ML-DSA-65 (FIPS 204) preview envelope plus X25519MLKEM768 intent, alongside a hedged (randomized-nonce) Ed25519 signer that stays compatible with the unchanged verifier.
pkg/identity/pq_mldsa.goHonest-negative measurement culture
Every bench carries a gear tag. Honest negatives are recorded verbatim. FROZEN-file MD5 teeth pin the byte-identity of load-bearing source across forks.
TestGate_GearHonesty · TestGate_FrozenMD5One FROZEN core, wrapped by seams.
A layered system organized around a single frozen δ-CRDT core, wrapped by an ingress gate stack, a durable LSM tier, a replication mesh, and operator surfaces.
What ships. What’s opt-in. What’s a stub.
The engine reports its own readiness — production-wired, opt-in, dormant, bench-only, or stub — with the test that proves each claim.
| Capability | Readiness | Evidence |
|---|---|---|
| δ-CRDT core (Join, HAMT, IBLT, EBR) | Production | FROZEN; rapid property tests + chaos mesh convergence; 0 allocs/op hot path |
| Wire-integrity + skew bound | Production | Phase 2c/2f/2g teeth; closes Byzantine A1/A4 |
| TLS 1.3 mTLS mesh + control port | Production | TestTLSHandshake_13_Only, /v1/* route teeth |
| Admission (rate + clock) | Production | TestPeerBucket_SybilIsolation; real EAGAIN-at-TCP is Track 2.1 (not yet shipped) |
| WAL + bounded snapshot recovery | Opt-in | --wal-path; TestStage6WALRecoveryDeterminism |
| L0→L1 compaction + DominancePrune | Opt-in | --compaction-prune-enable default false; ADR-0019/0020/0025 |
| T_gc auto-inference | Production | Day-22 ADR-0027; inferrer floors operator knob; retreats refused + counted |
| L0 reaper | Opt-in | --compaction-reap-enable default false; never auto-runs |
| Read-your-writes LiveSource | Production | Day-27 ADR-0032; insert→IMMEDIATE query→200; engine.State().Get is O(total entries) |
| SkipListArena.Seek | Dormant | Proven correct (Day-23 ADR-0028) but not wired into scanWindowRecordBatch |
| eBPF SK_REUSEPORT steering | Production | //go:build ebpf_kernel (opt-out); silicon tests t.Skip cleanly on capability-absent box |
| EPOLLET Cap’n Proto ingestion | Partial | Unix-socket E2E proven; binds but no message in TestEpollServer_BasicMessage; IPv6 unsupported |
| H3 spatial CRDT (C++ worker) | Partial | SPSC ring proven structurally; C++ h3_worker operator-supplied; in-tree tests use mocks |
| Ed25519 verify + hedged signer | Production | VerifyCRDTFrame + RejectSmallOrderKey; verifies under unchanged circl.Verify |
| ML-DSA-65 post-quantum | Preview | pq_preview build tag; no production imports; 32c re-run pending |
| aws-lc hedged bridge | Stub | aws_lc_hedged_stub.go is a panic stub; real CGO bridge deferred |
| Dev-mesh x509 PKI | Dev only | Not production PKI (no offline root/intermediates/HSM/OCSP/rotation) |
| Cedar ABAC | Bench-only | pkg/authorization has no non-test .go source; no production authorizer type or call site |
| Zero-GC PII masking | Production | internal/crypto/pii.go; memtable calls MaskPII per write |
| Telemetry → Prometheus bridge | Production | ADR-0023; SSoT-grows-auto; 19 instruments; real scrape cumulative-not-delta |
| Chaos harness | Bench-only | internal/chaos; SIGSEGV survival conditionally skipped pending CHAOS_WORKER_BIN |
| pkg/durability/wal.go | Alias layer | Pure re-export of internal/chaos WAL with zero own logic |
| EpochCompactor | Dead | Zero production importers; retained for scope hygiene; real GC is DominancePrune + L0 reaper |