Primary Use Cases

Each use case is grounded in a real capability surfaced by the engine source — and carries an honest scale caveat where the test doc is explicit about what is and isn’t proven.

Large-fleet event sourcing

The δ-CRDT core + IBLT/strata set reconciliation + sharded lock-free HAMT make the engine a fit for event-sourcing workloads that must converge across a large fleet without a central sequencer. Join is a merge-union join-semilattice (commutative/associative/idempotent, proven by rapid property tests and chaos mesh convergence), so events can be originated at any node and folded without coordination. GenerateDelta(remoteDigest) ships the minimal missing state — the minimal delta proportional to |A−B|, computed by subtracting a wire-exchanged remote IBLT digest and peeling the real diff. (An earlier variant computed the delta against an empty remote digest and so shipped everything; it was removed because it produced no bandwidth cut.) The async double-buffered MemTable flush (256 MB arenas, cap-4 in-flight backpressure) keeps the write path off the hot CAS path while streaming to per-entity Arrow IPC.

Honest scale caveat

The chaos mesh gate runs 32 nodes × 64 events, and the largest silicon run is 100 node processes on three machines across 3 AWS regions — not thousands, and not millions. The convergence property is scale-free, but nothing measured here proves planetary scale, and the test doc says so.

Multi-region eventually-consistent state

The TLS 1.3 mesh + anti-entropy sweep + Lamport causal dots + ACK-before-durability contract make the engine a fit for multi-region state that must remain available under partition and converge after heal. TestPartitionHeal_ConvergesUnder100ms proves bidirectional partition → divergence injection → heal → byte-equal roots + zero data loss + heal-to-convergence < 100 ms SLO. The clock cap (IngressHLCScalarCap) drops future-skewed frames before the ~60 µs verify, so a Byzantine peer cannot brick a receiver's Lamport clock. The skew-bound wire-integrity seam closes the far-future-dot and disk-state-poisoning attacks. InsertLocalEvents routes through bridge.PutLocal (WAL fsync) and returns 503 — not a lying 200+zero-dot — on fsync failure, so a client learns durability was not achieved.

Geo / spatial-temporal workloads

H3Index uint64 is carried on every CRDTEntry (@112) and in the Arrow schema (h3_index Uint64), so the data model is ready for workloads that query by both time and geography (fleet telemetry, asset tracking, coverage analysis). The bitemporal AsOf/Range queries resolve "what did the system believe about entity X at valid-time V as of tx-time T" over the durable Arrow tier plus a read-your-writes live HAMT merge today — these work today over the carried H3Index axis. The in-tree EpochBatcher + memfd SPSC H3 ring producer (internal/spatial) ships in the repo but is currently unwired (no production importer — only its own unit tests), and the C++ h3_worker consumer that would compute real H3 cells is operator-supplied and absent from the repo; the only in-tree H3Index assignment is the synthetic key-derived uint64(k) << 8 in the chaos harness. So H3 today is a reserved spatial axis on the data model and wire, not a live native geospatial index — an operator wires in the producer + worker to make it operational.

Honest caveat — H3 worker

The C++ h3_worker binary is operator-supplied and absent from the repo. The in-tree Go SPSC-ring producer + EpochBatcher ship but are not yet wired into the engine's data path (no production importer — only their own unit tests exercise them, e.g. TestNewSPSCRing_MemfdCreated proves the ring structurally). H3 is a reserved spatial axis, not a live index.

Post-quantum-secure data infrastructure

Post-quantum security is in the default build, not a roadmap promise: the transport negotiates X25519MLKEM768 key exchange by default, and a hybrid Ed25519 + ML-DSA-65 signature is compiled in with a BOTH-required verify — opt-in at runtime behind --hybrid-sign/--hybrid-verify, so a classical or a quantum break alone cannot forge a frame once it is enabled. The size economics are measured, not assumed: an ML-DSA-65 signature is 3309 B versus Ed25519's 64 B (51.7×), and a test gate enforces that ratio so it cannot drift silently. A hedged (randomized-nonce) Ed25519 signer closes side-channel nonce-reuse attacks while staying compatible with the unchanged classical verifier. For workloads with long confidentiality horizons, the engine is post-quantum-secure from day one rather than retrofittable.

High-write low-latency telemetry / CDR pipelines

The zero-GC hot path (0 allocs/op for HAMT.Set), the 128-byte cache-line discipline, the CAS+EBR lock-free write path, and the off-heap jemalloc SkipListArena make the engine a fit for high-write low-latency pipelines (CDR, telemetry, audit). The telemetry→Prometheus bridge surfaces the supremum_* cumulative series on /metrics with zero hot-path allocations; the Recorder records ingest/verify latency histograms and a six-value verdict counter (no WithLabelValues map lookup per frame). internal/transport's EPOLLET Cap'n Proto ingestion server (MaxConnections=4096, ReadBufSize=64KB, jemalloc-backed reassembly, runtime.Pinner zero-copy dispatch) is the high-throughput ingress path — proven E2E by TestParseMessages_RealClient_EndToEnd (Unix socket, all 5 TriTemporalEvent fields within 2s). The MaskPII zero-GC hot path scrubs 12-digit runs deterministically (same token → same marker → downstream join without retaining raw PII), so CDR payloads with PII can be ingested and redacted without allocator pressure.

Edge / replicated deployments under partition

The chaos-proven partition/heal convergence, the opt-in WAL + bounded snapshot recovery (O(post-checkpoint)), the eBPF SK_REUSEPORT steering (sticky across 4-tuple roam), and the jittered-backoff HTTP client with a bounded lock-free pool (the "1M edge nodes won't thunder the coordinator" mandate) make the engine a fit for edge deployments that partition frequently. The ConvergenceProbe (pkg/mesh/probe.go) composes two Gossipers/PeerSets/engines for partition/heal/SLO measurement. RecoverEngineWithSnapshot recovers from a crash with witness.Bounded and preserves history (TestQuery_ResilientAfterBoundedRecovery_HistorySurvivesCrash). The peer_key_slice_probe.go negative-compile guard bans the non-comparable map[ed25519.PublicKey]X pattern, so the admission layer stays compile-safe on edge toolchains.