Primary Use Cases
Each use case is grounded in a real capability surfaced by the engine source — and carries an honest scale caveat where the test doc is explicit about what is and isn’t proven.
Planetary-scale event sourcing
The δ-CRDT core + IBLT/strata set reconciliation + sharded lock-free HAMT make the engine a fit for event-sourcing workloads that must converge across a large fleet without a central sequencer. Join is a merge-union join-semilattice (commutative/associative/idempotent, proven by rapid property tests and chaos mesh convergence), so events can be originated at any node and folded without coordination. GenerateDelta(remoteDigest) ships the minimal missing state; GenerateDeltaStratified(remoteSE) makes the delta ∝ |A−B| via strata estimation. The async double-buffered MemTable flush (256 MB arenas, cap-4 in-flight backpressure) keeps the write path off the hot CAS path while streaming to per-entity Arrow IPC.
Honest scale caveat
The chaos mesh gate runs 32 nodes × 64 events, not millions; the convergence property is scale-free but the planetary-scale claim is unproven by these tests (the test doc is explicit).
Multi-region eventually-consistent state
The TLS 1.3 mesh + anti-entropy sweep + Lamport causal dots + ACK-before-durability contract make the engine a fit for multi-region state that must remain available under partition and converge after heal. TestPartitionHeal_ConvergesUnder100ms proves bidirectional partition → divergence injection → heal → byte-equal roots + zero data loss + heal-to-convergence < 100 ms SLO. The clock cap (IngressHLCScalarCap) drops future-skewed frames before the ~60 µs verify, so a Byzantine peer cannot brick a receiver's Lamport clock. The skew-bound wire-integrity seam closes the far-future-dot (A1) and disk-state-poisoning (A4) attacks. InsertLocalEvents routes through bridge.PutLocal (WAL fsync) and returns 503 — not a lying 200+zero-dot — on fsync failure, so a client learns durability was not achieved.
Geo / spatial-temporal workloads
H3Index on every CRDTEntry + the Arrow h3_index column + the memfd SPSC H3 ring make the engine a fit for workloads that query by both time and geography (fleet telemetry, asset tracking, coverage analysis). The bitemporal AsOf/Range queries resolve "what did the system believe about entity X at valid-time V as of tx-time T" over the durable Arrow tier plus a read-your-writes live HAMT merge. The EpochBatcher amortizes H3 enrichment across cross-process round-trips.
Honest caveat — H3 worker
The C++ h3_worker is operator-supplied; the SPSC ring is proven structurally but not with the real worker.
Post-quantum-secure data infrastructure
The Ed25519 verify gate is the production seam today; the ML-DSA-65 preview envelope (pq_preview) is wired for promotion once the 32c economics are measured. The size economics are measured, not assumed (sig 3309 B, pub 1952 B, 51.7× inflation), and the TestVerdictMatrix_PQ gate enforces bloat-ratio >= 50× so the GO/NO-GO decision cannot drift silently. The hedged EdDSA signer (randomized nonce) closes side-channel nonce-reuse attacks while staying compatible with the unchanged verifier. For workloads with long confidentiality horizons (decades), the engine is post-quantum-secure from day one rather than retrofittable.
High-write low-latency telemetry / CDR pipelines
The zero-GC hot path (0 allocs/op for HAMT.Set), the 128-byte cache-line discipline, the CAS+EBR lock-free write path, and the off-heap jemalloc SkipListArena make the engine a fit for high-write low-latency pipelines (CDR, telemetry, audit). The telemetry→Prometheus bridge surfaces 19 supremum_* cumulative series on /metrics with zero hot-path allocations; the Recorder records ingest/verify latency histograms and a six-value verdict counter (no WithLabelValues map lookup per frame). internal/transport's EPOLLET Cap'n Proto ingestion server (MaxConnections=4096, ReadBufSize=64KB, jemalloc-backed reassembly, runtime.Pinner zero-copy dispatch) is the high-throughput ingress path — proven E2E by TestParseMessages_RealClient_EndToEnd (Unix socket, all 5 TriTemporalEvent fields within 2s). The MaskPII zero-GC hot path scrubs 12-digit runs deterministically (same token → same marker → downstream join without retaining raw PII), so CDR payloads with PII can be ingested and redacted without allocator pressure.
Edge / replicated deployments under partition
The chaos-proven partition/heal convergence, the opt-in WAL + bounded snapshot recovery (O(post-checkpoint)), the eBPF SK_REUSEPORT steering (sticky across 4-tuple roam), and the jittered-backoff HTTP client with a bounded lock-free pool (the "1M edge nodes won't thunder the coordinator" mandate) make the engine a fit for edge deployments that partition frequently. The ConvergenceProbe (pkg/mesh/probe.go) composes two Gossipers/PeerSets/engines for partition/heal/SLO measurement. RecoverEngineWithSnapshot recovers from a crash with witness.Bounded and preserves history (TestQuery_ResilientAfterBoundedRecovery_HistorySurvivesCrash). The peer_key_slice_probe.go negative-compile guard bans the non-comparable map[ed25519.PublicKey]X pattern, so the admission layer stays compile-safe on edge toolchains.