patinaDB 0.15.0
All workspace crates share version 0.15.0. This manual covers the current revision; publishing documentation does not publish a binary or authorize a production rollout.
What changed since 0.13.0
- Region-aware Bolt routing includes named nonvoting learners and explicit local-read policies. See Multi-Region Topology.
- Scoped causal bookmarks fence reads against applied commits. A routed reader must catch up or refuse the read; routing alone does not guarantee freshness. See Bolt and Client Retry Contract.
- The correctness/security audit hardens snapshot database reconciliation, transport trust, Bolt resource limits and derived-cache lifetime. See Limitations for boundaries that still apply.
- Automated local release gates exercise idempotency, recovery, routing and impaired learner links. The Jira fan-out harness adds simultaneous admission under reads and updates. A local regression pass is not customer acceptance.
Current qualification: not production approved
The measurements below used the original relative gate. Subsequently, on 2026-09-08 (#1261), the user selected p90 <= 300 ms for explicit backup/fan-out profiles, with relative 3x increases reported as warnings. Old artifacts retain their original verdicts; this policy change is not a fresh qualification run.
The corrected-proxy local 1M-ticket run on 2026-09-08 (#1261) completed 60/60 successful samples per query family, with 2 reads/s and 0.1 updates/s during the mixed phase. Both learner logs show physical installation and subsequent history backfill completion. However, the unchanged whole-phase p90 gate fails:
| Query | Idle p90 | Mixed p90 | Mixed / idle |
|---|---|---|---|
| Q1 | 10.547 ms | 79.391 ms | 7.528x |
| Q3 | 10.989 ms | 62.795 ms | 5.715x |
| Q4 | 17.728 ms | 95.477 ms | 5.386x |
| Q5 | 11.429 ms | 58.257 ms | 5.097x |
| Q7 | 10.768 ms | 49.430 ms | 4.591x |
| Q9 | 10.811 ms | 70.946 ms | 6.562x |
The required limit is 3x each query’s idle p90. Q2/Q10 pass; only the previously
accepted Q6/Q8 exceptions apply at this scale. Low absolute latency does not
erase a failed relative budget. These are two 300-second phases on one shared
host with synthetic learner links, not real WAN, isolated transfer latency,
p99 qualification or a 6M/60M extrapolation. The run failed before final causal
evidence was persisted; it does not establish a complete onboarding verdict.
Source: #1261, docs/jira-fanout-2026-09-08.md in the source tree and its retained
million2 raw baseline/mixed reports. The interference cause remains unisolated.
Cold onboarding at the target throughput, real-backend integration, real WAN, off-host restore and operating/retry contracts remain release obligations. See First Customer and Limitations.
Upgrade boundaries
The package-version bump itself does not alter storage or peer-protocol formats. Do not infer rolling mixed-version compatibility from package numbers: regional routing and causal identity changes have their own protocol/snapshot contracts. Use the production runbook, take and verify a backup, and qualify the exact candidate before upgrading a live cluster.