Run the storage engine with a Rust allocator on targets that have no host filesystem or network stack.
Acceptance criteria · Run the core tests without default features and compile the library for bare-metal ARM.
Evidence · docs/OVERNIGHT_REPORT_V1.md records 16 core tests passing without default features on Windows GNU and Linux under WSL2, plus a thumbv7em-none-eabi compile check.
Verified on ·
Engineering history
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified JSON shinies, warrens and dens
Organize documents under separate databases and collections, including persistent empty namespaces.
Acceptance criteria · Reopen a database with independent namespaces and empty dens. Preserve legacy documents and reject removal of a populated namespace.
Evidence · crates/ratdb-document/src/lib.rs: catalog_reopen_and_guarded_deletion and isolation_legacy_and_reopen. Both passed in the 0.1.0 release checks.
Verified on ·
Engineering history
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified Document reads, writes and cursor pages
Store JSON objects by ID, update selected fields and traverse a collection in key order.
Acceptance criteria · Insert, read, update and delete by ID. Resume an ordered page after deleting its cursor record.
Evidence · crates/ratdb-server/tests/server.rs: persistent_crud_restart_and_ownership and application_commands_over_persistent_connections exercise authenticated CRUD, concurrent field updates and filtered pages.
Verified on ·
Engineering history
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified Local authentication and shell sessions
Connect to the local database using one password exchange per session.
Acceptance criteria · Reject bad credentials, reuse one authenticated connection, and reconnect the shell after restarting the server.
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified Recovery after process termination
Determine which writes survive when the process stops during publication.
Acceptance criteria · Kill a writer during a commit and after acknowledgement. Reopen, check integrity and compare the recovered value with the allowed outcomes.
Evidence · scripts/crash_test.py passed 20 process-kill scenarios per OS on Windows GNU and Linux under WSL2. docs/RECOVERY_AUDIT.md explains the separate hardware power-loss gate.
Verified on ·
Engineering history
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified Page index and incremental writes
Reduce the bytes written for small changes to large databases.
Acceptance criteria · Prototype a separately versioned page index. Measure bytes written per update against v1 at 100,000 keys and verify recovery at every root publication boundary.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/STORAGE_SCALING_V1.md records 4,800,128 adapter bytes for a batch of 16 replacements at 100,000 records in v1.
· Verified · cdcbd6957a24 · The fixed-key prototype met the stated acceptance criteria. Production still uses v1. Arbitrary keys, migration and physical power-cut qualification remain open.
Planned Capacity growth and page reclamation
Extend a database safely and reclaim unused space within an explicit storage budget.
Acceptance criteria · Grow within an explicit capacity limit, reuse released space under repeated updates, and reopen correctly after interrupted allocation or reclamation.
Evidence · docs/ROADMAP.md identifies bounded reclamation as a requirement for a future page format. V1 uses two fixed-size banks.
Engineering history
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap.
Needs hardening Ambiguous commit-header recovery
Distinguish an interrupted publication from damage to previously acknowledged data.
Acceptance criteria · Detect or safely report loss of a complete published header, including after interrupted metadata writes.
Evidence · crates/ratdb-core/src/tests.rs covers torn_commit_header_all_prefixes and all_invalidation_prefixes_preserve_active_data. docs/RECOVERY_AUDIT.md identifies complete header erasure as ambiguous in v1.
Engineering history
· Needs hardening · d5b5e5669f14 · Imported from the original public alpha roadmap.
Planned Migration from v1 storage
Move existing database contents into a future storage format without losing the recovery path.
Acceptance criteria · Migrate legacy, W1 and C1 records into a candidate format. Interrupt each stage and verify the source remains recoverable and document counts and contents agree.
Verified Server transactions and conditional writes
Commit related documents together through the server and detect concurrent changes.
Acceptance criteria · Commit related writes over one network request, reject a stale precondition atomically, and reconcile the result if the reply is lost.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/EMBEDDED_DOCUMENTS.md documents atomic embedded batches. docs/PROTOCOL.md documents individual network command commits.
· Verified · 2432bf376baa · One authenticated request atomically applies up to 128 explicit changes under an instance-wide generation check.
Verified Secondary indexes and unique fields
Look up documents by a field other than ID and enforce uniqueness where an application requires it.
Acceptance criteria · Evaluate index cost and semantics with a username constraint. Demonstrate that concurrent inserts, edits and recovery preserve uniqueness before adopting a design.
· Research · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/OVERNIGHT_REPORT_V1.md lists ID uniqueness as the current application guarantee.
· Verified · fec60ea66d37 · The v3 development checkout passed the acceptance criteria on Windows and Linux under WSL. File and memory costs were measured. The frozen alpha uses v1.
Verified Online backup
Back up a committed generation while the service continues handling mutations.
Acceptance criteria · Capture one committed generation while clients write. Restore the backup and compare it with that generation, including namespace metadata.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/BACKUP_RESTORE.md documents the current offline procedure and exclusive file ownership.
· Verified · acb3a3aa3294 · Authenticated live backup passed on a disposable instance. Writers pause while the committed bank is copied.
Verified JavaScript client
Read and write RatDB documents from a JavaScript application.
Acceptance criteria · Authenticate once, operate on a selected den, page results, and test malformed frames and disconnects against the real server.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/PROTOCOL.md defines the v1 framing and operation responses for a future client.
· Verified · c27ff5d9df9c · The dependency-free Node client passed 13 integration and wire tests. It connects through a local TCP endpoint.
Needs hardening Operational limits under application load
Characterize the service as data size and client demand approach configured limits.
Acceptance criteria · Measure latency and resource use under concurrent requests, near-full writes and slow clients on native Windows and Linux.
· Needs hardening · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified Consistent reads across pages
Let an application traverse one coherent view while other sessions modify its data.
Acceptance criteria · Compare ways to retain a read view across cursor requests. Bound snapshot lifetime and storage costs while concurrent writers insert and delete records.
· Research · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/API.md documents current keyset pages: each request sees its own committed state.
· Verified · 91c9d2ab1b82 · Verified bounded v3 snapshots across cursor requests with concurrent writers, historical indexed results and session-scoped cleanup on Windows and Linux.
Translate the core storage contract to sector devices and positioned filesystem I/O.
Acceptance criteria · Run representative adapters through reopen, partial-sector write, failed-barrier and stalled-I/O cases.
Evidence · crates/ratdb-core/examples/asterhold.rs contains four passing mock-adapter tests, including reopen_each_adapter and stalled_filesystem_io_is_an_error.
Verified on ·
Engineering history
· Verified · d5b5e5669f14 · Imported from the original public alpha roadmap.
Planned Asterhold storage service
Use the Asterhold operating system's storage and recovery services.
Acceptance criteria · Run the adapter contract on Asterhold's own filesystem or volume service. Verify exclusive ownership, durable length changes, flush ordering and restart.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap.
Planned Native IPC
Share an instance between OS services using native interprocess messages.
Acceptance criteria · Start a resident service after storage initialization. Send bounded requests over native IPC and verify restart and client error handling without a TCP stack.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap.
Planned Physical ARM and constrained-device trials
Measure memory, timing and recovery behavior on the actual embedded target.
Acceptance criteria · Boot the core on a named ARM board, measure heap and stack at the configured limits, and recover from resets using the board's actual storage.
Evidence · docs/OVERNIGHT_REPORT_V1.md records a bare-metal ARM compile check. Hardware execution remains open.
Engineering history
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap.
Research Flash endurance and device replacement
Determine whether candidate storage has sufficient endurance and a workable replacement procedure.
Acceptance criteria · Measure controller writes and erase cycles on candidate media, then rehearse replacement and cold restore using an independently retained copy.
Evidence · docs/FRONTIER_DESIGN.md outlines proposed wear measurements and replacement exercises.
Engineering history
· Research · d5b5e5669f14 · Imported from the original public alpha roadmap.
Establish which device and filesystem combinations preserve acknowledged writes through a power cut.
Acceptance criteria · Cut power on named filesystem and device combinations. Match an external acknowledgement log against recovered records and publish unsupported configurations.
Evidence · docs/RECOVERY_AUDIT.md defines the fault model and distinguishes simulated failures and process kills from physical cuts.
Engineering history
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap.
Verified Upgrade and restore validation
Exercise backward compatibility, upgrades and restored service startup across supported releases.
Acceptance criteria · Restore archived fixtures from supported releases, test interrupted upgrades, and verify data, catalog entries and documented rollback procedures.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap. docs/STORAGE_FORMAT.md describes current version and downgrade boundaries.
· Verified · 7513d840789d · Validated the frozen alpha to current v1 development build. Future format migrations need their own rehearsal.
Planned Sustained application workloads
Quantify long-running behavior under representative application traffic.
Acceptance criteria · Run a near-capacity mixed website or CRM workload on native Windows and Linux. Publish tail latencies, peak memory, write volume and restart outcomes.
· Planned · d5b5e5669f14 · Imported from the original public alpha roadmap.
Needs hardening Operator recovery procedures
Provide procedures that an operator can follow to recover an unavailable instance.
Acceptance criteria · Have operators follow the runbooks on clean hosts, restore onto replacement storage and recover a service without overwriting its source.
Evidence · docs/BACKUP_RESTORE.md contains the offline procedure. scripts/backup_test.py verifies no-overwrite publication, rejection of invalid input and refusal of a busy source.
Engineering history
· Needs hardening · d5b5e5669f14 · Imported from the original public alpha roadmap.
Needs hardening Release packaging and platform gates
Distribute reproducible, tested artifacts with checksums and a supported-platform matrix.
Acceptance criteria · Install the packaged release on clean supported systems, exercise actual binaries, and publish the supported OS and library versions with the test matrix.
Evidence · docs/OVERNIGHT_REPORT_V1.md records 50 passing all-target tests on Windows GNU and Linux under WSL2, release binary sizes and remaining native-platform qualification gaps.
Engineering history
· Needs hardening · d5b5e5669f14 · Imported from the original public alpha roadmap.
RatDB