# Evidence ledger — “One commit, three engines”

This evidence ledger indexes every quantity the paper cites against its originating receipt. Repository: `Hyphae-Research-Foundation/hyphae`. Working tree at ledger construction: `f65ada5`. Release source commit: `24bce1accdff8d14127797afe6f237a57c1cd4f3` (tag `release-v3.0.0-crates`, tree `52bdbb3ea7cd8d12e2cbd6cbe5f53cbcaa80d0ff`). Date: 2026-09-04. Every value below is quoted verbatim from the named receipt — nothing is rounded, averaged, or inferred — and each row carries the receipt's own caveats. Where a figure the paper would want does not exist in any receipt, it appears in the Gaps list rather than being reconstructed. The only non-receipt number is the LOC count, measured on working tree `f65ada5` over `crates/**/*.rs`.

I have everything. Here is the evidence ledger.

# EVIDENCE LEDGER — "One commit, three engines"

Repo: `hyphae` @ `main`, workspace version `3.0.0`. Ledger built 2026-09-04 against working tree `f65ada5`. All values quoted verbatim from receipts; no rounding, no derivation except where a receipt states the ratio itself.

**Host/class shorthand:** `M-a443c52`, `M-2ff8a4b`, `M-8aeb6ea` = AWS `i7i.metal-24xl` bare metal (Xeon Platinum 8559C, 96 logical CPUs, 755 GiB RAM, instance-store NVMe, ext4 `noatime`, `performance` governor, hypervisor flag absent), Ubuntu 24.04, kernel `7.0.0-1011-aws`, rustc 1.96.0, `us-east-2c` — **environment class 3**. `c-16` = DigitalOcean droplet (16 vCPU Xeon Platinum 8168 @ 2.7 GHz, 32 GB) — **class 2, virtualized**. `m6i.2xlarge` = AWS EC2 under KVM (Xeon Platinum 8375C, 8 vCPU, 30 GiB) — class 2.

**Critical caveat inherited by every row in §1–§3, §5(sweeps), §8:** all three metal receipts state "same host class … but a **different physical machine** each time — deltas under ~10 % are not claimed."

---

## 1. Cross-engine transaction cost

Shape = 1 INSERT + 1 SET + 1 indexed document, `Memory` durability, 2,000 commits.

| quantity | value | unit | source file | section | measured commit | host/class | caveat |
|---|---|---|---|---|---|---|---|
| Materialized batch p50 | 46.6 | ms | `docs/gates/evidence/hyphae-3.0-metal-a443c52-2026-09-03.md` | §4 | `a443c52` | M / class 3 | `begin_optimistic`; one run |
| Materialized batch p99 | 95.8 | ms | same | §4 | `a443c52` | M / class 3 | one run |
| **Delta batch p50** | **1.02** | ms | same | §4 | `a443c52` | M / class 3 | `begin_optimistic_delta` |
| **Delta batch p99** | **1.09** | ms | same | §4 | `a443c52` | M / class 3 | — |
| SQL only | 200 | µs | same | §4 | `a443c52` | M / class 3 | delta staging |
| SQL + structure | 371 | µs | same | §4 | `a443c52` | M / class 3 | — |
| SQL + structure + search | 1.02 | ms | same | §4 | `a443c52` | M / class 3 | — |
| Materialized p50 / p99 | 65.0 / 127 | ms | `baseline-i7i-metal-2026-09-03.md` | §5 | `2ff8a4b` | M / class 3 | pre-B+tree-fix; "pessimistic for 3.0" |
| Delta p50 / p99 | 1.10 / 1.16 | ms | same | §5 | `2ff8a4b` | M / class 3 | — |
| SQL / +structure / +search | 218 / 386 / 1.07 | µs,µs,ms | same | §5 | `2ff8a4b` | M / class 3 | marginals stated: +168 µs, +684 µs |
| Materialized p50 / p99 | 55.1 / 101 | ms | `baseline-i7i-metal-2026-08-30.md` | §5 | `8aeb6ea`-plus-harness | M / class 3 | harness uncommitted at measure time |
| Delta p50 / p99 | 1.13 / 1.26 | ms | same | §5 | `8aeb6ea` | M / class 3 | receipt: delta "~49× faster at p50" |
| SQL / +structure / +search | 205 / 444 µs / 1.13 ms | — | same | §5 | `8aeb6ea` | M / class 3 | marginals: +239 µs, +690 µs |
| Group-commit smoke, strict p50 | 1.54 ms @ 587/s | ms, commits/s | `hyphae-3.0-metal-a443c52-2026-09-03.md` | §4 | `a443c52` | M / class 3 | 256 commits, 8 producers, delta path |
| Group-commit smoke, group p50 | 3.14 ms @ 2,263/s | ms, commits/s | same | §4 | `a443c52` | M / class 3 | "3.86× strict throughput" |
| Group-commit smoke, strict / group | 1.67 ms @ 535/s; 3.28 ms @ 2,141/s | — | `baseline-i7i-metal-2026-09-03.md` | §5 | `2ff8a4b` | M / class 3 | "4.0× the strict throughput" |

**Original contract receipt** — `docs/gates/evidence/native-delta-all-engine-transaction-linux-2026-08-03.md` (name matches; contract commit `7c70654`, measured runtime commit `28a7af7`), `m6i.2xlarge` under KVM, pinned CPU 0, concurrency 1, median of three runs:

| quantity | value | unit | source file | section | measured commit | host/class | caveat |
|---|---|---|---|---|---|---|---|
| PING 32 B p50 | 5.625 | µs | contract receipt | UDS latency observations | `28a7af7` | m6i.2xlarge / class 2 | UDS, warm, 1 client; "must not be causally compared with the sealed baseline" |
| SQL stage p50 | 12.439 | µs | same | same | `28a7af7` | m6i.2xlarge | median statistic of 3 runs |
| Structure stage p50 | 6.929 | µs | same | same | `28a7af7` | m6i.2xlarge | — |
| Search stage p50 | 7.873 | µs | same | same | `28a7af7` | m6i.2xlarge | — |
| Memory commit p50 | 1.001241 | ms | same | same | `28a7af7` | m6i.2xlarge | "Memory and strict commit remain outside [the microsecond] domain" |
| Strict commit p50 | 9.388397 | ms | same | same | `28a7af7` | m6i.2xlarge | — |
| Peak heap (whole process) | 11.52 | MiB | same | Allocation observation | `28a7af7` | m6i.2xlarge | heaptrack; "not a per-operation allocation claim" |
| Allocation calls | 53,923,701 | count | same | same | `28a7af7` | m6i.2xlarge | whole-process incl. setup |
| Leaked at exit | 544 | bytes | same | same | `28a7af7` | m6i.2xlarge | — |
| Targeted delta / local txn / runtime unit suites | 5 / 22 / 339 | tests passed | same | Red and deterministic gates | `28a7af7` | m6i.2xlarge | — |
| Workspace funnel | 697 passed, 0 failed, 1 ignored | tests | same | Final validation | `28a7af7` | m6i.2xlarge | 84 result blocks |

## 1b. Delta scaling sweeps (§5)

Version depth — `a443c52`, CPU 0, median of three runs, `Memory`:

| prior versions | total p50 (µs) | stage (µs) | commit (µs) | page reads | appends | full-state loads | source |
|---|---|---|---|---|---|---|---|
| 1 | 194 | 32.4 | 161 | 9 | 3 | 0 | a443c52 §5 |
| 32 | 193 | 32.4 | 161 | 9 | 3 | 0 | a443c52 §5 |
| 256 | 202 | 38.8 | 163 | 9 | 3 | 0 | a443c52 §5 |
| 1,024 | 201 | 38.8 | 162 | 9 | 3 | 0 | a443c52 §5 |

Population — `a443c52`, same conditions:

| unrelated items/engine | total p50 (µs) | stage (µs) | commit (µs) | page reads | appends | source |
|---|---|---|---|---|---|---|
| 0 | 346 | 34.2 | 272 | 17 | 5 | a443c52 §5 |
| 256 | 676 | 33.6 | 577 | 30 | 11 | a443c52 §5 |
| 4,096 | 893 | 51.1 | 764 | 41 | 14 | a443c52 §5 |

`2ff8a4b` (`baseline-i7i-metal-2026-09-03.md` §6; adds WAL bytes = 65,536 at every depth point; "Every point: 0 complete-state loads, 0 complete-catalog loads"; 32 observations per point, `taskset -c 0`):

| point | total p50 | stage | commit | reads | appends |
|---|---|---|---|---|---|
| depth 1 / 32 / 256 / 1,024 | 194 / 196 / 197 / 195 µs | 32.5 / 33.4 / 33.5 / 33.4 µs | 161 / 161 / 163 / 161 µs | 9 | 3 |
| pop 0 | 346 µs | 34.1 µs | 273 µs | 17 | 5 |
| pop 256 | 805 µs | 35.6 µs | 707 µs | 30 | 15 |
| pop 4,096 | 1,045 µs | 52.6 µs | 917 µs | 43 | 20 |

`8aeb6ea` receipt (2026-08-30) contains **no** delta scaling sweep section — the sweeps first appear on `2ff8a4b`. Contract receipt (`m6i.2xlarge`) equivalents: depth 257.708/259.446/257.765/258.369 µs (reads 9, appends 3, WAL 65,536, full state 0, full catalog 0); population 904.657 µs / 1.397271 ms / 1.651544 ms (reads 35/54/65, appends 16/28/30). The `2ff8a4b` receipt summarizes this as "the 2026-08-03 receipt was an `m6i.2xlarge` under KVM: 258 µs flat, 905 µs → 1.65 ms".

## 2. Durability ablations

Identical single-`SET` commits on the **materialized** path, 10,000 commits per phase, fresh directory, no maintenance between commits.

| quantity | value | unit | source file | section | commit | host/class | caveat |
|---|---|---|---|---|---|---|---|
| Strict p50 | 4.39 | ms | `hyphae-3.0-metal-a443c52-2026-09-03.md` | §4 | `a443c52` | M / class 3 | "back at the 2.2.0 level and slightly under it" |
| Memory p50 | 3.86 | ms | same | §4 | `a443c52` | M / class 3 | — |
| Group (8 producers) p50 | 12.4 | ms | same | §4 | `a443c52` | M / class 3 | 497 commits/s vs strict 196/s (2.5×) |
| Strict clocks p50 | execution 1.58 ms, wal_append 49 µs, page_sync 536 µs, wal_sync 589 µs | — | same | §4 | `a443c52` | M / class 3 | receipt clocks |
| Memory clocks p50 | execution 366 µs, wal_append 41 µs | — | same | §4 | `a443c52` | M / class 3 | — |
| Strict p50 | 35.5 | ms | `baseline-i7i-metal-2026-09-03.md` | §5 | `2ff8a4b` | M / class 3 | **published regression** |
| Memory p50 | 34.2 | ms | same | §5 | `2ff8a4b` | M / class 3 | regression |
| Group (8) p50 | 40.4 | ms | same | §5 | `2ff8a4b` | M / class 3 | throughput 170/s vs strict 31/s |
| Strict clocks p50 | execution 1.84 ms, wal_append 75 µs, page_sync 683 µs, wal_sync 662 µs | — | same | §5 | `2ff8a4b` | M / class 3 | clocks unchanged; extra ~31 ms outside them |
| Memory clocks p50 | execution 440 µs, wal_append 45 µs, zero sync | — | same | §5 | `2ff8a4b` | M / class 3 | — |
| Strict p50 | 4.98 | ms | `baseline-i7i-metal-2026-08-30.md` | §5 | `8aeb6ea` | M / class 3 | — |
| Memory p50 | 3.62 | ms | same | §5 | `8aeb6ea` | M / class 3 | — |
| Group (8) p50 | 16.1 | ms | same | §5 | `8aeb6ea` | M / class 3 | throughput 451/s vs strict 198/s (2.3×) |
| Strict clocks p50 | execution 1.69 ms, wal_append 64 µs, page_sync 650 µs, wal_sync 657 µs | — | same | §5 | `8aeb6ea` | M / class 3 | — |
| Memory clocks p50 | execution 410 µs, wal_append 50 µs, zero sync | — | same | §5 | `8aeb6ea` | M / class 3 | — |

### Regression narrative (`baseline-i7i-metal-2026-09-03.md` §5 / §5a)

| quantity | value | unit | section | host/class | caveat |
|---|---|---|---|---|---|
| Bisect, Memory p50: `17a841d` (branch base) | 4.3 | ms | §5a | c-16 / class 2 | 4,000 commits/phase; "relative same-host A/B only" |
| Bisect: `eec0784` | 3.8 | ms | §5a | c-16 / class 2 | — |
| Bisect: **`93dc3d3`** | **35.6** | ms | §5a | c-16 / class 2 | regression enters here ("point-resolved batch ingest and coalesced scalar root construction") |
| Bisect: `2ff8a4b` | 47.6 | ms | §5a | c-16 / class 2 | — |
| At 500 commits/phase, both engines | 1.35–1.39 | ms | §5a | c-16 / class 2 | "cost grows with what accumulates in the tree" |
| Devbox A/B Strict, `8aeb6ea` → `2ff8a4b` | 14.4 → 86.6 | ms | §5a | c-16 / class 2 | ran alongside a 1M job; "absolute numbers are noisy; the ratio is the point" |
| Devbox A/B Memory | 9.6 → 81.7 | ms | §5a | c-16 / class 2 | — |
| Devbox A/B Group (8) | 46.5 → 103 | ms | §5a | c-16 / class 2 | — |
| Devbox A/B shape materialized / delta | 139 → 159 ms; 2.91 → 3.03 ms | — | §5a | c-16 / class 2 | — |
| Directory written by `eec0784`, 4,000 commits | open 11.7 s / 11.6 s; begin p50 2.15 / 2.65 ms | — | §5a | c-16 / class 2 | engines `eec0784` / `93dc3d3`, 20 begins each |
| Directory written by `93dc3d3`, 4,000 commits | open 164 s / 165 s; begin p50 32.4 / 34.5 ms | — | §5a | c-16 / class 2 | "The engine does not matter; the directory does" |
| B+tree unit test leaf count | **904 leaves where 10 would be full** | leaves | §5a | `hyphae-native-btree` unit test | 4,000 random single-key batch upserts |
| `pages.hydb` size, same commits | 182 vs 127 (44 % larger) | MB | §5a | c-16 / class 2 | — |
| Fix `b53348e` devbox A/B, Strict/Memory/Group | 13.9 / 10.5 / 44.9 | ms | §5a | c-16 / class 2 | vs 14.4 / 9.6 / 46.5 for `8aeb6ea`; full scale, one run |
| Fix `b53348e`, materialized shape / delta shape | 159 → 115 ms; 3.03 → 2.49 ms | — | §5a | c-16 / class 2 | — |
| Fix `b53348e`, 250k ladder ingest | 1,099 → 1,346 | docs/s | §5a | c-16 / class 2 | durable scorer 22–24 → 13.6 ms |

Chain: `93dc3d3` (introduces) → `6df81f2` / `b53348e` (fix, `append_leaf_level_balanced` in `rewrite_node_batch`; occupancy test asserts leaf count within 2× full-packing minimum). Note: the receipts name **`b53348e`** as the fix commit; `6df81f2` does not appear in any receipt text — verify before citing.

## 3. Per-engine comparisons (losses included)

### Baseline versions and postures
`baseline-i7i-metal-2026-08-30.md` header + `benchmarks/baseline-harness/README.md`: SQLite 3.50.2 (`rusqlite` 0.37 bundled, WAL, `synchronous=FULL`); DuckDB v1.5.5 (`duckdb` 1.4.1 bundled, default durable WAL); Redis 7.0.15 (UDS only, `appendonly yes`, separate `appendfsync always` and `appendfsync everysec` servers); Tantivy 0.25 (default BM25, 256 MiB writer heap). Workloads: "deterministic seeded xorshift64*, byte-identical rows, keys, documents, and query strings across engines; exclusive per-operation latency; skewed key distribution." Harness fairness rules: like-for-like durability, prepared statements everywhere, baselines at documented defaults, "DuckDB is included as a familiar reference point, not as an OLTP victim: it is a columnar OLAP engine." `2ff8a4b` and `a443c52` both state baselines/workloads unchanged from 2026-08-30.

### §1 SQL point workload — 1,000,000 rows; 200,000 skewed prepared point SELECTs, 10,000 strict single-row UPDATE commits, 100,000 UPDATEs in groups of 100

| Phase (p50 / p99) | `a443c52` | `2ff8a4b` | `8aeb6ea` | SQLite | DuckDB | caveat |
|---|---|---|---|---|---|---|
| Point SELECT prepared | 20.3 / 36.3 µs | 34.0 / 36.5 µs | 30.8 / 33.3 µs | 1.8 / 2.1 µs | 191 / 235 µs (a443c52 col); 190 / 253 (2ff8a4b); 190 / 232 (8aeb6ea) | **SQLite 11× faster** (a443c52); ~19× (2ff8a4b); ~17× (8aeb6ea) |
| UPDATE, fsync per commit | 1.75 / 2.43 ms | 1.85 / 2.56 ms | 1.82 / 2.51 ms | 21.9 µs / 402 µs; 22/506; 22/398 | 915 µs / 1.38 ms; 920/1.37 ms; 922/1.39 ms | Hyphae pays page COW + WAL block + fsync ×2 |
| UPDATE, batched ×100 | 30.6 / 31.4 ms | 33.7 / 34.2 ms | 29.4 / 30.0 ms | 724 µs / 4.34 ms; 734/4.36; 735/4.4 | 23.7 / 30.8 ms; 23.2/29.6; 23.8/31.1 | — |
| Load 1,000-row batches | 4.0/s | 3.9/s | 4.3/s | 963/s; 932/s; 967/s | 13.1/s; 13.1/s; 13.5/s | batches per second |

Read checksums matched across all three engines (200,000 hits each) in all three receipts. `2ff8a4b` records the +10 % on prepared SELECT (30.8 → 34.0 µs) as "inside what two single runs on different instances of the same class show … recorded, not explained."

### §2 Keyspace — 1,000,000 keys; 500,000 skewed GETs, 10,000 strict SETs, 200,000 relaxed SETs

| Phase (p50 / p99) | `a443c52` | `2ff8a4b` | `8aeb6ea` | Redis UDS `always` | Redis UDS `everysec` | caveat |
|---|---|---|---|---|---|---|
| GET | 2.2 / 16.3 µs | 11.1 / 14.1 µs | 13.5 / 16.0 µs | 7.9 / 10.8; 8.0 / 9.9; 8.1 / 9.1 µs | 8.2 / 9.5; 7.9 / 8.8; 8.2 / 9.2 µs | a443c52: 3.6× faster at p50 but **"at p99 (16.3 µs) it is the slower one"**; 8aeb6ea: Hyphae **loses** 13.5 vs 8.1 µs |
| SET fsync-per-write vs Strict | 1.81 / 2.53 ms | 1.82 / 2.50 ms | 1.82 / 2.50 ms | 509 µs / 910 µs; 509/945; 509/960 | — | Redis ~3.6× faster; two fsyncs vs one AOF fsync |
| SET no-fsync-ack vs `everysec` | 371 / 404 µs | 357 / 376 µs | 376 / 414 µs | — | 9.6 / 11.5; 8.7 / 10.4; 9.1 / 11.1 µs | Redis ~40× faster; gap is root-publication cost, not fsync |

### §3 Lexical BM25 — 100,000 synthetic documents (~60 tokens, 50k-term skewed vocabulary), 10,000 two-term top-10 queries

| Phase (p50 / p99) | `a443c52` | `2ff8a4b` | `8aeb6ea` | Tantivy | caveat |
|---|---|---|---|---|---|
| Query top-10 | 111 / 181 µs | 255 / 856 µs | 4.09 / 6.55 ms | 78.3 / 82.9 µs; 77.6 / 83.1; 76 / 81 | Tantivy leads **1.4×** (a443c52), 3.3× (2ff8a4b), ~50× (8aeb6ea) |
| Ingest 1,000-doc durable batch | 1.12 / 1.73 s | 2.19 / 2.89 s | 16.6 / 17.9 s | 27.0 / 45.7 ms; 29.1 / 43.1; 28 / 47 | Tantivy leads **41×** (a443c52), 75× (2ff8a4b), ~580× (8aeb6ea) |

Hit totals matched (100,000 vs 100,000) in all three. `8aeb6ea` also records from an aborted first run: a 1M-document strict-batched ingest "wrote 2.87 TB of copy-on-write pages before being stopped."

## 4. Formal model

| quantity | value | source file | section | caveat |
|---|---|---|---|---|
| Spec name | `docs/formal/HyphaeCommit.tla` (model `HyphaeCommit.cfg`) | `docs/formal/README.md` | HyphaeCommit | — |
| Spec SHA-256 | `b13cfc83454e01ad87c8eeeba74c35b71a1c3a2ebb075380a6f011c4994c9728` | `baseline-i7i-metal-2026-09-03.md` | §1 | digest present only on the `2ff8a4b` receipt |
| Config SHA-256 | `7dfeb0c5c573fb898611dee0598459ded66ddfea431a1df63b72bbd1e5c02ecc` | same | §1 | — |
| `tla2tools.jar` SHA-256 | `936a262061c914694dfd669a543be24573c45d5aa0ff20a8b96b23d01e050e88` | same | §1 | — |
| TLC version | TLC2 2.19 | `baseline-i7i-metal-2026-08-30.md` | §1 | version stated only on the 08-30 receipt |
| Model bounds | 3 transactions, 2 keys, 3 engines, ≤2 crashes | both receipts | §1 | — |
| Workers / flags | 96 workers, `-deadlock` | both receipts | §1 | `-deadlock` required: model has intentional terminal states |
| States generated | 79,063,806 | both receipts | §1 | identical across both runs |
| Distinct states | 43,885,299 | both receipts | §1 | — |
| States left on queue | 0 | `baseline-i7i-metal-2026-09-03.md` | §1 | — |
| Depth of complete state graph | 30 | both receipts | §1 | — |
| Wall time | 01min 45s (`2ff8a4b`); 1min 41s (`8aeb6ea`) | both | §1 | — |
| Result | "Model checking completed. No error has been found." | both | §1 | — |
| Invariants (6, all held) | `TypeOk`, `Atomicity`, `StrictDurability`, `FirstCommitterWins`, `VisiblePrefixComplete`, `CsnBounded` | `baseline-i7i-metal-2026-08-30.md` | §1 | names appear only on the 08-30 receipt |
| Reproduction status | identical state counts ⇒ 08-30 run is *Reproduced* | `baseline-i7i-metal-2026-09-03.md` | §1 | — |
| Crash model | crash truncates volatile WAL suffix at an arbitrary prefix-closed point; fsync is file-wide; `Memory` commits acknowledge without entering the durable set | `docs/formal/README.md` | HyphaeCommit | model "demonstrates (rather than hides) that a crash may drop acknowledged `Memory` commits while never splitting one" |
| Abstraction boundary | "evidence about the protocol as specified, not a proof of the Rust implementation" | `docs/formal/README.md`, `docs/product/claims.md` | — | fidelity carried by `tests/all_engine_transaction_g5.rs`, `examples/process_crash_matrix.rs` |
| a443c52 TLC | **not run** — "the same detached script … minus TLC (already reproduced twice)" | `hyphae-3.0-metal-a443c52-2026-09-03.md` | header | — |

## 5. Crash and recovery evidence

| quantity | value | source file | section | commit | host/class | caveat |
|---|---|---|---|---|---|---|
| Process-kill boundaries (singleton commit) | 7 | `native-process-crash-matrix-linux-2026-08-02.md` | Crash mechanism | `91af0b7` (tree `a613893`) | m6i.2xlarge ext4/EBS, class 2 | one child process per boundary |
| Injected signal | signal 9 (`SIGKILL`) at every boundary | same | Exact Linux result | `91af0b7` | same | parent calls `Child::kill`; no graceful close |
| Recovered CSN sequence | `[null, null, null, null, 1, 1, 1]` | same | Exact Linux result | `91af0b7` | same | blob staged/promoted/page appended/page synced → prior empty; WAL appended/WAL synced/root published → complete CSN 1 |
| Outcome | all seven boundaries passed; no mixed state | same | Red-to-green | `91af0b7` | same | "A partial combination is a hard failure" |
| Native runtime tests | 196 passed | same | Red-to-green | `91af0b7` | same | — |
| Boundary limit | "`SIGKILL` is a real process crash, not physical power loss … the kernel page cache survives" | same | Evidence boundary | — | — | does not cover lost device-cache writes, torn sectors, FS reordering, EBS failure, kill during retention/vacuum/blob collection/group commit/migration, disk full, multi-process readers, UDS, backup/restore |
| Checkpoint process kills | 4 additional scenarios (11 total with the 7) | `native-checkpoint-process-crash-linux-2026-08-02.md` | — | — | m6i.2xlarge / class 2 | signal 9 at all 11 boundaries; debug preflight 11/11 and clean-source release 11/11 passed; native runtime 196 passed |
| Block-layer power-loss scenarios | 7 commit + 4 checkpoint = 11 | `native-block-power-loss-replay-linux-2026-08-02.md` | — | `0a167bc` (tree `679c549`) | m6i.2xlarge + `dm-log-writes`, class 2 | fresh ext4 over `dm-log-writes v1.1.0`; `replay-log` from upstream `7b70d8a6863c5de30933d42a7672d35d01d2dc6c` |
| Commit recovered CSNs | `[null, null, null, null, null, 1, 1]` | same | Singleton commit result | `0a167bc` | same | **differs from process kill at `WAL appended`**: page-cache reopen saw a complete transaction, stable-block replay correctly sees prior state |
| Checkpoint authority tuples | `[(0,0,0,1), (1,0,1,0), (1,0,1,0), (1,1,0,0)]` | same | Commands and mechanical checks | `0a167bc` | same | (manifests, checkpoints, unanchored, temp recovered) |
| `dm-log-writes` entries per mark | 119 to 176 | same | Commands and mechanical checks | `0a167bc` | same | positive count at every mark |
| Verification per scenario | signal 9, normal ext4 mount/recovery, clean read-only `e2fsck`, exact cleanup, all 11 scenarios | same | same | `0a167bc` | same | no active mapper or mount left |
| Raw receipt status | `block-replay-not-physical-device-cut` | same | Evidence boundary | — | — | "not evidence of an actual EC2 stop, EBS detach or failure, availability-zone loss, firmware cache, or arbitrary tear inside a completed block write" |
| Kill/restart + backup/restore soak | `0.2-soak-gate-{windows,wsl2}-x86_64.json` | `docs/gates/evidence/README.md` line 13 | — | 0.2-era | Windows / WSL2, class 1 | JSON only, no Markdown narrative; predates 3.0 by two major versions |

## 6. Isolation / litmus / metamorphic

All five carry the same status line: **"bounded implementation evidence; not promoted into the G2 closure at `a839037`, which claims no universal SQL or official benchmark result."** No host, commit, or timing is recorded in any of them.

| receipt | counts | claims | explicitly does NOT claim |
|---|---|---|---|
| `native-g2-isolation-litmus.md` | 6 proven properties (`tests/sql_isolation_g2.rs`) | repeatable reads from immutable snapshot; private writes visible in-transaction; overlapping row writes → first-committer-wins; rejected txn cannot replace committed value; disjoint stale write sets rebase and both commit; committed state survives reopen | dirty reads, non-repeatable reads, phantoms, lost update, write skew, read-only anomalies, catalog conflicts, unique-index conflicts, rollback/crash boundaries, documented isolation level and anomaly policy; hosted exact-SHA execution and semantic receipt "remain required" |
| `native-g2-metamorphic.md` | 5 checked rewrite families; **256 deterministic cases × 3 rewrites = 768 comparisons**, seed `20260804`, 64-row typed dataset | AND/OR commutativity, double negation, De Morgan, PK range-bound ordering, CTE identity; byte-equivalent logical rows and same output schema | generated typed datasets, seeded reproducibility, broad expression/join rewrites, failure shrinking, exact corpus/generator digests, hosted exact-SHA receipts |
| `native-g2-sqllogictest.md` | 6 covered feature areas, corpus `tests/corpus/g2-smoke.slt` | typed table creation; insert/update/delete; deterministic ordered reads; exact-key reads; bounded non-recursive CTEs; bounded `ROW_NUMBER` windows | broad SQLLogicTest conformance; needs statement/query counts and a content digest |
| `native-g2-tpcc.md` | 8 proven properties; **9 core table families** loaded and reopened (`warehouse`, `district`, `customer`, `orders`, `new_order`, `order_line`, `item`, `stock`, `history`) | atomic New-Order / Payment / Delivery publication; snapshot-consistent Order-Status/Stock-Level reads; first-committer-wins on overlapping New-Order; loser cannot publish; strict-durability survives reopen; rollback publishes neither | canonical full-column TPC-C schema and loader, seeded workload receipts, hosted exact-SHA execution; "Throughput and tail latency remain G7 responsibilities" |
| `native-g2-tpch.md` | 4 admitted query shapes; **matrix accounts for all 22 canonical queries exactly once — Q3 admitted, other 21 with explicit unsupported-feature reasons** | secondary-index filtering, composite-PK prefix reads, materialized CTE, exact supplier lookup, each vs a frozen reference row set | TPC-H correctness closure; canonical schema, scale-factor generator + digests, reference outputs, reopen equivalence, hosted receipts; "Performance claims remain owned by G7" |

## 7. Determinism and proofs

### Cross-host determinism — `docs/gates/evidence/rag-cross-host-determinism-2026-08-22.md`

| quantity | Host A | Host B | caveat |
|---|---|---|---|
| Platform | Linux 7.0.12 (Fedora 44), glibc 2.43 | Linux 5.15.0-185 (Ubuntu 22.04), glibc 2.35 | different distro, kernel line, glibc, CPU gen, Python |
| CPU | Intel Xeon Platinum 8358 | Intel Xeon 6767P | — |
| Python | 3.13 line | 3.11.0rc1 | — |
| `ndcg@10` / `recall@10` / `mrr@10` | 0.235959 / 0.298234 / 0.293643 | identical | — |
| **Directory bytes after ingest** | **55,562,927,163** | **55,562,927,163** | across 7,208 windowed ingest/checkpoint/vacuum cycles |
| **Directory bytes after maintenance** | **564,961,635** | **564,961,635** | — |
| Dataset | BEIR FiQA-2018, 57,638 documents, 648 test queries, archive SHA-256 `32c7df99…3ad02` | — | engine `hyphae 1.2.2`, candidate limit 1,000, k=10, maintenance interval 32 batches |
| Non-claim | "does not claim cross-architecture identity (aarch64 is unmeasured)" | — | also excludes attested embedding float pipelines beyond the separate replay evidence |

### Scorer equivalence ladder

| rung | hits | bit_identical | durable scorer | model scorer | source | commit/host |
|---|---|---|---|---|---|---|
| 100k | 1,000 | true | 12.6 ms | 335 s | `collection-cap-250k-2026-09-02.md` | c-16 / class 2 |
| 250k | 1,000 | true | — | — | same | c-16; "see the appended run log in this file's history" |
| 1M | 1,000 | true | 57.5 ms | 12,596,531.2 ms (~3.5 h) | `baseline-i7i-metal-2026-09-03.md` §9 | `2ff8a4b` / M class 3; 2 terms, 1,562 segments, 372,418 physical entries |
| 1M | 1,000 | true | 39.5 ms cold, 22 ms warm | 12,711,486.6 ms (~3.5 h) | `hyphae-3.0-metal-a443c52-2026-09-03.md` §7 | `a443c52` / M class 3; "fourth rung (100k, 250k, 1M ×2) on which the two scorers agree bit for bit" |

The 1M ladder receipt (`collection-manifest-chunked-1m-ladder-2026-09-03.md`) states its own 1M comparison "is appended to this file when the run completes" — it is **not** appended in the current tree.

### Proof and witness formats

| quantity | value | source file | caveat |
|---|---|---|---|
| Proof envelope magic | ASCII `HYNPRF02`, offset 0, 8 bytes | `docs/native/native-proof-v1.md` | "canonical, bounded proof envelope for native product results" |
| Anchor | `ExternalTrustedAnchor` obtained independently of the proof and witness | same | verifier requires reopened retained authority's lineage, root, catalog version, visible CSN, latest verified state |
| Always-performed verification | 5 steps: decode + canonical re-encode under explicit limits; verify CRC32C, envelope, section, inventory, file digests; compare proof anchor to independently supplied anchor; require identical proof/witness anchors and exact witness reference; account for every retained file and directory | same | scope `ArtifactIntegrity` |
| Semantic re-execution (`HYOPRQ02`) | 7 additional steps: extract witness to new private temp dir; open via `NativeProduct::open` (verifies native WAL, manifests, pages, blobs, catalog, all-engine roots); check retained root + durable checkpoint authority; decode canonical operation under `NativeVerificationLimits`; **re-execute against the retained root and logical time**; compare canonical ordered result, evidence, object bindings; reconstruct and compare ANN/hybrid metadata | same | only this path returns scope `SemanticReexecution` / `semantic_reexecution_performed = true` |
| ANN proof limit | "An ANN proof proves faithful execution of the declared approximate algorithm; it does not prove that omitted vectors could not be closer." | same | quote verbatim |
| Attestation classes | `HYATTS01`: `AttestedLocal` (weights + input + output BLAKE3 digests, replayable) and `DeclaredProvider` (provider/model id + request/response digests, "proves what was sent and received, never that the provider computed it deterministically"); names ≤256 bytes, envelope ≤4 KiB | same | "never-interchangeable classes" |
| Witness magic / version | `HYNWIT02`, format version 2, 64-byte header | `docs/native/native-witness-v1.md` | "intentionally incompatible with `HYNWIT01`" |
| Witness scope | every directory below the native data root (incl. empty) and every regular file with complete bytes + BLAKE3 digest; root implicit; symlinks and special files rejected | same | "contains no origin path and remains usable after the originating directory is deleted" |
| Witness digest domain | `hyphae-native-witness-envelope-v2` | same | CRC32C over header bytes 0..32 (field zeroed) plus payload; BLAKE3 envelope digest at offset 32 |

## 8. Scale ladder

### 250k / 1M on metal (a443c52 §6) — p50, 16 samples, `limit=10`, candidate limit 1,000, reopened directories

| rung | ingest docs/s | ingest wall | vacuum | directory | reopen | bm25 | filtered+facet | phrase | fuzzy(1) |
|---|---|---|---|---|---|---|---|---|---|
| 250k `a443c52` | 4,265 | 58.6 s | 13.8 s | 236 MB | 7.7 s | 6.2 ms | 10.6 ms | 7.3 ms | 12.0 ms |
| 250k `2ff8a4b` | 4,069 | 61.4 s | 14.0 s | 236 MB | 7.7 s | 6.2 ms | 10.7 ms | 7.2 ms | 12.0 ms |
| 1M `a443c52` | 3,638 | 275 s | 64.3 s | 1.01 GB | 34.6 s | 23.2 ms | 42.6 ms | 24.2 ms | 54.2 ms |
| 1M `2ff8a4b` | 3,755 | 266 s | 62.9 s | 1.01 GB | 34.5 s | 51.6 ms | 71.1 ms | 52.7 ms | 89.0 ms |
| ratio 250k→1M `a443c52` | 0.85× | | | | 4.5× | 3.7× | 4.0× | 3.3× | 4.5× |
| ratio 250k→1M `2ff8a4b` | 0.92× | | | | 4.5× | 8.3× | 6.6× | 7.3× | 7.4× |
| c-16 1M (class 2) | 1,014 | 986 s | 185 s | 995 MB | 107 s | 172 ms | 233 ms | 175 ms | 308 ms |

Caveats: "The collection bound stays 250,000; the 1M rows measure above the bound"; bound lifted to 1,000,000 **on the measurement host only**; "The first bm25 sample after a fresh load is still the cold-cache outlier (p95 17 s at 1M, 3.8 s at 250k), reported and not excluded."

### Manifest chunking

| rung | format | chunks | header bytes | largest chunk | header decode | full materialization | one probe | source |
|---|---|---|---|---|---|---|---|---|
| 100k legacy | `HYPSMAN1` | — | 1,600,012 | — | 0.54 ms | 1.4 ms | 0 µs | ladder receipt |
| 100k after first batch | `HYPSMAN2` | 98 | 1,976 | 16,412 | 0.27–0.30 ms | 1.8–1.9 ms | 6–7 µs | ladder receipt |
| 250k legacy | `HYPSMAN1` | — | 4,000,012 | — | 1.7 ms | 3.8 ms | 0 µs | ladder receipt |
| 250k fresh | `HYPSMAN2` | 487 | 9,756 | 14,636 | 0.8–1.0 ms | 4.8–5.3 ms | 10–16 µs | ladder receipt |
| 1M fresh | `HYPSMAN2` | 1,952 | 39,056 | 13,356 | 2.6 ms | 21 ms | 17–19 µs | ladder receipt (c-16) |
| 250k / 1M on metal | `HYPSMAN2` | 487 / 1,952 | 9,756 / 39,056 | — | 0.25 / 0.5 ms | 1.5 / 13 ms | 2 / 3 µs | `baseline-i7i-metal-2026-09-03.md` §7 |

Derived bound `MAX_PRODUCT_SEARCH_MANIFEST_CHUNKS` = 978 at the 250k bound, 3,908 at 1M; chunk count ≈ `2 × documents / 1,024`.

### Buffer-pool comparison (same host, same 1M directory, a443c52 §6)

| `HYPHAE_BUFFER_POOL_FRAMES` | durable scorer (rounds 3–4) | integrated `MatchAll` | range + facet | fuzzy(1) |
|---|---|---|---|---|
| 1,024 (2.x default) | 50.8 / 51.2 ms | 52.0 / 51.9 ms | 78.4 ms | 90.6 ms |
| 8,192 (3.0 default) | 22.4 / 22.4 ms | 23.6 / 23.4 ms | 49.7 ms | 56.4 ms |

"2.3× on the scorer from residency alone." Devbox (c-16) version of the same sweep: 1,024 → 135–146 ms; 8,192 → 61–69 ms; 65,536 (1 GiB) → 72–86 ms ("a larger pool buys nothing further"; pool populated lazily, "128 MiB is a ceiling, not a working-set cost").

### `perf` profile shares (self time, 15 s, 999 Hz, DWARF call graphs)

| symbol | `2ff8a4b` (§8) | `a443c52` (§6) |
|---|---|---|
| `_blake3_hash_many_avx512` | 17.3 % | absent from top 40 |
| `_blake3_compress_in_place_avx512` | 10.7 % | absent |
| `crc32c::hw_x86_64::crc_u64_parallel3` | 10.7 % | absent |
| `crc32c::hw_x86_64::crc_u64_append` | 5.3 % | absent |
| **page verification total** | **44 % (BLAKE3 28 %, CRC32C 16 %)** | **absent — "no longer shows page verification at all"** |
| `decode_lexical_segment` | 6.3 % | 12.6 % |
| score sorts | 6.1 % + 3.9 % | 20.8 % |
| `BorrowedLeaf::entries` / `::decode` | 3.4 % + 3.3 % | 16.2 % combined |
| `execute_lexical_plan` | — | 7.6 % |
| `drop_in_place<NativeRuntimeError>` | 2.8 % | 5.5 % ("fail-open probe constructing errors on the hot path; the cheap next fix") |
| kernel `_copy_to_iter` | 3.7 % | — |

Diagnostic stages at 1M (`a443c52` §6): manifest 1,952 chunks / 39,056-byte header; durable scorer 22.3 ms (1,562 segments, 372,418 entries); integrated `MatchAll` 23.3 ms; Eq filter 31.8 ms; range + facet 49.1 ms; fuzzy 56.2 ms.

## 9. Release and code identity

| quantity | value | source | caveat |
|---|---|---|---|
| Version | `3.0.0` | `docs/release/receipts/3.0.0.md` + `Cargo.toml` `[workspace.package]` | — |
| Publication tag | `refs/tags/release-v3.0.0-crates` (annotated) | release receipt | — |
| Annotated tag object | `0bc6fe56498472804c3cc376b5b28d7652955701` | release receipt | — |
| **Source commit (peeled tag target)** | `24bce1accdff8d14127797afe6f237a57c1cd4f3` | release receipt | — |
| **Source tree** | `52bdbb3ea7cd8d12e2cbd6cbe5f53cbcaa80d0ff` | release receipt | — |
| Source PR | `#262`, head `d27546fd…`, base `95872a65…`, merged 2026-09-04T03:41:57Z | release receipt | — |
| Crates published to crates.io | **24** | release receipt | 23 live under `crates/`; the 24th, `hyphae-pliegors`, is at `integrations/pliegors/` |
| Workspace crate directories | 23 | `ls crates/` | — |
| **MSRV** | `1.89.0` (`rust-version`), edition 2024 | `Cargo.toml` | measured hosts ran rustc 1.96.0 |
| **LOC** | **341,347** | `git ls-files 'crates/**/*.rs' \| xargs wc -l \| tail -1` | working tree `f65ada5`, not the tagged tree `52bdbb3`; counts `crates/` only — excludes `integrations/`, `conformance/`, `benchmarks/`, `tools/` |
| GitHub Release | `382494586`, published 2026-09-04T05:19:52Z, **38 assets** | release receipt | created as prerelease, promoted to latest |
| Required PR checks bound | 19 successful checks to head `d27546fd…` | release receipt | — |
| G8 aggregate | SHA-256 `41dacc41…5ebf`, `claims=["G8"]`, `closure_declared=true`, `status=passed`, three required platforms | release receipt | — |
| `cargo test -p hyphae-native-product` | 252 passed, 0 failed | `a443c52` and `2ff8a4b` receipts, header | host proof before measuring; not the full workspace |
| Workspace tests | 1,772 passed | `collection-manifest-chunked-1m-ladder-2026-09-03.md` | at `92f3c7a` / `51d8fb0` on the c-16 devbox, **not** at any measured metal commit; 19 new tests listed |
| Workspace funnel (2026-08-03) | 697 passed, 0 failed, 1 ignored, 84 result blocks | contract receipt | 3.0-era count differs; do not conflate |
| Consumer verification | `cargo install hyphae-cli --version 3.0.0 --locked` completed 2026-09-04; binary reports product `hyphae`, engine `3.0.0`, API `v1`, disk format `2`, native directory format `1`, product API version `1` | release receipt | — |
| Distribution boundary | TypeScript/Python clients and JS framework integrations "remain source-only in this release" | release receipt | "do not constitute npm or PyPI publication" |

## 10. Environment definitions (verbatim, `docs/product/claims.md`)

**Three environment classes** ("Performance-evidence claims"):

> 1. **development observation** — warm, concurrency-1, developer hardware; never quotable externally;
> 2. **virtualized operational scale** — the closed G7 C-60 authority; quotable with the explicit "virtualized, no latency certification" qualifier;
> 3. **dedicated hardware** — bare-metal receipts under [`docs/gates/evidence/`](../gates/evidence/) produced by the [baseline harness](../../benchmarks/baseline-harness/README.md) with pinned baselines (SQLite, DuckDB, Redis, Tantivy), byte-identical deterministic workloads, like-for-like durability, and per-phase latency/throughput distributions. Only this class supports comparative statements, and each statement names the receipt.

**Measured / Reproduced labels:** `claims.md` does **not** define these terms. The only use of "Reproduced" as a policy label is in `baseline-i7i-metal-2026-09-03.md` §1: "Identical state counts to the 2026-08-30 run, which makes that run *Reproduced* in the publication policy's sense for the model-checking claim." The "publication policy" referenced is not `claims.md` and I did not locate a file defining it — **see Gaps.**

**Prohibited claim shapes** (verbatim, the non-claims list):

> - "Universal SQL", "drop-in replacement", "protocol compatible".
> - "Serializable" in any form.
> - "Distributed", "replicated", "highly available".
> - Any latency number without its environment class and receipt.
> - Any comparative statement without the baseline's version, configuration, durability posture, and the shared workload definition.

Also normative: **Isolation claim** — "Snapshot isolation with first-committer-wins over logical write identities, one global commit sequence, and read-your-writes inside a transaction. Serializable execution is **not implemented** and must never be implied; predicate/range conflicts are not detected. Write skew is therefore admissible exactly as in any snapshot-isolation system." **Topology** — "Single-node, single-writer publication. No replication, no clustering, no distributed transactions, no consensus, no multi-tenant kernel." **Third-party conduct** — measurements stated neutrally, never "beats"/"crushes"/"wins against"; other systems' stronger results recorded "with the same prominence as Hyphae's".

## 11. Contract facts

| quantity | value (quoted) | source file | section |
|---|---|---|---|
| **System claim** | "A committed cross-engine transaction is visible at exactly one CSN in all engines or in none." | `docs/product/claims.md` | The system claim |
| **Product invariant** | "Local transactional work must scale with the touched keys, affected index entries, B+tree height, generated pages, and WAL bytes. It must not scale with the total number of unrelated rows, structures, lexical documents, vectors, or historical versions." | `docs/native/delta-all-engine-transaction-v1.md` | Product invariant |
| Hot-path prohibition | "The default local transaction therefore may not use `MaterializedState` or call the full `load_state` path at `BEGIN`, during staging, or at commit admission." | same | Product invariant |
| Full-state retained where | "Full-state decoding remains an integrity, recovery, migration, vacuum, and explicit verification surface. Removing it from the hot path must not weaken open-time corruption detection or page verification on a buffer-pool miss." | same | Product invariant |
| **Recovery cut** | "interruption through `PageSynchronized` reopens the prior state; and interruption from `WalAppended` through `RootPublished` reopens the complete new state." / "No boundary may expose a mixed engine state." | same | Failure and crash semantics |
| Preserved properties (8) | semantic-stage failure without losing earlier staged operations; rollback/close/peer-loss/transport-loss discard with no durable ID; exact expected-operation-count checks; conflict consumption at commit; no partially published loser; prior-snapshot invisibility; reopen equivalence; the existing seven commit crash boundaries | same | Failure and crash semantics |
| Staging surfaces | SQL DML (`INSERT`/`UPDATE`/`DELETE`, exact-PK, resolves only relation def, owned secondary-index defs, addressed primary row, old/new secondary projections, exact uniqueness probes; requires `HYCAT006` catalog root; FK relations fail closed); scalar structure `SET`; V3 Hash points (`HSET`/`HDEL`/`HINCRBY`); exact lexical document lifecycle | same | Point-resolved staging |
| **Commit admission and publication (10 steps)** | 1 acquire native writer admission; 2 reject read CSN below retention floor; 3 validate complete read/write conflict set with first-committer-wins; 4 re-resolve only staged point identities against admitted root set; 5 reject semantic divergence without appending pages/blobs/WAL; 6 apply relational, structure, and search deltas to admitted B+tree roots with COW page mutation; 7 stage and publish only large values referenced by admitted mutations; 8 encode the existing canonical WAL transaction; 9 apply the selected page/WAL synchronization policy; 10 publish all changed roots once through the existing commit coordinator | same | Commit admission and publication |
| Single-coordinator claim | "There is no second coordinator, per-engine commit, internal TCP/HTTP/JSON path, or compatibility database. A successful receipt still carries one WAL `TransactionId` and one commit CSN for all three engines." | same | Commit admission and publication |
| **Durability classes** | `Strict`: "acknowledgement after this transaction's WAL fsync." `Group`: "acknowledgement after a shared cohort fsync." `Memory`: "acknowledgement without any fsync; an acknowledged Memory commit can be lost by a crash (never torn — recovery drops whole commits from the volatile WAL suffix only)." | `docs/product/claims.md` | Durability claims |
| Class encoding + delta scope | "Memory (`0`) and strict (`1`) durability are accepted. Group (`2`) durability requires the later scheduling contract and is rejected without opening a transaction." | `docs/native/local-all-engine-transaction-v1.md` | lines 36–38 |
| Group commit framing | "Group commit is a durability scheduler, not a transaction-composition feature." / "The cohort is not an atomic super-transaction." / "No acknowledgement occurs before step 4." | `docs/native/group-commit-v1.md` | — |
| **MVCC snapshot** | `Snapshot { visible_csn, catalog_version, logical_time_micros, root_set }`; "All reads use that immutable snapshot plus the transaction's private writes. A later engine checkpoint or index merge cannot change the result." | `docs/native/mvcc-commit-v1.md` | Snapshots |
| **CSN visibility rule** | "A version with `[begin_csn, end_csn)` is visible when `begin_csn <= snapshot.visible_csn < end_csn`. `end_csn = u64::MAX` is open-ended. Tombstones participate in the same rule. Private writes shadow snapshot versions for read-your-writes." | same | Version visibility |
| Version chain integrity | "Each older `end_csn` equals the next-newer `begin_csn`; recovery validates the entire chain and fails closed on cycles or discontinuities… Closing a version never mutates bytes reachable through an older snapshot." | same | Version visibility |
| MVCC implementation status | "concurrent commit submission and lock-free publication remain pending" | same | Status line |
| **Search document manifest** | "The collection manifest is the durable set of document identities the integrated surface reports as `total_documents`, tests for membership on every lifecycle mutation, and enumerates for pagination. It is chunked so a mutation rewrites the records holding the affected identities, not the whole set." | `docs/native/search-document-lifecycle-v1.md` | Document manifest |
| Manifest header format | `HYPSMAN2`: `magic(8) ++ u32 LE total_count ++ u32 LE chunk_count ++ chunk_count × (u128 BE floor ++ u32 LE entry_count)`; "An empty collection is exactly the 16-byte header and owns no chunk record." | same | Document manifest |
| Manifest chunk format | `HYPSCHK1`: `magic(8) ++ u128 BE floor ++ u32 LE count ++ count × u128 BE identity`; identities strictly ascending, nonzero, at or above the chunk floor, below the next chunk's floor; first chunk carries sentinel floor `0` | same | Document manifest |
| Delta vs materialized ingest | "A batch that carries at least one named vector keeps the materialized transaction until the ANN store gains a delta stage. Both paths write the same durable records: a reopened directory cannot tell which path ingested a batch." | same | — |
| Contract non-goals | delta slice does not: add joins/scans/DDL/prepared DML/transaction-private reads; validate FKs; expose aggregate or scanning Hash reads; make lexical identities mutable; change group durability; remove full validation from recovery; bypass CRC32C/BLAKE3 verification on a page-cache miss; "promise microsecond fsync or universal sub-millisecond commits"; introduce a sidecar/LLM/cloud service; delete the materialized path | `docs/native/delta-all-engine-transaction-v1.md` | Explicit non-goals |
| Contract status caveat | current worktree adds a batch-wide retained-memory ledger under a 32 MiB mutation allocation (8 MiB Hash sub-budget); "The linked evidence predates this ledger… This is not allocation-exact or complete P6 evidence, and G7 remains open." | same | Status |

---

## Gaps

Numbers the paper would want that **no receipt in this tree provides**:

1. **Multi-host reproduction of any latency number.** Every metal receipt is "single host, one run per phase (three for the delta sweeps)" on a *different physical machine* each time, with the standing caveat "deltas under ~10 % are not claimed." Only the TLC state counts are formally *Reproduced*. No confidence intervals, no variance, no repeated runs of §1–§4 on one machine.
2. **aarch64 / non-x86-64 anything.** Explicitly unmeasured for determinism (`rag-cross-host-determinism`), for the scale ladder ("no aarch64, no hosted CI" in both ladder receipts), and for all baselines. The release ships an `aarch64-apple-darwin` archive with no performance or determinism receipt behind it.
3. **`6df81f2`.** Named in the task as part of the B+tree fix chain, but it appears in **no** receipt. Only `93dc3d3` (regression) → `b53348e` (fix) are evidenced.
4. **A "Measured / Reproduced" label definition.** `claims.md` defines the three environment classes but never these two labels; `baseline-i7i-metal-2026-09-03.md` §1 invokes "the publication policy's sense" of *Reproduced* without naming the file. No such policy document was found.
5. **Post-fix TLC run.** `a443c52` skipped TLC ("already reproduced twice"), so no model check is bound to the shipped 3.0 code SHA. No spec digest on the 08-30 run; no invariant *names* on the 09-03 run (each receipt has half the facts).
6. **1M scorer equivalence on c-16.** The ladder receipt promises the result "is appended to this file when the run completes" — it is not appended.
7. **Corpora beyond 1M, and any non-synthetic corpus at scale.** All ladder and baseline corpora are synthetic; every receipt states "no relevance claim." The only real corpus (FiQA, 57,638 docs) is at `hyphae 1.2.2`, two majors behind, and measures determinism not latency.
8. **The R5 vector conditions.** ANN consolidation cost and RSS at 1M × 768-dim vectors are named as blockers and are unmeasured in all three receipts. The collection bound therefore stays at 250,000 while every 1M number is "a measurement above the bound," with the bound lifted on the measurement host only.
9. **Concurrency beyond 1.** All phases run concurrency 1 except the 8-producer group-commit phases. No multi-client, saturation, contention, or abort-rate data. No `workers>1` measurement — the parallel scorer path "never activates in the product surface."
10. **Crash evidence at 3.0.** All crash matrices (`SIGKILL`, `dm-log-writes`) are dated 2026-08-02 against commits `91af0b7` / `0a167bc`, on `m6i.2xlarge` (class 2), a month and many commits before the measured 3.0 code — including the B+tree layout change. No crash receipt binds to `a443c52`, `2ff8a4b`, or the tagged `24bce1ac`. Process-kill lanes remain open for group commit, WAL retention, page vacuum, blob collection, active expiry, and migration.
11. **Physical power loss.** Best available is block-order replay, status `block-replay-not-physical-device-cut`. No EC2 stop, EBS detach, AZ loss, firmware-cache, or intra-block-tear evidence.
12. **G2 closure numbers.** All five isolation/litmus/metamorphic/TPC receipts are "bounded implementation evidence, not promoted into the G2 closure," with no host, no commit, no timing, and no hosted exact-SHA execution. The TPC-H matrix explicitly admits 1 of 22 queries.
13. **Kill/restart soak at 3.0.** Only `0.2-soak-gate-{windows,wsl2}-x86_64.json` exists — 0.2-era JSON, class 1 hosts, no narrative receipt.
14. **LOC provenance.** The 341,347 figure is from the working tree `f65ada5`, not the tagged tree `52bdbb3`, and covers `crates/` only. No receipt states a LOC count; if the paper cites it, it must state the tree and the glob.
15. **Test-count coherence.** Three different totals exist (697 workspace @ 2026-08-03; 1,772 workspace @ `92f3c7a`/`51d8fb0` on c-16; 252 for `hyphae-native-product` only on the metal hosts). No receipt reports a full-workspace test count at any measured metal commit or at the release SHA.