A shard now seals its accumulated delta into an `IndexRun`, publishes it
through the manifest, and discards exactly the layers that run covers in one
committed-root CAS. This replaces the `NotImplemented` that refused a shard
once it had accumulated `max_index_runs` delta layers.
The seal runs at admission, before anything is reserved or sequenced, because
a seal that fails partway has to poison and poisoning a shard that has just
accepted a transaction owes that caller an answer it can no longer give. Two
triggers: `DeltaPressure::SealRequired` over the accumulated entries and
bytes, and the layer count, which is the fan-out every lookup pays before it
reaches a run and which entry pressure alone does not bound.
Everything up to `install_index_run` is pre-durable and fails as an ordinary
error; from there the shard poisons on any failure, including one the call
may have made before writing. The caller cannot distinguish those, and the
conservative direction is refusing to keep writing against a root that may no
longer describe the device. `poison_now` latches it — `poison_error` only
built the error, which is right inside the publication window whose caller
latches for the whole group, and wrong here.
Four frozen amendments, all recorded as contract review 2026-07-29-C:
`segment::install_index_run` holds the whole durability sequence so no
durability operation lives in `engine.rs`; `index::delta_pressure` becomes a
free function so the writer's multi-layer backlog asks the same watermark
rather than restating it; `CommittedRoot::merge` recognizes a publication
that appends no frame, without which the run reaches the manifest and never
the root; and a manifest may have an empty retained tail when it commits
through zero, which is every shard that has sealed an index but not yet
rotated its journal.
A finding, recorded in scope §6.5 rather than papered over. Sealing moves
entries out of the layers but no frame out of `active/`, and the committed
prefix advances only on a checkpoint or a rotation — so recovery still
replays everything into one ceiling-bounded delta. The writer therefore
refuses once the replayable set reaches `max_active_index_entries`, closing a
hole that pre-dates this change: the old layer cap never bounded the summed
entries behind it. The consequence is that an entry-pressure seal lands
exactly on that ceiling and the next admission is refused; only a fan-out
seal leaves the shard able to continue. Entry-pressure sealing becomes useful
when `checkpoint()` can advance the prefix.
Mutation-checked in both directions. Reverting the discard reports one run
beside a three-layer backlog where the test requires zero, so the frozen
`IndexMaintenanceSnapshot` is load-bearing. Reverting the `merge` amendment
reports zero runs beside a three-layer backlog while `CURRENT` names the run:
the silent divergence, arriving quietly.
`store-bench` is untouched and stays preliminary.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XKzM69CHmBuDcA3qN1jFdh
Levi Neuwirth
fef8520bdf