net.
moves
at light.

Named after Walter Hill's 1979 cult film and Rockstar Games' 2005 adaptation — a gang trying to make it home through hostile turf. Channels in this release do the same: replicas survive partitions, election storms, disk pressure, and divergent tails, and still converge on a consistent leader before the night is out.

v0.14 lands cross-node replication for RedEX channels end-to-end across the substrate and all five bindings. v0.13 ("Chippin' In") made capability the load-bearing layer; v0.14 makes replication the load-bearing layer underneath the channel surface. SUBPROTOCOL_REDEX is now a real wire codec, ReplicationCoordinator is a real tokio runtime task with a 4-state machine pinned per plan §3, leader election is deterministic nearest-RTT with a NodeId tiebreak (no broadcast, no epoch — microseconds-wide convergence), and catch-up is pull-based with bandwidth budgets and a 64 MiB hard ceiling. Every binding exposes the same enable_replication(mesh) / open_file(name, cfg.with_replication(Some(rep))) surface and the same per-channel Prometheus snapshot.

The hardening posture from the Black Diamond line continues — every new surface ships with handle-lifetime, panic-safety, FFI-soundness, lock-order, and cancel-safety guarantees consistent with v0.11 / v0.12 / v0.13 — and a sixty-four-item second-pass review (docs/misc/CODE_REVIEW_2026_05_11_REDEX_DISTRIBUTED.md) shipped its closure commits before the v0.14 branch cut.

Alongside the replication landing, v0.14 carries two cross-cutting breaking changes: capability hardware / network units switch from MB / Mbps to GB / Gbps end-to-end, and the predicate-on-the-wire header renames from cyberdeck-where: to net-where: (predicate envelope ABI bumped to 2).

RedEX Distributed (substrate)

The implementation plan in REDEX_DISTRIBUTED_PLAN.md phases A–I all closed before v0.14. The shape:

ReplicationConfig

pub struct ReplicationConfig {
    pub factor: u8,                       // replicas including leader; 1..=16, default 3
    pub placement: PlacementStrategy,     // Standard / Pinned([NodeId]) / ColocationStrict
    pub heartbeat_ms: u64,                // 100..=300_000, default 500
    pub leader_pinned: Option<NodeId>,    // pin election outcome to a specific NodeId
    pub on_under_capacity: UnderCapacity, // Withdraw (default) / EvictOldest
    pub replication_budget_fraction: f32, // share of measured NIC peak; 0.0 < f ≤ 1.0
}

PlacementStrategy::Standard defers to the v0.13 PlacementFilter axes (scope filter, proximity max-RTT, capability intent matching, anti-affinity, custom-filter callback). Pinned([NodeId]) and ColocationStrict skip the filter chain. UnderCapacity::Withdraw (the default) drops the replica role and lets the leader's other replicas absorb the redundancy responsibility; EvictOldest runs RedexFile::sweep_retention against the configured caps and stays in Replica. validate() enforces every invariant at construction; binding layers run it before crossing the FFI so a malformed config can't leak into the coordinator's hot loop.

Wire protocol — SUBPROTOCOL_REDEX

A new subprotocol family at 0x0E00. Four message types pinned at byte-level:

• SYNC_REQUEST (0x20, replica → leader) — fixed-size { channel_id, since_seq, chunk_max }.
• SYNC_RESPONSE (0x21, leader → replica) — variable; carries { channel_id, first_seq, leader_first_retained_seq, events: [{event_seq, payload_len, payload}] }. The new leader_first_retained_seq field lets the replica disambiguate retention-trim from split-brain divergence; legitimate trim with first_seq == leader_first_retained_seq triggers skip-ahead via RedexFile::skip_to, any other gap shape NACKs back and bumps dataforts_replication_skip_ahead_total.
• SYNC_HEARTBEAT (0x22, bidirectional) — fixed-size { channel_id, tail_seq, role, wall_clock_ms }. Pinned at 52 bytes; the role byte is the validator-checked ReplicaRole discriminant.
• SYNC_NACK (0x23, leader → replica) — variable; carries { channel_id, since_seq, error_code, detail_len, detail }. Error codes: 1 NotLeader / 2 BadRange / 3 Backpressure / 4 ChannelClosed. detail truncates at a UTF-8 char boundary ≤ u16::MAX so a multi-byte codepoint straddling the cap can't ship invalid UTF-8 to the peer.

Codec is hand-rolled (no serde over the wire) for byte-stable round-trips, validated by byte_layout_pinned tests per message type. Truncation errors carry (need, have) for diagnostics; need = consumed + still_needed so a peer logging the value sees an accurate frame-completion estimate.

ReplicationCoordinator — the 4-state machine

pub enum ReplicaRole { Idle, Replica, Candidate, Leader }

Transitions are matrix-validated and serialized through an outer tokio::sync::Mutex<()> so the state write + chain-tag side-effect (announce_chain / withdraw_chain against MeshNode) can't interleave. Two transition_to calls racing one another produce a deterministic sequence: T1's Replica → Candidate announce never lands after T2's Idle withdraw. The transition signals (CapabilitySelected, MissedHeartbeats, ElectionWon, ElectionLost, GracefulRelinquish, DiskPressureWithdraw, ChannelClose) are pinned per plan §3; ChannelClose is the universal escape valid from any state, used by the disk-pressure / channel-closed paths when the current role isn't Replica.

The coordinator surfaces two error variants:

• CoordinatorError::Transition — the validator rejected the triple. State unchanged.
• CoordinatorError::TagSink — the state mutation already happened; only the chain-tag side-effect failed. Operator observes a divergence between local state and advertised state until the next successful announce. Runtime handlers clear the believed leader on both variants so the next tick re-enters discovery cleanly.

Replica selection vs. leader election

Two distinct subsystems per plan §4:

• Placement consults PlacementFilter to choose which N nodes carry the channel's replica set when the channel is first opened or on roster change. Standard flows through the v0.13 scoring; Pinned skips it. The selected set is published via the causal:<hex> chain-tag layer so peers discover holders without a centralized membership view.

• Leader election is a pure function over each healthy replica's locally-known state:

elect(replica_set, self_id, rtt_to, health_of) -> ElectionOutcome:
    R = { r ∈ replica_set : health_of(r) }
    sorted = R sorted by (rtt_to(self, r), r.node_id_lex)   // tie-break: lexicographic NodeId
    return ElectionOutcome::PeerWins(sorted[0])
        | ElectionOutcome::SelfWins
        | ElectionOutcome::NoEligibleReplica

No broadcast, no epoch, no collection window. Every healthy replica computes the same winner from the same (replica_set, self_id, rtt_to, health_of) tuple, so leader-loss recovery converges in microseconds without the wire protocol getting involved. Peers with rtt_to == None (no recent ping measurement) rank at Duration::MAX rather than getting excluded — health already filtered the candidate set, and the NodeId tiebreaker keeps the outcome deterministic among any equally-unmeasured peers.

Pull-based catch-up

Replicas drive SYNC_REQUEST(since_seq=local_next, chunk_max=N) on every tick where is_leader_silent == false && believed_leader.is_some() && local_next < leader_tail_seq. The leader's handle_sync_request reads [since_seq, since_seq+chunk_max) from its local file, packs into a SYNC_RESPONSE, and ships. The replica's apply_sync_response validates strict monotonicity (prev.checked_add(1)), enforces a 64 MiB hard chunk ceiling even for the "admit at least one event" branch (so an oversize first event NACKs back rather than DOSing the wire), and routes typed RedexError variants (DiskPressure, Closed) to the right runtime handler.

Bandwidth budgets

BandwidthBudget is a token bucket sized at replication_budget_fraction × measured_NIC_peak. The catch-up loop calls try_consume(estimated_bytes, now) before shipping each chunk; full bucket admits; partial defers and NACKs back Backpressure. Oversize requests (a single event larger than one-second's capacity — rare but representable) admit as a one-off and drain the bucket fully, so the channel can never deadlock trying to ship an event it can never afford.

Heartbeats + repair

HeartbeatTracker per channel per node holds (last_seen, role, tail_seq) for every peer. The runtime tick emits a heartbeat to every non-self peer in the replica set when role ∈ {Leader, Replica}; inbound heartbeats update the tracker and refresh the believed_leader cell. is_leader_silent trips when now - last_seen > heartbeat_ms × miss_threshold (default 3× = 1.5 s at the 500 ms heartbeat), triggering the Replica → Candidate transition and the in-tick election. heartbeat_ms is now validated to [100, 300_000] so a unit-confused config (μs instead of ms) can't saturate the silence-detection multiplication and silently disable failover.

Failover + replica rejoin

Plan §7: leader loss → silence detection → Candidate → election → Leader/Replica per ElectionOutcome. Plan §8: a replica rejoining from a longer-than-trim outage observes first_seq > local_next on the next SYNC_RESPONSE; if first_seq == leader_first_retained_seq the gap is a legitimate retention trim and RedexFile::skip_to(first_seq) runs (bumping dataforts_replication_skip_ahead_total), any other shape is treated as divergence and NACKs back.

Cross-binding API surface

Every binding ships the same two-method extension to its existing Redex type:

• enable_replication(mesh) — installs the SUBPROTOCOL_REDEX inbound router on the mesh and arms Redex::open_file to spawn a replication runtime when the supplied RedexFileConfig carries replication: Some(ReplicationConfig). Idempotent: a second call with the same mesh is a no-op.
• open_file(name, cfg) — when cfg.replication.is_some(), spawns a per-channel ReplicationRuntime (tokio task + HeartbeatTracker + BandwidthBudget + ReplicationCoordinator) and registers it on the inbound router. Reopen with a structurally-different ReplicationConfig returns a typed error rather than silently reusing the original.

The substrate exposes Redex::replication_runtime_count(), Redex::replication_coordinator_for(name), Redex::replication_status_snapshot(), and Redex::replication_metrics_snapshot(). The metrics snapshot is also rendered to Prometheus text via Redex::replication_prometheus_text() for direct scraping.

Metrics

Per-channel atomic counters (ChannelMetricsAtomic) — sync_bytes_total, sync_request_total, sync_response_total, sync_nack_total, leader_changes_total, election_thrash_total, under_capacity_total, skip_ahead_total, applied_events_total, applied_bytes_total, leader_lag_micros, replica_lag_micros. Gauges (leader_lag_micros, replica_lag_micros) saturate one tick below LAG_NOT_OBSERVED = u64::MAX so a follow-up arithmetic operation can't accidentally collide with the sentinel. The Prometheus registry caps at 4096 channels to bound a hostile multi-channel scrape; entries past the cap are silently dropped at insertion.

Observability + operator ergonomics

Redex::replication_status_snapshot() returns a Vec<ChannelReplicationStatus> with channel, role, replica_set, believed_leader, tail_seq, lag_micros, under_capacity_total per channel. Plug into a Prometheus exporter via the replication_prometheus_text() text-format helper; pipe into a Grafana dashboard via the per-channel labels.

RedEX Distributed test strategy

The plan's test matrix landed in full:

• Unit — pure-function coverage for replication_state, replication_election, replication_heartbeat, BandwidthBudget, replication_metrics, the wire codec, and replication_catchup. Every pre-fix correctness item from the second-pass review ships with at least one regression test.
• Integration (e2e) — multi-tokio-thread tests under tests/redex_replication_e2e.rs covering two-node catch-up, leader-close → replica election, three-node fanout, lag-driven catch-up, heartbeat round-trip, and the bandwidth_budget_metric_field_is_plumbed smoke. The replication_overhead_within_30_percent_budget perf-budget test is marked #[ignore] and lives off CI's default matrix — wall-clock perf on shared CI runners isn't a stable signal.
• DST (deterministic-simulation) — 14 scenarios under tests/redex_replication_dst.rs covering happy-path catch-up, isolated-replica no-advance, partition heal, asymmetric / symmetric failover, three-node central-peer convergence, restart-during-sync, divergence-freedom after partition-heal AND after kill-revive (the original C-2 single-path scenario expanded), election storms (the C-1 scenario; storm rounds now assert election_thrash_total bumps), and wall_clock_ms determinism. The harness derives wall-clock time from a step counter, not real Instant::now, so traces reproduce byte-identically across machines.
• Loom — atomic-pattern models for RedexFile::close's swap-true-on-close, the record_tail_seq CAS loop, the replication metrics counters under concurrent increment (including a three-way same-counter contention case), and the try_first_close first-call-wins flag.

Hardening — redex-distributed second-pass review

A two-pass review of the replication branch (docs/misc/CODE_REVIEW_2026_05_11_REDEX_DISTRIBUTED.md) landed sixty-four numbered items (R-1..R-64) plus four coverage gaps (C-1..C-4). The first pass closed forty-four; the second-pass review on 2026-05-12 surfaced one regression in the original R-23 fix plus nineteen new items; all closed before the v0.14 branch cut. Grouped by area:

Runtime / coordinator correctness

• Role-flip TOCTOU closed. SyncRequest and SyncResponse handlers re-check coordinator.role() immediately before the dispatcher send so a concurrent transition between the entry check and the outbound ship triggers a clean NACK NotLeader rather than a response from a node that no longer claims leadership.
• Chain-tag side-effects serialized. The coordinator's transition_to holds a tokio::sync::Mutex<()> across the state update + metric bumps + sink call so two racing transitions can't interleave announce_chain from a stale role over a withdraw_chain from a fresher one.
• NACK NotLeader / BadRange actually recover. NotLeader clears the believed leader so the next tick re-resolves via find_chain_holders; BadRange calls RedexFile::skip_to(since_seq + 1) and re-issues the request, rather than logging-and-dropping.
• Post-election failure no longer strands Candidate. When the second transition_to (Candidate → Leader / Candidate → Replica) surfaces TagSink (state moved, side-effect failed) or Transition (state moved out from under us), both error branches clear the believed leader so the next tick re-enters discovery from a clean slate.
• Disk-pressure / channel-closed pick the valid signal per current role. The transition matrix only permits DiskPressureWithdraw on Replica → Idle; Leader / Candidate variants now route through ChannelClose (the universal escape) so a Leader observing disk pressure actually withdraws rather than logging the matrix-reject and continuing to write through.
• cancel() can't hang. Uses try_send(Shutdown) first; on Full, aborts the JoinHandle directly so a wedged task with a saturated inbox can't block the caller waiting on a buffer the task may never drain.
• Drop on ReplicationRuntimeHandle aborts the task. The strong-reference cycle MeshNode → router → handle → task → dispatcher Arc is broken unconditionally when the handle goes out of scope, not just via the canonical ReplicationWiring::drop un-installation.
• is_stopped consults an explicit flag flipped after cancel()'s .await returns, not the JoinHandle slot — two concurrent cancel()s racing on task.lock().take() could previously let the loser observe None and report stopped == true before the winner had finished joining.
• Channel-id validation defense-in-depth on every inbound type. SyncRequest, SyncResponse, SyncNack, Heartbeat all gate on msg.channel_id == inputs.channel_id at the runtime boundary so mesh misroute can't poison the tracker.
• GapBeforeChunk underflow closed. first_seq.saturating_sub(local_next) plus a debug_assert!(first_seq > local_next) belt-and-suspenders.

Catch-up correctness

• Retention-trim vs. divergence disambiguation. SyncResponse carries leader_first_retained_seq on the wire; the replica treats first_seq == leader_first_retained_seq as a legitimate trim (skip-ahead via RedexFile::skip_to) and any other gap shape as divergence (NACK back, bump counter, log loudly).
• Empty chunk validates first_seq. The short-circuit on response.events.is_empty() now validates first_seq >= local_next so a leader bug emitting first_seq = 999 on an empty chunk isn't silently accepted.
• 64 MiB hard ceiling enforced for oversize first event. The "admit at least one event" branch rejects events larger than CHUNK_MAX_HARD_CEILING_BYTES rather than shipping wire bytes that the replica's local append would refuse.
• prev + 1 strict-monotonicity uses checked_add. Practically unreachable; surrounding code used saturating_* and the asymmetry was the real bug.
• Lag-driven SyncRequest filters believed_leader != self so a test-setup loopback or tracker misuse can't make the runtime issue a SyncRequest to itself.

Wire codec

• SyncNack::from_bytes truncation reports correct need. The R-23 fix shipped for SyncResponse but missed the SyncNack arm in the original commit; the second-pass review caught and fixed it.
• SyncNack::to_bytes truncates at a UTF-8 char boundary. A multi-byte codepoint straddling SYNC_NACK_DETAIL_MAX previously shipped invalid UTF-8 that the decoder rejected, losing the structured error code along with the diagnostic.
• WireError::Truncated.need formula correct everywhere. need = consumed + still_needed in every arm — both header reads and per-event payload reads.

File / manager

• RedexFile::skip_to panic-safe swap order. Builds the new index / timestamps into temp Vecs, calls evict_prefix_to against the segment, then assigns the new index. Pre-fix a panic between the index swap and the eviction call would leave the index referencing pre-eviction offsets.
• Reopen with differing replication config rejects with a typed error rather than silently reusing the original. Compares against the live coordinator's config; accepts None ↔ None and Some(cfg_a) ↔ Some(cfg_b) where the two are structurally PartialEq, rejects everything else.
• mod replication dual public surface collapsed. The flat re-exports under redex:: are now the only public path; pub mod replication is gone.
• Lag saturation pinned with a named constant LAG_SATURATED_MICROS = LAG_NOT_OBSERVED - 1 and a test asserting the gap from the sentinel is preserved.

Mesh / dispatch

• from_node == 0 sentinel collision rejected. The replication inbound arm mirrors the reflex handler's guard — a peer whose from_node falls back to 0 (the valid NodeId sentinel collision) is dropped rather than entering the tracker.

Bindings / FFI

• Python replication=False with replication_* kwargs rejects with a typed RedexError rather than silently dropping the other kwargs.
• enable_replication is a typed RedexError stub without the net feature in both Node and Python, rather than TypeError: redex.enableReplication is not a function / AttributeError. The Python replication_runtime_count / replication_prometheus_text gates the same way.
• net_redex_enable_replication drops Box<Arc<MeshNode>> on every error path. Doc-comment now states "consumed regardless of return code."
• net_redex_open_file and net_redex_file_tail pre-zero *out_handle / *out_cursor on entry so a cgo / C consumer reading the slot after a non-zero return sees null rather than stale stack data.
• Python runtime.block_on paths release the GIL via py.detach across the blocking open / open-from-snapshot / tail / watch / snapshot-and-watch paths. Existing precedent (wait_for_seq, __next__) already did this; the cortex open / tail / watch paths now match.
• Node RedexFile.sync and RedexFile.close are async — disk I/O dispatches via tokio::task::spawn_blocking onto the napi worker pool instead of running on the JS event-loop thread. The other read-side methods stay sync (in-memory only).
• Python rejects kebab-case spellings for colocation_strict / evict_oldest; Node rejects snake_case for the same (each binding accepts only its idiomatic spelling). The FFI core remains liberal so the Go-facing JSON shape can use either.
• Pinned([]) rejected at the binding layer with a typed error rather than falling through to the core validator.
• leader_pinned cross-checked against pinned_nodes at the binding layer when placement == Pinned.
• Node redex_err documents the redex: prefix contract in index.d.ts so JS-side operators can string-sniff on e.message.startsWith("redex:") against a pinned shape.
• Go OpenFile distinguishes ErrInvalidReplicationConfig from ErrReplicationRequiresEnable. Binding-side validator covers shape errors plus Factor / HeartbeatMs ranges; only the FFI NET_ERR_REDEX for replication-not-enabled falls into the second sentinel.
• Go RedexFile.mu uses sync.RWMutex so appends / reads aren't serialized per file. The Rust substrate's HandleGuard is a reader-counter; pre-fix the Go binding's mutex defeated that.
• Go typedef ArcMeshNode aliases the upstream net_compute_mesh_arc_t opaque typedef so the same Arc handle works through both surfaces.

Hygiene + coverage

• Election sort uses sort_unstable_by. The total compound key (rtt, node_id) provides determinism; stability isn't load-bearing.
• Event-vec preallocation cap (4096) documented in the wire codec.
• u32::try_from(payload_len).unwrap_or(u32::MAX) carries a debug_assert! so accidental misuse surfaces in debug builds rather than silently corrupting on the wire.
• DST harness wall_clock_ms derives from the step counter, not real Instant::now. Traces reproduce byte-identically across machines.
• DST election-storm scenario asserts election_thrash_total. The harness mirrors the production coordinator's counter locally so storm rounds can observe the gauge without rewiring the harness around the async coordinator.
• Divergence-freedom check runs after partition_heal AND after restart_during_sync, not just on the happy path.
• e2e flake-prone test marked #[ignore]. The replication_overhead_within_30_percent_budget 1.3× wall-clock budget is opt-in via cargo test -- --ignored rather than running on shared CI runners.
• e2e bandwidth_budget_is_observable_in_metrics renamed to bandwidth_budget_metric_field_is_plumbed so the test name matches what the test asserts (field plumbing under the wire path, not budget engagement; the budget-fired path is unit-tested under replication_catchup).
• Loom metrics model exercises a three-way same-counter contention case beyond the existing two-thread mixed-counter races.
• BandwidthBudget::try_consume handles oversize requests via the full-bucket admit-once-and-drain escape hatch so a single event larger than one-second's capacity can't deadlock the channel.
• Election ranks unmeasured-but-healthy peers at Duration::MAX rather than excluding them — health already filtered the candidate set, and the NodeId tiebreaker keeps the outcome deterministic among any equally-unmeasured peers.

CI

• Three new CI jobs. redex-replication-e2e runs the multi-tokio-thread integration suite under --features "redex net"; redex-replication-dst runs the deterministic-simulation harness under --features redex; loom-models runs the atomic-pattern loom tests under RUSTFLAGS=--cfg loom. All three gate the redex-distributed merge.

Capability hardware units — MB → GB / Mbps → Gbps

v0.14 changes the hardware-axis numeric units from megabyte / megabit-per-second to gigabyte / gigabit-per-second across core and every binding. The tag keys, predicate builders, FFI shapes, and JSON schemas all rename. This is a breaking wire-format change for any CapabilitySet that carries hardware numerics.

The motivation is operator ergonomics — fleets in 2026 routinely advertise hundreds of GB of memory and tens of Gbps of network capacity, and the MB / Mbps wire shape forced operators to read values like 65_536 and 10_000 when 64 / 10 is what they meant. The smaller numeric range also fits cleanly in u32 for the wire encoding.

Tag / key renames

Adjust values when migrating: 65_536 MB → 64 GB, 81_920 MB → 80 GB, 10_000 Mbps → 10 Gbps.

Filter / predicate renames

The predicate builders (p.minMemory(...), p.minVram(...), etc. in TS; the p.min_memory(...) family in Python; Predicate{}.MinMemory(...) in Go) now produce NumericAtLeast tags whose key is memory_gb / vram_gb / storage_gb / network_gbps.

Binding surfaces

Refactors

The core schema (AXIS_SCHEMA) and tag codec emit / parse the new *_gb / *_gbps keys. Placement / scoring and proximity tiers use a 16 GB baseline (was 16 GB previously; the renames are nominal, not behavioral). Serialization APIs that took MB-shaped values now take GB. Safety types and topology hints align. Docs, benches, examples, and every test fixture / cross-binding golden vector regenerate against the new shape; the final sweep removed lingering network_mbps references across tests/cross_lang_capability/ and the per-binding compat suites.

Cross-binding fixtures

The thirteen fixtures under tests/cross_lang_capability/ regenerate against the new unit. predicate_eval, capability_set_diff, capability_validation, placement_score, and the numeric-parity fixtures all carry GB / Gbps values. predicate_nrpc_envelope.json bumps abi_version_expected: 1 → 2 (see below).

Predicate-on-the-wire header — cyberdeck-where: → net-where:

The HTTP / nRPC header carrying predicates from caller to callee was named cyberdeck-where: in v0.13 — the project umbrella on the wire. v0.14 renames to net-where: for three reasons:

1. HTTP / nRPC convention names the protocol, not the parent organization. HTTP doesn't have w3c-content-type:; traceparent / idempotency-key use system-level prefixes, not org names. The umbrella-on-the-wire shape was an outlier.
2. The header is not nRPC-specific even though it currently rides nRPC. Predicates are protocol-agnostic; any future predicate-bearing surface (raw channel pre-filter, subprotocol call hook, …) should ride the same name. net-where: brackets the right layer (the net crate / SDK), not a specific service inside it.
3. Symmetric naming with the substrate crate. Net's other reserved headers and protocol identifiers carry the net- / net_ prefix; lining this one up makes the surface easier to grep and easier to teach.

RPC_WHERE_HEADER constant

Every binding exports the new name as a pinned constant:

• Rust: net::adapter::net::behavior::predicate::RPC_WHERE_HEADER = "net-where"
• TS: import { RPC_WHERE_HEADER } from '@ai2070/net-sdk'
• Python: from net_sdk import RPC_WHERE_HEADER
• Go: net.RPCWhereHeader
• C: NET_PREDICATE_WHERE_HEADER macro in net.go.h

Server-side decoders accepting the v0.13 cyberdeck-where: name are not provided. Mixed v0.13 / v0.14 fleets cannot exchange predicates over the wire; recommend lockstep upgrade alongside the capability-unit migration.

Predicate envelope ABI version bump

tests/cross_lang_capability/predicate_nrpc_envelope.json bumps abi_version_expected: 1 → 2 to signal the wire-format change. No binding-side ABI version constants pin to 1 — none of the per-binding tests asserted on the envelope fixture's version — so the bump is informational + future-defensive. Future header / envelope changes in v0.15+ will bump to 3 against the same fixture.

Test hygiene

• Cross-binding wire-format fixtures regenerate against the new units + header name. Thirteen fixtures under tests/cross_lang_capability/, all versioned via abi_version_expected: 2 for the predicate envelope (other fixtures continue at 1 — only the envelope carries the ABI version field today).
• Three new CI jobs. redex-replication-e2e, redex-replication-dst, loom-models gate the merge.
• Lib suite at 2640+ tests (was 2330+ at v0.13 release). 300+ net new tests across the replication + regression paths; every numbered review item ships with at least one regression where the shape made one possible.
• cargo clippy --all-features --all-targets -D warnings clean across substrate + every binding crate.
• cargo doc --all-features --no-deps clean under RUSTDOCFLAGS="-D warnings" — both rustdoc::broken_intra_doc_links and rustdoc::private_intra_doc_links enforce.

Breaking changes

Wire format — SUBPROTOCOL_REDEX is new

SUBPROTOCOL_REDEX = 0x0E00 is a new mesh subprotocol family; v0.13 nodes don't speak it. Mixed v0.13 / v0.14 fleets cannot exchange replication traffic. Channels opened with replication: None continue to work cross-version (same single-node behavior as v0.13).

Wire format — capability hardware units

v0.14 breaks wire compatibility with v0.13 for CapabilityAnnouncement / CapabilityDiff carrying hardware numerics. hardware.memory_mb / hardware.gpu.vram_mb / hardware.storage_mb / hardware.network_mbps / hardware.accelerator.<i>.memory_mb rename to the *_gb / *_gbps shape. v0.13 receivers parse v0.14 announcements as Tag::Legacy (unknown axis-prefixed tags pass through under the forward-compat rule) — the values survive the round-trip but no longer satisfy min_memory_mb / etc. filters, so placement decisions on a v0.13 receiver may produce different verdicts. Recommend lockstep upgrade.

Wire format — cyberdeck-where: → net-where:

v0.14 renames the predicate-on-the-wire HTTP header. v0.13 servers expecting cyberdeck-where: won't see v0.14 callers' header values; v0.13 callers' cyberdeck-where: won't be read by v0.14 servers. Mixed fleets must either upgrade lockstep or maintain a transitional gateway that rewrites the header on the way through.

Rust core (net crate) — API surface

• Capabilities::with_memory(value) takes GB, not MB. Same for the resource-envelope / claim / topology types: ResourceEnvelope::max_memory_gb, ResourceClaim::memory_gb, TopologyHint::{uplink_gbps, downlink_gbps}.
• HardwareCapabilities field renames — memory_gb, gpu.vram_gb, storage_gb, network_gbps. AcceleratorCapability::memory_gb.
• adapter::net::redex exports — new types ReplicationConfig, PlacementStrategy, UnderCapacity, ReplicationCoordinator, ReplicationCoordinator::transition_to, ReplicaRole, TransitionSignal, StateTransition, HeartbeatTracker, PeerState, BandwidthBudget, ReplicationMetricsRegistry, ChannelMetricsAtomic, ChainTagSink, ChannelIdentity, CoordinatorError, elect, ElectionOutcome, ChannelReplicationStatus. The wire codec types (SyncRequest, SyncResponse, SyncHeartbeat, SyncNack, SyncNackError, SyncEvent, WireError, SUBPROTOCOL_REDEX, DISPATCH_SYNC_*, SYNC_NACK_DETAIL_MAX) re-export at the redex module root.
• Redex::enable_replication(mesh) is a new method. Idempotent; pair with Redex::open_file carrying cfg.replication = Some(rep) to spawn a per-channel replication runtime.
• Redex::open_file rejects reopen with a structurally-different ReplicationConfig with a typed RedexError::Channel. Reopen with the same config returns the existing handle (unchanged from v0.13).
• RPC_WHERE_HEADER = "net-where" (was "cyberdeck-where" in v0.13).
• HEARTBEAT_MS_MAX = 300_000 added; ReplicationConfig::validate rejects heartbeat_ms > HEARTBEAT_MS_MAX with a typed HeartbeatTooHigh variant.

Rust SDK (net-sdk)

• net_sdk::capabilities::redex re-exports the substrate replication surface — ReplicationConfig, PlacementStrategy, UnderCapacity, ReplicaRole, ChannelReplicationStatus.
• net_sdk::capabilities::predicate::RPC_WHERE_HEADER is the renamed constant.

FFI / bindings

Behavioral fixes that may surface as test breakage

• ReplicationConfig::heartbeat_ms clamps at [100, 300_000]. Tests injecting u64::MAX or other pathological values to observe silence-detection behavior will see ReplicationConfigError::HeartbeatTooHigh instead.
• PlacementFilter election no longer excludes peers with rtt_to == None. Tests that asserted NoEligibleReplica against an all-unmeasured replica set will see the smallest-NodeId healthy peer elected instead.
• SyncNack::to_bytes truncates at a UTF-8 char boundary, so a regression test that previously expected from_bytes to fail on an oversize multi-byte payload will see the round-trip succeed at a slightly-shorter detail length.
• Reopen with a different ReplicationConfig rejects. Tests that opened a channel with one config and reopened with another expecting silent reuse will see RedexError::Channel("different from the original").
• bandwidth_budget_is_observable_in_metrics renamed. Tests referencing the old test name fail to find it; rename to bandwidth_budget_metric_field_is_plumbed.
• replication_overhead_within_30_percent_budget marked #[ignore]. CI runs that included this test in the default matrix will no longer see it; run via cargo test -- --ignored.

How to upgrade

1. Bump your Cargo.toml / package.json / requirements.txt / go.mod to the v0.14 line. Recompile / rebuild the binding cdylib (NAPI for Node, maturin for Python, cargo build -p net-compute-ffi + -p net-rpc-ffi for Go).
2. Capability hardware-unit migration. Rename memory_mb → memory_gb, vram_mb → vram_gb, storage_mb → storage_gb, network_mbps → network_gbps, accelerator.memory_mb → accelerator.memory_gb throughout. Adjust values: 65_536 → 64, 81_920 → 80, 10_000 → 10. The predicate builders pick up the new keys automatically; tag-string literals need a manual rewrite. cargo build (and the binding-side TypeScript / Python static checks) drives the rewrite — the renames are compile errors.
3. Predicate header migration. If your call sites reference the header name directly ("cyberdeck-where" as a string literal), replace with "net-where" or use the exported RPC_WHERE_HEADER constant. Server-side handlers consuming the v0.13 name need the same rewrite.
4. Replication opt-in. Channels that want replication: call Redex.enable_replication(mesh) once after constructing the Redex (idempotent), then open each replicated channel with Redex.open_file(name, cfg.with_replication(Some(rep_cfg))). The per-channel ReplicationRuntime spawns automatically; consult the operator surface via Redex.replication_status_snapshot() / replication_prometheus_text().
5. Channels that don't want replication require no changes. Single-node channels behave identically to v0.13. RedexFileConfig::replication = None is the default.
6. Node consumers — RedexFile.sync() / RedexFile.close() are async. Add await to call sites:

   await file.sync();
   await file.close();
   

   Sync call sites compile but generate orphan Promise warnings under modern Node and may exit the process before the fsync lands.
7. Python consumers — Redex.open_file(name, replication_*=…) requires replication=True. Pre-v0.14 code passing replication_factor=5 without replication=True produced a single-node channel; now raises RedexError. Either pass replication=True explicitly or drop the replication_* kwargs.
8. Go consumers — RedexFileConfig.Replication is the new optional field. Pass a *ReplicationConfig for replicated channels. Numeric validation (factor / heartbeat ranges) runs on the Go side before the FFI; structurally-invalid configs return ErrInvalidReplicationConfig instead of the catch-all ErrReplicationRequiresEnable.
9. Fleet-wide upgrade required for any deployment using capability announcements with hardware numerics. v0.13 receivers parse v0.14 announcements' hardware.memory_gb as Tag::Legacy — the value survives but no longer satisfies min_memory_mb-keyed filters. Recommend lockstep upgrade alongside the predicate-header migration.
10. Cross-binding wire fixtures regenerated. If you have CI that asserts golden-vector parity against tests/cross_lang_capability/, the GB / Gbps shape and the net-where: header rename mean every fixture changes. predicate_nrpc_envelope.json bumps abi_version_expected: 1 → 2; future binding-side version pins should track the per-fixture version field.
11. Operator dashboards — Redex::replication_prometheus_text() emits a per-channel snapshot in Prometheus text format; pipe into your existing scrape config under the dataforts_replication_* metric family. Per-channel labels (channel, role) carry the channel name and current role for dashboard slicing.
12. DST harness integration — if you have channel-level DST scenarios that drive ReplicaRole directly, the harness's force_transition / tick_node now mirror the production coordinator's election_thrash_total counter onto a per-VirtualNode election_thrash_count field, so storm scenarios can assert on the gauge without rewiring around the async coordinator. The harness's wall_clock_ms derives from a step counter, not Instant::now.

v0.12 breaks the "Black Diamond" hardening line. After two consecutive releases of pure bug-fix + audit closure (v0.10 / v0.11), Firestarter is the first feature release on the line: it ships a complete request/response RPC surface (nRPC) on top of the v0.11 mesh, plus the four-language binding pipeline that consumes it (Node, Python, Go, plus the existing Rust SDK), plus a TypeScript migration of the Node binding's hand-written modules. The hardening posture is intact — every new surface has the same handle-lifetime, panic-safety, and FFI-soundness guarantees v0.11 established for the existing surfaces — but this release is about adding capability, not just polishing the existing one.

nRPC

Folds, Codec, Mesh Glue

The architectural anchor (and the prerequisite for everything else): an RPC server is a CortEX fold over a directed channel pair. There is no new transport, no new subsystem, no new daemon — just a typed dispatch enum on EventMeta, a channel-naming convention, and small caller-side / server-side helpers.

• SubscriptionMode::QueueGroup on the channel roster (adapter/net/channel/roster.rs) — the one missing channel-layer primitive. Work-distribution dispatch alongside the existing Broadcast mode. add_with_mode / dispatch_recipients / subscriber_mode API; back-compat shims preserve every existing call site. MembershipMsg::Subscribe.queue_group: Option<String> wire field added at channel/membership.rs with forward-compat decode (pre-queue-group senders with zero remaining bytes after the token decode as Broadcast). Public APIs Mesh::subscribe_channel_in_queue_group[_with_token]. Pinned by 13 regression tests; cross-validated end-to-end by tests/queue_group_dispatch.rs (two QueueGroup subscribers on different nodes divide a stream of 100 events between them with exactly-once delivery; broadcast subscriber + queue-group pool coexist on one channel).
• cortex::rpc codec (adapter/net/cortex/rpc.rs) — dispatch constants DISPATCH_RPC_REQUEST / RESPONSE / CANCEL / STREAM_GRANT / STREAM_CHUNK_DROPPED, flag bits (FLAG_RPC_STREAMING_RESPONSE, FLAG_RPC_PROPAGATE_TRACE), RpcStatus enum (Net-native with documented gRPC equivalence), RpcRequestPayload / RpcResponsePayload round-trip codec with MAX_RPC_* caps and encoded_len() helpers for buffer pre-sizing. 15 regression tests pin wire stability + decode-rejection of malformed payloads.
• RpcServerFold — RedexFold<()> decoding REQUEST events, dispatching the handler in tokio, emitting RESPONSE via a RpcResponseEmitter callback. RpcCancellationToken (Notify+AtomicBool wrapper, race-safe), RpcContext (caller_origin + decoded payload + cancellation), RpcHandler async-trait, RpcHandlerError::{Application, Internal}. Handler panic caught via catch_unwind and surfaced as RpcStatus::Internal. Fast deadline-already-passed short-circuit. CANCEL flips the in-flight token. Malformed payloads emit a structured warn-and-skip and continue (do not kill the cortex adapter). Duplicate REQUEST for an in-flight call_id is refused; first-wins semantics. Per-channel-hash inbound dispatch hook on MeshNode (register_rpc_inbound / unregister_rpc_inbound) lets the mesh's inbound packet path consult a dispatcher map per packet (one DashMap get); registered channel hashes route directly and skip the per-shard inbound queue.
• RpcClientFold + RpcClientPending — symmetric caller side. RpcClientPending::register(call_id) returns a oneshot receiver for unary calls; register_streaming(call_id) returns an mpsc receiver of StreamItem for streaming calls (the same RpcClientFold demuxes both call kinds via a PendingEntry::{Unary | Streaming} enum). Re-register of the same call_id closes the prior receiver (misuse detection).
• Mesh::serve_rpc(service, handler) / Mesh::call(target_node_id, service, payload, opts) glue (adapter/net/mesh_rpc.rs). serve_rpc registers an inbound dispatcher for <service>.requests's channel hash; the dispatcher pushes events into a tokio mpsc that drains through the RpcServerFold. call lazy-subscribes to <service>.replies.<caller_origin>, allocates a call_id, registers a oneshot in the per-Mesh RpcClientPending, direct-sends the REQUEST via publish_to_peer bypassing the local subscriber roster (RPC's caller-knows-target model doesn't fit the publisher-led pub/sub roster), and awaits the receiver under opts.deadline. Returns RpcReply on Ok, RpcError on any failure. ServeHandle is RAII — the dispatcher unregisters on Drop and in-flight handlers complete (no abort). Per-Mesh state additions on MeshNode: rpc_client_pending, rpc_next_call_id, rpc_reply_subscriptions (bounded; refuses hash collisions instead of overwriting).
• End-to-end Mesh integration test (tests/integration_nrpc_mesh.rs, 4 tests through real network handshake): round-trip echo, multiple sequential calls reusing the lazy reply subscription with exactly-once handler invocation, server panic surfaces as Internal, deadline emits CANCEL and surfaces as Timeout to the caller. Deadline-fire CANCEL emission is now pinned by an explicit assertion test (rpc_deadline_fires_cancel_on_the_wire).

Service Discovery + Routing Policies

• Service discovery via capability announcements. Mesh::serve_rpc auto-registers the service in a per-Mesh rpc_local_services set; announce_capabilities[_with] auto-merges nrpc:<service> tags onto the announced CapabilitySet, propagating through the existing capability-broadcast machinery. Two new public APIs: Mesh::find_service_nodes(service) -> Vec<u64> queries the local capability index for nodes carrying the nrpc:<service> tag; Mesh::call_service(service, payload, opts) -> Result<RpcReply, RpcError> finds candidates, picks one per RoutingPolicy, dispatches via the existing direct-addressed call(target, ...). Returns RpcError::NoRoute if no servers advertise the tag. ServeHandle::Drop removes the service from the local registry so subsequent announcements stop emitting the tag.
• RoutingPolicy enum on CallOptions (default RoundRobin): RoundRobin uses a dedicated per-Mesh cursor with fetch_add (no longer collides with the call-id counter); Random (xxh3 of call_id, modulo); Sticky { key: u64 } (xxh3 of key, modulo a sorted candidate list — same key → same target while the candidate set is stable); LowestLatency (picks the candidate with smallest latency_us per the local ProximityGraph; deterministic fallback to the lexicographically-first sorted node id when no proximity data exists).
• filter_unhealthy: bool on CallOptions (default true) — skips candidates whose ProximityGraph entry reports !is_available(). Pin: candidates with NO proximity entry are KEPT (absence of evidence ≠ evidence of unhealth), so a freshly-announced server isn't falsely filtered just because pingwaves haven't propagated yet.
• EntityId ↔ node_id bridge — MeshNode::entity_id_for_node(u64) -> Option<[u8; 32]> accessor consults peer_entity_ids to map session-layer node ids to entity-layer keys. The single missing piece that LowestLatency and filter_unhealthy both flow through.
• End-to-end coverage (tests/integration_nrpc_service_discovery.rs, 6 tests): three nodes, two serve "echo", one caller uses call_service — both servers exercised by round-robin; Sticky pins consistency; Random distributes evenly; no-servers returns NoRoute with diagnostic; LowestLatency falls back deterministically when no proximity data exists; filter_unhealthy keeps proximity-less candidates.

Streaming, Tracing, Resilience, Metrics

The biggest single chunk of new surface in this release.

• Streaming responses. Multi-fire DISPATCH_RPC_RESPONSE events for one call_id marked non-terminal vs. terminal via the nrpc-streaming header (continue / end). RpcResponseSink (unbounded mpsc, non-blocking send), RpcStreamingHandler async-trait, and RpcServerStreamingFold (parallel to RpcServerFold but spawns a pump task draining the sink and emitting per-chunk nrpc-streaming: continue frames; handler return → terminal end frame, handler Err → terminal non-Ok frame, handler panic caught by catch_unwind → terminal Internal). Per-call ordering guarantee: the streaming fold takes an RpcAsyncResponseEmitter (Arc<dyn Fn(...) -> BoxFuture<()>>) instead of the unary fold's sync RpcResponseEmitter, and the pump task .awaits each emit before reading the next sink chunk — without this, two chunks emitted in tight succession would race into the publish path via independent tokio::spawns and arrive at the caller out of order. Caller side: Mesh::call_streaming returns an RpcStream: futures::Stream<Item = Result<Bytes, RpcError>>; terminal-Ok closes the stream, terminal-error yields one final Err(RpcError::ServerError) then closes. RpcStream::Drop clears the pending entry and best-effort emits CANCEL via direct unicast so the server's handler observes ctx.cancellation.
• Per-stream window grants (closes the Phase 3 streaming backlog). Wire additions: DISPATCH_RPC_STREAM_GRANT (caller → server, payload is 4-byte big-endian u32 credit count) + HEADER_NRPC_STREAM_WINDOW_INITIAL (REQUEST header, ASCII-decimal u32 initial window). Server side keeps a per-call Arc<tokio::sync::Semaphore> map; pump task acquire_owned().await + forget() per chunk. STREAM_GRANT events add_permits(n). Caller side: CallOptions::stream_window_initial: Option<u32>. RpcStream::poll_next auto-grants 1 credit per delivered chunk (in-flight credit holds near the initial window). RpcStream::grant(n) is the explicit API for batched cadence; no-op when flow control isn't enabled. Defensive caps on incoming GRANT amounts so a misbehaving caller can't overflow tokio's MAX_PERMITS. Bounded streaming pump mpsc with drop-on-full metric so a slow caller can't unbounded-buffer the server.
• W3C Trace Context propagation (cortex::rpc::TraceContext + extract_trace_context / build_trace_headers helpers). New CallOptions::trace_context: Option<TraceContext> and RpcContext::trace_context: Option<TraceContext> fields. When the caller sets CallOptions::trace_context, the SDK emits traceparent / tracestate headers and sets FLAG_RPC_PROPAGATE_TRACE; the server's fold extracts the headers and populates RpcContext::trace_context. nRPC is transport-only — application code on both sides reads/writes via whatever tracing backend it has wired up (tracing-opentelemetry, Datadog, etc.). Empty tracestate is omitted on the wire (W3C convention). Header-name matching is case-insensitive (W3C + HTTP convention); the previous implementation used name.as_str() == "traceparent" and silently dropped any non-lowercase variant.
• Caller-side retry helper (sdk/src/mesh_rpc_resilience.rs). RetryPolicy with full-half jitter (each backoff scaled by uniform random in [0.5, 1.0]), exponential growth (backoff_multiplier, default 2.0), upper-bound cap (max_backoff), and a swappable retryable: Arc<dyn Fn(&RpcError) -> bool> predicate. Default policy: 3 attempts, 50ms initial → 1s cap. default_retryable retries Timeout, Transport, and ServerError for canonical transient statuses (Internal, Backpressure, server-observed Timeout); does NOT retry NoRoute, Codec, application errors, NotFound, Unauthorized, UnknownVersion, or Cancelled. Four wrappers on Mesh: call_with_retry, call_service_with_retry, call_typed_with_retry, call_service_typed_with_retry. Typed variants encode once and reuse the bytes across attempts; service variants re-resolve the candidate set per attempt so failover is automatic.
• Caller-side hedge helper. HedgePolicy { delay, hedges } — fire-then-race: primary at t=0, additional hedges at t=delay*idx, first reply (Ok or Err) wins; if first finisher is Err, the wrapper waits for remaining hedges before surfacing the deterministic last error. Defaults: 50ms delay, 1 hedge. Four wrappers: call_with_hedge_to(targets, ...) / call_typed_with_hedge_to for explicit-target hedging (e.g. primary + warm-standby), call_service_with_hedge / call_service_typed_with_hedge for capability-index-driven hedging across replicas. Why service-only and explicit-targets-only, not direct-to-one-target: hedging to the same target is always wrong (same backlog, same GC pause, doubles your load for nothing). Hedge losers' UnaryCallGuard::Drop fires CANCEL to the server, which observes it on ctx.cancellation (pinned by hedge_loser_handler_observes_cancellation).
• Caller-side circuit breaker. CircuitBreaker with CircuitBreakerConfig — three-state machine Closed → Open → HalfOpen → Closed/Open. Defaults: 5 consecutive failures to trip, 30s open cooldown, 1 successful probe to close. Different shape from retry/hedge: a long-lived stateful guard the user instantiates once (typically per logical downstream — one per service, or one per (service, target) pair) and shares via Arc<CircuitBreaker>. The wrapper takes a closure: breaker.call(|| async { mesh.call_typed::<Req,Resp>(...).await }).await. Generic over the inner result type so it composes around raw, typed, retried, OR hedged calls. BreakerError::{Open | Inner(RpcError)} — pattern-match Open to fall back, Inner to handle the underlying error. default_breaker_failure matches default_retryable (transient infra failures count as health signals; application errors don't). HalfOpen semantics: at most ONE concurrent probe; other calls during HalfOpen short-circuit. Panic-safe: a probe that panics doesn't poison the breaker's mutex; a poisoned mutex is recovered into into_inner() so the breaker keeps serving.
• Unary-call CANCEL-on-drop. New UnaryCallGuard is constructed inside Mesh::call immediately after the REQUEST is published; if the call future is dropped before resolving (hedge loser, tokio::select! losing arm, caller-side JoinHandle::abort), the guard's Drop runs pending.cancel(call_id) AND spawns a CANCEL publish to the server via the new spawn_cancel_publish helper (shared with RpcStream::Drop). The success path flips guard.completed = true so a happy call doesn't fire a useless CANCEL.
• Per-service metrics + Prometheus formatter (adapter/net/mesh_rpc_metrics.rs). RpcMetricsRegistry — per-Mesh DashMap<String, Arc<ServiceMetricsAtomic>> (one entry per service that's been called or served). Bounded; idle entries with no in-flight ops and zero counters get evicted alongside empty queue-group shells. Per-service counters: caller-side (calls_total, errors_no_route / errors_timeout / errors_server / errors_transport, in_flight, latency_sum_ns / latency_count, Prometheus-default cumulative bucketed histogram), server-side (handler_invocations_total, handler_panics_total, handler_in_flight, handler_duration_*, streaming_chunks_emitted_total, streaming_chunks_dropped_total). CallMetricsGuard — RAII shim built BEFORE any potential early-return bumps in_flight on construction, balances on Drop. Snapshot + Prometheus formatter: MeshNode::rpc_metrics_snapshot() is a cheap one-DashMap-pass copy. Service names are escaped per Prometheus exposition convention (backslash, double-quote, newline, \r); negative gauges from racy decrements clamp to zero.

nRPC bindings — Node, Python, Go (B1–B7)

The seven-phase rollout from NRPC_BINDINGS_PLAN.md ships in full. Each phase landed independently; all phases pass their per-binding test suites and the cross-binding wire-format compat tests. Total ~5,800 LoC of new binding code + ~2,500 LoC of tests.

Cross-cutting decisions enforced by the fixture and the per-binding compat suites:

• Stable nrpc: error prefix. Every binding's caller-side errors carry nrpc:<kind>: <detail> where <kind> is one of no_route, timeout, server_error, transport, codec_encode, codec_decode, breaker_open. Each binding maps the prefix to typed exception classes via classifyError(e) (Node) / classify_error(e) (Python) / parseRpcError + typed *RpcError (Go). The Node binding throws plain Error with the prefix (NOT typed classes) to sidestep vitest's dual-module-instance hazard; users classify at the catch site.
• Canonical typed-handler status codes: NRPC_TYPED_BAD_REQUEST = 0x8000, NRPC_TYPED_HANDLER_ERROR = 0x8001 — both in the application-defined range 0x8000..=0xFFFF. Re-exported from every binding alongside the typed surface. (The fixture initially used 0x4001 matching a stale Rust SDK comment; the fixture and Rust test were corrected to match the constant the bindings actually export. Found while writing the cross-binding compat suite.)
• ServeHandle lifecycle per language. Node: .close() method (finalizers are non-deterministic so callers MUST close). Python: context-manager protocol (with rpc.serve(...) as handle:) + explicit .close(). Rust: Drop. Go: (*ServeHandle).Close() + runtime.SetFinalizer as a backstop. In every case "drop / close stops new dispatch but lets in-flight handlers complete" — same contract as the Rust serve_rpc.
• Caller-driven cancellation across all four bindings. Late in the cycle the bindings each grew an explicit cancellation surface beyond the existing CANCEL-on-future-drop:
  • Node: AbortSignal-driven (MeshRpc.reserveCancelToken() mints a bigint; pass on the call's options; call MeshRpc.cancelCall(token) from an AbortSignal listener). Abort fires CANCEL on the wire.
  • Python: Cancellable pyclass + RpcCancelledError. Pass via opts={'cancel': cancel}; cancel.cancel() from another thread aborts mid-flight.
  • Go: ctx.Done() watcher goroutine wired through net_rpc_reserve_cancel_token / net_rpc_cancel_call C-ABI exports. Watcher pins to the stream/call's lifetime so it doesn't leak past close. Watcher self-deadlock prevention via watcherDone channel closed before Close().
• Per-handler timeout configurable everywhere. Each binding's serve accepts an optional handler timeout (defaults to 60s for Go, no default for Rust/Node/Python — the SDK wraps user code with no timeout unless asked). Wedged handlers can't hold the in-flight slot indefinitely.

Node binding TS migration

• Single source of truth. errors.ts and mesh_rpc.ts replace the hand-written errors.js / mesh_rpc.js + parallel .d.ts files. The .d.ts was the only guard on the public type contract — and reviews of the nRPC work surfaced several places where the two had quietly diverged (the RawMeshRpc shape, the breaker.armed dead branch, the appError helper signature). Compiling from a single TS source catches that class of drift at build time.
• Pipeline. New tsconfig.build.json extends the existing test-only tsconfig.json; target: ES2022, module: CommonJS, moduleResolution: node, strict, declaration, noEmitOnError. outDir/rootDir both . so import paths don't change. package.json gains scripts.build:ts, scripts.typecheck, and a prepublishOnly that runs the TS build before napi prepublish -t npm. Build artifacts (errors.{js,d.ts} + mesh_rpc.{js,d.ts}) are gitignored — regenerated on publish.
• Module shape preserved. Stays CJS. npm pack --dry-run produces the same 8 files as before. Existing require('@ai2070/net/errors').CortexError keeps working unchanged. index.js / index.d.ts stay JS forever — auto-generated by napi-rs from the Rust crate.
• Test-stub conformance enforced. Turning RawMeshRpc from documentation into a real type forced StubRawMeshRpc, LoopbackHandlerRpc, and CancelTrackingRaw to drop their as unknown escape hatches and grow the missing methods. The compile error IS the win — the parallel .d.ts couldn't catch this.
• Outcome. -210 LOC of duplicated .js/.d.ts content collapsed into single TS sources. 53/53 vitest tests pass against both source state (TS) and built state (compiled .js).

Test hygiene

• Cross-binding compat fixture — single source of truth for the canonical service contract. Every binding's compat test loads golden_vectors.json and asserts the same matrix. Fixture is versioned via abi_version_expected mirroring NET_RPC_ABI_VERSION; bumping the ABI invalidates the fixture and forces every binding's compat test to update.
• Streaming flow-control coverage (tests/integration_nrpc_streaming.rs, 6 tests through real network): collects-all-chunks, drop-cancels-handler, terminal-error-after-partial-stream, plus the three flow-control tests (window_throttles_pump_until_grants asserts the server's streaming_chunks_emitted_total metric is exactly the initial window after 300ms; auto_grant_drains_full_stream; explicit_grant_unblocks_pump).
• Resilience helpers — 12 SDK integration tests across mesh_rpc_retry.rs (4), mesh_rpc_hedge.rs (3), mesh_rpc_breaker.rs (5). Each pins a specific aspect: retry-then-succeed, retry-skips-app-errors, retry-exhaustion, predicate classification (retry); backup-wins, zero-degrades, empty-targets-NoRoute (hedge); full-state-machine cycle, failed-half-open-reopens, app-errors-don't-trip, reset-clears-state, error-flatten (breaker). All over real-network handshake.
• Cross-language compat — 24 parametrized assertions (4 Rust + 4 Node + 16 Python) all driven from the shared fixture.

Breaking changes

Wire format additions (forward-compat from v0.11)

Unlike v0.11, v0.12 does not break wire compatibility with v0.11 for any pre-existing message type. Every change is a forward-compat addition:

• New dispatch bytes in the CortEX EventMeta::dispatch namespace under nRPC: DISPATCH_RPC_REQUEST, DISPATCH_RPC_RESPONSE, DISPATCH_RPC_CANCEL, DISPATCH_RPC_STREAM_GRANT, DISPATCH_RPC_STREAM_CHUNK_DROPPED. All in the CortEX-internal range 0x10..=0x1F. A v0.11 receiver that doesn't know nRPC will see these as unknown dispatch values and route them to the no-op fold arm — no crash, no confusion, just a silent skip on the receiver side.
• MembershipMsg::Subscribe gains an optional queue_group: Option<String> field (u8 length + UTF-8 bytes after the existing token field). Forward-compat: a v0.11 sender (zero remaining bytes after the token) decodes as Broadcast. A v0.12 sender that emits a queue_group to a v0.11 receiver — the v0.11 receiver ignores the trailing bytes, which is benign for broadcast semantics but means queue-group dispatch silently degrades to broadcast-fan-out across mixed-version peers. Recommendation: upgrade publishers and subscribers in lockstep if you intend to use QueueGroup.
• publish_to_peer now stamps channel_hash on the outgoing packet header (was always 0 pre-fix). A v0.11 receiver doesn't consult the header for dispatch routing on the per-shard inbound path, so this is invisible there; v0.12 receivers consult the field for the per-channel-hash fast-path dispatcher hook. Mixed-version: v0.12 sender → v0.11 receiver works (header byte ignored); v0.11 sender → v0.12 receiver works (zero hash misses the dispatcher map and falls through to per-shard inbound, which is the same behavior the v0.11 sender's receiver already had).
• New REQUEST headers: nrpc-stream-window-initial (ASCII-decimal u32 initial flow-control window) and the W3C tracing pair traceparent / tracestate (when FLAG_RPC_PROPAGATE_TRACE is set on the REQUEST). All optional; absence means "no flow control" / "no tracing context."
• No changes to IdentityEnvelope, EventMeta, CausalLink, OriginStamp, NetHeader, RedEX on-disk layout, or per-event checksum format — every v0.11 wire-format change persists unchanged into v0.12.

The summary: a v0.11 ↔ v0.12 fleet can coexist on the same mesh for the v0.11 subset of operations. nRPC traffic between mixed-version peers will silently fail (the v0.11 peer doesn't know how to dispatch nRPC), but the existing pub/sub and migration paths continue to work. Recommend lockstep upgrade if you intend to use nRPC across the fleet from day one.

Rust core (net crate) — API surface

• SubscriptionMode enum is new in adapter::net::channel::roster. Match arms over SubscriptionMode need to handle both variants; #[non_exhaustive] was added so this is forward-compatible.
• MembershipMsg::Subscribe gains a public queue_group: Option<String> field. Struct-literal constructors must add it; the helper constructors (Subscribe::new, etc.) default to None so most call sites don't need updating.
• Mesh::subscribe_channel_in_queue_group / Mesh::subscribe_channel_in_queue_group_with_token are new public methods on MeshNode and the SDK's Mesh envelope.
• Mesh::serve_rpc / Mesh::call / Mesh::call_service / Mesh::find_service_nodes are new public methods on MeshNode. The SDK adds typed counterparts: serve_rpc_typed, call_typed, call_service_typed, serve_rpc_streaming, serve_rpc_streaming_typed, call_streaming, call_streaming_typed.
• adapter::net::cortex::rpc is a new public module re-exporting RpcContext, RpcHandler, RpcHandlerError, RpcRequestPayload, RpcResponseEmitter, RpcResponsePayload, RpcServerFold, RpcClientFold, RpcClientPending, RpcStatus, RpcStreamingHandler, RpcResponseSink, StreamItem, TraceContext, plus the dispatch + flag constants.
• adapter::net::mesh_rpc is a new public module re-exporting RpcError, RpcReply, RpcStream, CallOptions, RoutingPolicy, ServeError, ServeHandle, CodecDirection, MAX_RPC_* constants.
• adapter::net::mesh_rpc_metrics is a new public module re-exporting RpcMetricsRegistry, RpcMetricsSnapshot, ServiceMetrics, ServiceMetricsAtomic, CallOutcome, DEFAULT_LATENCY_BUCKETS_SECS. Snapshot via MeshNode::rpc_metrics_snapshot(); Prometheus formatter via RpcMetricsSnapshot::prometheus_text().
• MeshNode::register_rpc_inbound(channel_hash, dispatcher) -> bool and MeshNode::unregister_rpc_inbound(channel_hash) are new public methods. The dispatcher is Arc<dyn Fn(StoredEvent) + Send + Sync>; registered channel hashes route directly and skip the per-shard inbound queue. register_rpc_inbound returns false if the hash is already registered (refuses overwrites).
• ThreadLocalPooledBuilder::set_channel_hash(u32) is a new public method exposing the underlying packet-builder method so the publish path can stamp the channel hash.
• ChannelConfigRegistry::insert_prefix(prefix, config) / remove_prefix(prefix) are new public methods. get_by_name(name) falls back to a longest-prefix-first walk when no exact match exists. The exact-match hot path (DashMap get) is unaffected.

Rust SDK (net-sdk)

The SDK's nRPC surface is entirely additive — no existing SDK API changes.

• New module mesh_rpc re-exports RpcError, RpcReply, CallOptions, RoutingPolicy, ServeHandle, RpcContext, RpcHandler, RpcHandlerError, RpcStatus, ServeError, Codec, RpcStreamTyped, ResponseSinkTyped, plus the NRPC_TYPED_* status constants.
• New module mesh_rpc_resilience re-exports RetryPolicy, HedgePolicy, CircuitBreaker, CircuitBreakerConfig, BreakerError, BreakerState, plus default_retryable / default_breaker_failure predicates.
• New Mesh methods (Rust SDK): serve_rpc, serve_rpc_typed, serve_rpc_streaming, serve_rpc_streaming_typed, call, call_service, call_typed, call_service_typed, call_streaming, call_streaming_typed, call_with_retry, call_service_with_retry, call_typed_with_retry, call_service_typed_with_retry, call_with_hedge_to, call_service_with_hedge, call_typed_with_hedge_to, call_service_typed_with_hedge, find_service_nodes, rpc_metrics_snapshot.

FFI / bindings

Behavioral fixes that may surface as test breakage

• MembershipMsg::Subscribe encoder emits no trailing bytes when queue_group: None. Tests that decoded a v0.11 Subscribe and asserted "trailing zero byte" will fail — the encoder no longer writes the length byte on None. The decoder still accepts both shapes (forward-compat).
• Hedge losers' handlers observe ctx.cancellation. Pre-fix a hedge loser's request stayed in-flight on the server and the handler ran to completion against a caller that no longer cared. Tests that asserted "handler ran for every hedge attempt" will see the cancellation signal instead.
• Caller-side Mesh::call dropped before resolution emits CANCEL on the wire. Tests that asserted the server-side handler ran to completion despite caller drop will see ctx.cancellation fire.
• Server-side fold emits RpcStatus::Cancelled on CANCEL observation. Tests that asserted "deadline + cancel surfaces as Timeout" will see Cancelled if CANCEL beat the deadline timer; the deadline path still surfaces Timeout (no behavior change for the deadline-only case).
• extract_trace_context is case-insensitive. Tests that injected only-lowercase trace headers and asserted extraction will continue to work; tests that asserted capitalized variants were silently dropped will see the headers picked up.
• classify_publish_no_session matches both publish-side and send-side error strings. call_service failure to a peer whose session expired between discovery and dispatch now surfaces RpcError::NoRoute instead of RpcError::Transport.
• ChannelConfigRegistry prefix-walk is longest-prefix-first. Tests that relied on insertion-order or shortest-prefix-wins to disambiguate nested prefix registrations will see the most-specific prefix match instead.
• Per-handler-timeout default for the Go binding is 60s. Wedged Go-side handlers can no longer hold the in-flight slot indefinitely; tests that exercised "handler runs for >60s" will surface a timeout where they previously hung.

How to upgrade

1. Bump your Cargo.toml / package.json / requirements.txt / go.mod to the v0.12 line. Recompile.
2. For consumers that only use the existing pub/sub + migration surfaces — no source changes required. v0.12 is forward-compatible with v0.11 wire formats for everything that existed in v0.11. The new SubscriptionMode and MembershipMsg.queue_group fields are additive.
3. For consumers that want nRPC — the typed surface is opt-in. Read net/crates/net/README.md#nrpc for the cross-binding contract, then per-binding READMEs for language-idiomatic usage:
   • Rust SDK — net/crates/net/sdk/README.md § nRPC. Feature-gated on cortex (already enabled by the local and full umbrella features).
   • Node — net/crates/net/sdk-ts/README.md § nRPC. Import from @ai2070/net/mesh_rpc.
   • Python — net/crates/net/sdk-py/README.md § nRPC + net/crates/net/bindings/python/README.md § nRPC. Import from net.mesh_rpc.
   • Go — net/crates/net/include/README.md § nRPC for the C-ABI surface. Reference cgo wrapper at bindings/go/net/mesh_rpc.go.
4. For mixed v0.11 ↔ v0.12 fleets — pub/sub and migration paths continue to work cross-version. nRPC traffic between mixed-version peers will silently fail (v0.11 doesn't know how to dispatch nRPC). Upgrade the fleet in lockstep if you intend to use nRPC across all peers from day one. QueueGroup subscriptions silently degrade to broadcast fan-out when crossing into a v0.11 receiver — same recommendation.
5. Node consumers depending on the hand-written mesh_rpc.js / errors.js shape — module exports and require() resolution are unchanged. If your test harness used as unknown casts to satisfy RawMeshRpc against a stub that didn't conform, the stub will need to grow the missing methods (or the casts switched to actual conforming shapes). The TypeScript compile error names the missing method.
6. Cross-binding nRPC consumers — every binding's compat suite asserts the same fixture (tests/cross_lang_nrpc/golden_vectors.json). If you're integrating nRPC across language boundaries, your wire-level compatibility is enforced at the binding's own CI. The fixture is versioned via abi_version_expected mirroring NET_RPC_ABI_VERSION = 0x0001.
7. Go consumers — the libnet_rpc cdylib is a separate build artifact from the existing libcompute_ffi. Build with cargo build --release -p net-rpc-ffi and link both. ABI version drift is detected via net_rpc_abi_version() vs the consumer's compiled-in ExpectedABIVersion.
8. If you implemented your own caller-side request/response over the existing pub/sub primitives (e.g. via two channels + correlation id) — the nRPC surface implements exactly that pattern, with deadlines, retry/hedge/breaker, response streaming, and end-to-end cancellation. Migration is a straight rewrite per the per-binding README's ## nRPC section.
9. If you wired your own metrics around the existing channel publish path for RPC-shaped traffic — MeshNode::rpc_metrics_snapshot() + RpcMetricsSnapshot::prometheus_text() ships a complete per-service counter set (caller-side nrpc_calls_total / nrpc_errors_total{kind} / nrpc_in_flight_calls / nrpc_call_latency_seconds_* + server-side nrpc_handler_invocations_total / nrpc_handler_panics_total / nrpc_handler_in_flight / nrpc_handler_duration_seconds_* / nrpc_streaming_chunks_emitted_total). One snapshot covers both directions for any service the local node both calls and serves.

Addressed in this release

RedEX & CortEX (storage + folded state)

• Compact temp-file leak on reopen failure — compact_to's cleanup path ran after the post-rename open_or_poison / clone_or_poison fallibles, so a reopen failure left three placeholder files behind in /tmp forever. Cleanup now runs before the fallible reopen.
• Truncate-on-recovery without sync_all — torn-tail repair set_len was not durable; a crash before the next write reverted the recovery and the same torn bytes were re-read. Now sync_all + fsync_dir after the truncate.
• Best-effort rollback silently swallowed open errors — if let Ok(f) = OpenOptions::new().write(true).open(...) quietly skipped rollback when the dat/idx open failed; subsequent appends produced permanent dat/idx divergence. Now propagated as RedexError.
• In-memory index corruption on panic between drain and renormalize — sweep_retention could leave rebased base_offset against absolute payload offsets if it panicked mid-rewrite. Now builds the renormalized index in a temp Vec and atomically replaces.
• saturating_sub(dat_base) as u32 masks heap corruption — silently wrote offset 0 for stale heap entries. Now hardened so the cast never silently squashes a real offset error.
• next_seq rollback skipped if disk is None — currently safe path; documented and pinned by an invariant comment.
• Stale watermark advances past unfolded events under Stop policy — recoverable_decode published folded_through_seq.store(seq) for events whose state mutation never landed; wait_for_seq(seq) returned true incorrectly. Now gated on the actual fold result.
• Snapshot persists last_seq for skipped events — when the watermark fix above lands, snapshot() no longer emits a last_seq for events whose state was never applied; the log remains the source of truth on restore.
• Cortex WatermarkingFold saturates app_seq at u64::MAX — a peer publishing seq_or_ts == u64::MAX could pin our app_seq; the next fetch_add(1) panicked in debug or wrapped in release, breaking per-origin monotonicity. Inputs are now capped at u64::MAX - 1.
• Memories upsert was asymmetric and tombstone-less — existing-id STORED partial-updated, missing-id inserted with pinned: false, and a STORED → DELETED → STORED sequence resurrected the deleted entry. Now consistent and tombstone-aware.
• Memories empty-vec filter footgun — Some(vec![]) for require_any_tag excluded everything (any over empty = false); Some(vec![]) for require_all_tags excluded nothing (all over empty = true). UI forms emitting empty multi-selects broke silently. Both empty cases now treated as "no filter."
• Cortex/memories watch strict-bound mismatch — doc said > / <, code used >= / <=. Strict-bound consumers received boundary events. Now matches the doc.
• StoredEvent::Serialize round-trips bytes through Value — re-encoding through serde_json::Value discarded original whitespace, normalized number formatting (1.0 → 1), and reordered keys. Any downstream that hashed or signed the serialized form silently failed verification. Now passes the raw bytes through &serde_json::value::RawValue.

Bus, shards, and dispatch

• remove_shard_internal awaited batch worker before drain — contradicting the function's own doc comment. Drain still owned a sender clone, so a wedged adapter pinned this function indefinitely (no tokio::time::timeout shell on this path). Order swapped to drain → batch and the same timeout the rollback path uses now wraps the await.
• add_shard_internal rollback dispatched stranded batch with stale next_sequence after worker timeout — the still-detached worker may not have published its final flush, so the rollback emitted overlapping msg-ids. Rollback now refuses to dispatch on the timeout path; the JoinHandle leak is acknowledged in the comment.
• manual_scale_up cooldown loop invariant violated whenever cooldown > 0 — each iteration bumped last_scaling = Instant::now(); iteration 1 immediately failed InCooldown (default 30 s), leaving the first shard half-added. Operator-initiated scale-up now bypasses the auto-scaling cooldown via a dedicated scale_up_provisioning_force path.
• Scaling monitor and manual_scale_down raced finalize_draining — non-target qualifying Draining shards were silently transitioned to Stopped, dropped on the floor by the target.contains(&shard_id) filter, and leaked. Non-target ids are now still routed through remove_shard_internal.
• flush() Phase 2 barrier satisfied by post-flush traffic — dispatched was a running counter, not a snapshot; with asymmetric per-shard latency the inequality could be satisfied while pre-flush events were still queued. Now snapshots dispatched + dropped at flush entry and gates on the delta.
• shutdown() deadline path double-counted in-flight events — events_dropped += in_flight_ingests then the final two-pass sweep also drained those events into events_dispatched, violating events_ingested = events_dispatched + events_dropped on every deadline-triggered shutdown. Now subtracts the events the final sweep drained.
• Drop did not surface stranded ring-buffer events — bus dropped without await shutdown() lost ring contents but never bumped events_dropped or set shutdown_was_lossy. Operators reading post-mortem stats saw no record of the loss. Now snapshots shard_stats() in Drop.
• PollMerger topology swap had a lost-update race — concurrent add_shard_internal / remove_shard_internal could each read shard_ids() and serialize their store(...) in the wrong order, leaving the published merger view including a removed shard until the next topology change. The shard_ids() → store block is now serialized.
• PollMerger::poll lost cursor context on stalled poll — next_id was None when no shards made progress, even with a valid request.from_id. Callers re-fetched from zero — silent pagination regression. Now echoes back the original from_id.
• mapper.activate active_count.fetch_add outside the held write lock — three concurrent activates could pass the budget gate against a stale count and transiently overshoot max_shards. Increment moved before drop(shards).
• mapper.finalize_draining read pushes_since_drain_start with Relaxed — the field's docstring required Acquire to pair with the writer's SeqCst reset. Now matches.
• JoinHandle errors silently dropped in shutdown — let _ = futures::future::join_all(drains).await; ate panicked drain workers (default Tokio doesn't log task panics). Now captured and surfaced via events_dropped.
• shutdown_via_ref and in-flight wait loops thrashed the runtime — bare tokio::task::yield_now re-queued the task without parking; tight loops under contention starved the workers they were waiting on. Switched to short tokio::time::sleep.
• flush() held a sync parking_lot::Mutex inside async fn — replaced with the async-safe variant.
• JSON cursor key "00" parsed to 0 — collided with shard 0 across rebuilds. Cursor codec now treats string keys as opaque.
• std::time::Instant mixed with tokio time in shutdown — wall-clock 5s broke tokio::time::pause()-based tests. Now consistent.
• Drain worker mem::replace/send ordering — swapped scratch before the awaited sender.send(batch); channel-close mid-await silently dropped the batch. Documented as load-bearing under shutdown ordering and pinned by a regression test.

Atomics, timestamps, and counters

• raw_to_nanos(raw) quanta semantics — clarified to use delta_as_nanos(0, raw) consistently.
• TimestampGenerator::next re-reads raw inside the CAS loop — pre-fix now was read once outside the loop; on contention, retries reused the stale now and the returned timestamp drifted as last + 1 arbitrarily far behind real time.
• shard/batch.rs current_batch_size * 3 + target overflow — debug panic / release wrap on adversarial config. BatchConfig::validate now bounds max_size <= 1_000_000.
• shard/batch.rs velocity-window Instant - Duration underflow — Windows Instant is QPC-relative-to-boot; immediately-after-boot processes aborted the batch worker. Now checked_sub.
• f64 → usize as cast in batch — added clamp first.
• shard/mapper.rs next_shard_id.store(first_id + count) — checked_add on the bump path.
• shard/mapper.rs overloaded_count used stale-metric placeholders for freshly-added shards — newly-active shards no longer skew the load signal until they have at least one observation window.
• record_flush / collect_and_reset latency-sum/count desync — two independent fetch_adds vs two independent swaps let avg_flush_latency = sum.checked_div(count).unwrap_or(0) silently zero out under sustained load, suppressing the scale-up flush-latency trigger. (sum, count) now packed into a single u128 and CAS'd together. Same fix applied to push_latency_sum_ns / push_count.

Adapters (JetStream / Redis / dedup)

• JetStream Other PublishErrorKind classified as transient — auth failures, permission denied, malformed-subject all retried forever against a backend that would never succeed. Now enumerates the truly transient variants and treats Other as fatal.
• JetStream "pipelined" publish was actually serial — loop awaited publish_with_headers per event before moving on; only the server-ack join was parallel. 1k-event batch on a 1 ms RTT cost 1 s instead of "1 RTT per batch." Now pushes the publish-future into the join set.
• JetStream per-event serde_json::Value allocation — violated the per-event no-alloc contract. Now mirrors Redis's RawValue borrow + Bytes::copy_from_slice.
• JetStream one RTT per sequence in steady state — direct_get(seq) per sequence on a 1 ms RTT cost ≥100 ms wall for a 100-event poll. Now direct_batch_get.
• JetStream cold-stream bail enabled on transient info() failure — fallback fabricated first_seq = 0, enabling the cold-stream bail; populated streams returning NotFound in deletion gaps bailed after 64 NotFounds with events still ahead. Now propagates Transient.
• JetStream Fatal decode discarded already-decoded prefix — function returned immediately, dropping the events accumulated so far without advancing the cursor; recovery re-emitted the prefix. Now returns Ok on the good prefix and surfaces the corruption on the next poll.
• JetStream shutdown retained self.jetstream / self.client — post-shutdown on_batch proceeded against a drained client (typically erroring, sometimes hanging). Both fields now cleared.
• JetStream init-after-shutdown silently overwrote client without drain() — losing in-flight publishes piggybacking on the prior client. Now drains first.
• JetStream partial-failure produced duplicate publishes — mid-batch error dropped in-flight PublishAckFutures but bytes were already on the wire; retry re-published, and Nats-Msg-Id deduped only within the dedup window. Documented and pinned; retry path now wraps publish_with_headers in tokio::time::timeout to bound the cancellation surface.
• JetStream missing r field stored b"null" — could surprise downstream consumers expecting either present-or-absent. Now passes through unchanged.
• Redis cluster errors classified as fatal — MOVED / ASK / READONLY / CLUSTERDOWN / NOREPLICAS were not in the substring set; after any Redis Cluster failover, every batch failed permanently until process restart. Added.
• Redis is_healthy PING timeout cancellation — wrapped in command_timeout, with a dedicated health-check connection so a desynced ConnectionManager doesn't serve a stale PING reply on the next real command.
• Redis poll_shard XRANGE had no command_timeout wrapper — on_batch and is_healthy honored the timeout contract; poll_shard could block indefinitely. Now wrapped.
• Redis shutdown didn't drop self.conn — pure advisory flag; get_conn ignored initialized = false. on_batch could write to Redis silently after shutdown. Connection now dropped, get_conn errors with Fatal when the adapter has shut down.
• RedisStreamDedup 4096-entry default was two orders of magnitude too small — at 10 K events/sec that's a 0.4 s window; the doc described "~minutes of in-flight." Default raised; capacity required at construction.
• dedup_state startup nonce non-cryptographic — xxh3_64 of (pid, tid, ns, stack_addr, ...) narrowed entropy on 32-bit targets. Now mixes a /dev/urandom seed.
• limit + 1 overflow (Redis & JetStream poll request shaping) on adversarial limits — saturating_add(1).

Mesh transport, sessions, routing

• handle_routed_handshake Case 2 — replay nuked the live session, no rate limit — Noise NKpsk0's responder uses a fresh ephemeral on each reply, deriving a brand-new session key per replay; an attacker replaying a captured msg1 replaced the legitimate session keys, the legitimate sender kept the old keys, every subsequent packet failed AEAD. Now drops the replay when the live session matches the same remote_static_pub, and the HandshakePacer from the legacy adapter has been added.
• Pingwave strict_progress permitted address-poisoning via the hops < n.hops arm — an attacker who had observed pingwaves could spoof (origin_id=Y, seq=K, hop_count=0) for K < n.last_seq and overwrite n.addr to their UDP source. The conditions are now AND'd: pw.seq >= n.last_seq AND hops <= n.hops.
• ThreadLocalPool per-thread cache leaked forever — every connect/disconnect/NAT-rebind/mesh-rebuild cycle leaked ~16 KB × local_capacity × num_threads. Long-lived daemons OOM'd in proportion to peer-churn count. Now Drop walks every thread's LOCAL_BUILDERS to evict its pool_id slot.
• MAX_PACKET_POOL_SIZE = 1<<20 was OOM-on-first-session — with_local_capacity pre-allocated size × ~16 KB ≈ 16 GiB up front. The cap was meant to prevent OOM. Lowered to a few thousand; remaining budget covered by lazy-on-first-use.
• Anti-replay window forward-jump > 1024 zeroed state instead of refusing — MAX_FORWARD = 65_536, WINDOW_SIZE = 1024; a single authenticated jump in (1025, 65_536] zeroed the bitmap and left previously-seen counters in rx_counter - 1024 .. rx_counter replayable. The slide is now refused past WINDOW_SIZE; a fresh handshake is required.
• Anti-replay received == u64::MAX — first authenticated packet at the boundary saturated rx_counter and rejected every subsequent counter; one hostile authenticated packet could permanently poison the receive path. Now rejected at is_valid.
• TokenScope::contains(NONE) returned true unconditionally — (self.bits & 0) == 0. Compounded with authorizes(NONE, ch) returning unconditional true, so any token authorized the no-op action; callers building action: TokenScope from external input where the input masked to NONE saw true for every token. Short-circuits at the top of contains.
• route.rs tie-break used <= — doc said "preserved if strictly better." Now <.
• router.rs route_packet had no source/loop suppression — TTL exhaustion was the only loop-breaker; add_route_with_metric flap or a malicious peer could set up a 2-hop loop. Now drops when routing_header.src_id == routing_table.local_id and inspects a small (src_id, stream_id, sequence) LRU.
• router.rs RouterError::TtlExpired recheck after forward() double-counted — both record_in and record_drop ran. record_in deferred until after the post-decrement TTL check.
• linux.rs BatchedTransport::send_batch silently truncated above 64 — len.min(MAX_BATCH_SIZE) returned ≤ 64 unconditionally; reliable streams stashed the rest via on_send and only learned via NACK/RTO. Now returns InvalidInput over the cap; chunked-internally is a follow-up.
• linux.rs iov_base: packet.as_ptr() as *mut _ provenance laundering — sound under the kernel-reads-only invariant, but documented at the call site so a future Miri pass doesn't have to re-derive it.
• mod.rs handshake retry sleep had no upper bound — 100 * attempt over MAX_HANDSHAKE_RETRIES = 1024 summed to ~14 hours total with the last attempt sleeping ~102 s. Capped at 5 s per attempt.
• mod.rs handshake recv loop allocated BytesMut::with_capacity(MAX_PACKET_SIZE) per iteration — allocator pressure under stray traffic. Buffer now reused across iterations.
• session.rs evict_idle_streams LRU vs concurrent open race — min_by_key then remove was non-atomic; a freshly-opened stream could be torn down between selection and removal. Now uses remove_if with a freshness predicate.
• session.rs verify_and_touch_heartbeat did not pre-check parsed.payload.len() == TAG_SIZE — AEAD caught the mismatch but a length check shortcuts cleartext-flood probes before they touch the cipher.
• session.rs RxCreditState::on_bytes_consumed consumed/granted not jointly atomic — concurrent calls could publish consumed > granted transiently; observability/metrics showed flicker. Now packed u128 AcqRel CAS.
• route.rs capability-announcement hop_count += 1 — every other hop-count increment in the crate uses saturating_add(1); this one was bounded today by the < MAX_CAPABILITY_HOPS - 1 = 15 guard but one constant change from a debug panic. Now matches the rest.
• Static-mode select_shard_by_hash used raw modulo — dynamic-mode was already on Lemire's unbiased (hash * len) >> 64. Same bias, same fix; both paths now consistent.
• gateway.rs ParentVisible over-permissive direction — predicate accepted both dest.is_ancestor_of(source) and source.is_ancestor_of(dest); the second clause leaked parent-region traffic down into descendants. Now strictly upward.
• pool.rs (payload.len() - 16) as u16 truncation — currently safe under MAX_PAYLOAD_SIZE = 8112; debug_assert! added so a future cap-raise past u16::MAX + 16 doesn't silently mis-frame on the wire.
• failure.rs unwrap() on poisoned std::sync::Mutex — the rest of the crate uses unwrap_or_else(|p| p.into_inner()); a single panic anywhere holding these locks would have turned every subsequent unwrap into a runtime panic that took down the failure-detection loop. Switched.
• failure.rs RecoveryManager::on_failure overwrote FailedNodeState on insert — failed_at and retry_count reset to 0 each time; flapping peers never hit max_retries. Now entry().or_insert(...) and bumps retry_count.
• failure.rs get_action returned Retry { delay_ms: 0 } for healthy nodes — busy-loop footgun for callers using the action on the healthy path. Now returns the no-op variant.
• transport.rs BatchedPacketReceiver thread spun at 1 ms on persistent socket errors — EBADF / ENOTSOCK / permission-revoke ate a CPU forever. Now exponential backoff with hard-error early return.
• proxy.rs telemetry counters incremented before send succeeded — counters drifted high under partial failure. Now incremented on success.
• proximity.rs update_from_pingwave worse path overwrote better — high-seq pingwave through a long route demoted the cached direct route. Freshness (always take latest seq) is now separate from path quality (only update hops/addr/latency_us when new_hops <= self.hops).
• proximity.rs self-edge insert_or_update_edge per-pingwave — hot-path noise; skipped.

Compute, daemons, migration

• start_migration always emitted a single SnapshotReady regardless of size — chunk_index: 0, total_chunks: 1 whether the snapshot was 12 B or 12 MB; the wire encoder rejected any chunk over MAX_SNAPSHOT_CHUNK_SIZE = 7000. Locally-initiated migration of any daemon whose serialized state exceeded 7 KB couldn't be sent. Now routes through chunk_snapshot(daemon_origin, snapshot_bytes, seq_through). Breaking — see breaking-changes section.
• Snapshot reassembly unbounded chunk hold via seq_through == latest — eviction only fired for strictly greater; an attacker could park up to ~4.3 GiB of unfinished reassembly per (origin, seq) and refresh forever. Per-entry byte cap (MAX_PENDING_REASSEMBLY_BYTES = 64 MiB) plus a per-entry age sweep (MAX_PENDING_REASSEMBLY_AGE = 5 min, opportunistic at the head of every feed plus a public sweep_stale for external timers) close the at-cap-and-quiet residual hole.
• abort_migration_with_reason did not propagate to MigrationSourceHandler — source-side migrations map retained the entry; is_migrating() stayed true, buffer_event kept buffering into an undrained vector, retries tripped AlreadyMigrating. Now dispatched.
• standby_group replaced standby marked healthy with synced_through = 0 — a subsequent active failure could promote the fresh zero-state standby and lose all pre-buffer state. Now keeps the replaced standby unhealthy until after a successful sync, and promote() candidates are filtered to last_sync.is_some().
• migration_target::buffer_event had no phase guard — could insert/deliver post-cutover; combined with normal-path delivery yielded duplicate execution. Now guarded.
• migration_source::start_snapshot was a contains_key → entry() race — two concurrent snapshots of the same origin could both call user-supplied MeshDaemon::snapshot() (DashMap entry guard was held across user I/O — a separate fix moves the entry-guard drop ahead of the snapshot). The trait API doesn't enforce idempotency; the race is now serialized.
• migration_source::take_buffered_events had no phase guard — misuse-prone. Now guarded.
• migration_target::abort did not clear completed index — minor leak. Cleared.
• orchestrator returned MigrationError::TargetUnavailable(0) from auto-placement — surfaced "target node 0x0 unavailable" to operators when no specific node had ever been tried. Now typed NoTargetAvailable (variant addition).
• orchestrator::buffer_event returned false at Cutover — downstream caller could route to source post-handoff. Now correctly buffers through Cutover.
• migration.rs started_at: u64 saturated on clock jump backward — switched to Instant.
• fork_group forks.pop() and coord.remove_last() invariant unenforced — brittle. Now enforced.
• bindings.rs Vec::with_capacity from peer-supplied u32 — declared count of ~4 B entries → ~96 GiB allocation before truncation. Now bounded by data.len() / MIN_BINDING_SIZE.
• reconcile.rs unreachable!() reachable on signed but divergent input — equal-length-equal-payload tiebreak panicked on the chain's reconciliation thread. Now a deterministic tiebreak on parent_hash.
• reliability.rs silent reliability drop — when pending.len() >= max_pending, the oldest unacknowledged packet was popped; subsequent NACK could never recover that seq because the entry was gone. Now backpressures callers; doesn't drop tracking for in-flight packets.
• router.rs NetRouter::start had no re-entry guard — a second call spawned a competing dequeue loop. Now compare_exchange on running.
• continuity/chain (0, Some(non-empty payload)) accepted as genesis-shaped — chain reported Forked against junk. Now Unverifiable.
• state/log genesis-shaped event with un-validated payload — peer-injected attacker-chosen anchor. Now pinned to the canonical genesis payload.
• contested/correlation capability-index parent walk loops forever — defensive depth cap (matches the 4-level hierarchy).
• contested/observation unbounded HashMap + seq_diff_sum overflow — long chains accumulated forever. LRU + saturating_add.
• contested/superposition target_replayed only advanced from Superposed — Spreading (target catches up before advance(Replay)) stalled forever; ReadyToCollapse never fired. Now both arms advance.
• contested/propagation lossy f64 → u64 poisoned EWMA — a pathological RTT clamped per_hop to u64::MAX permanently. NaN check tightened.
• contested/correlation Instant subtraction panicked — now - correlation_window panicked if the window exceeded uptime. Now checked_sub.
• partition.rs NaN >= threshold blocked healing — when other_side.is_empty() the ratio was NaN. Empty case now treated as "fully healed."
• failure.rs RecoveryManager flapping peers (see Mesh transport, sessions, routing — the recovery and the failure detection both lived in this file).
• identity/origin.rs origin_hash: u32 collision floor documented — ~65 K peer birthday collision; cross-channel accounting keyed by origin_hash aliases distinct entities. Documented as the boundary; the rename to origin_tag and the wire bump are deferred to the next phase.

Behavior, identity, security

• safety.rs AuditOnly silently dropped violation logs — check_rate_limits only logged when mode == Enforce; the documented "log violations but don't block" stance simply didn't log. Now logs unconditionally; only the return Err is gated.
• safety.rs Relaxed / AcqRel mismatch — release paired against acquire's AcqRel; observable counter drift on weakly-ordered cores. Both sides now AcqRel.
• safety.rs audit-only token counter fetch_add without saturating — wraps under hostile traffic. Now saturating.
• loadbalance.rs NaN slipped past total_weight <= 0.0 — switched to !(total_weight > 0.0) which captures NaN.
• token.rs slot-cap race unbounded — contains_key then entry() overshoot bounded by concurrent calls, not shards. Now entry().or_insert_with() then drop on overflow.
• token.rs signed_payload() allocated 95 bytes per verify — hot-path waste. Now stack-buffered.
• channel/roster is_empty() → remove_if TOCTOU — idempotent today but fragile. Tightened.
• channel/guard revoke() did not rebuild bloom — false-positive rate climbed until manual rebuild_bloom. Now triggers rebuild.
• behavior/diff::to_bytes returned Vec::new() on cap-violation — indistinguishable from a legitimate empty diff; senders silently transmitted zero bytes, receiver dropped. Deprecated in favor of try_to_bytes.
• crypto.rs ReplayWindow::commit — see Mesh transport, sessions, routing: received == u64::MAX poisoning fixed at is_valid instead of commit.

Bindings (Node, Python, Go, C) & FFI

• net_poll buffer-too-small dropped already-consumed events — bus.poll(request) advanced the cursor before the response was serialized; an undersized buffer returned BufferTooSmall and dropped the entire response, but the next call started at the now-advanced cursor. Every event in the failed serialization was silently lost. Buffer is now sized-checked first and the response is buffered so a retry can resume.
• net_poll_ex allocation failure dropped the entire batch — Layout::array::<NetEvent>(count) and std::alloc::alloc(layout) failures returned Unknown and dropped the response. Now pre-validates count against a max event-count.
• Panic across FFI on OOM in net_poll_ex — event.id.as_bytes().to_vec().into_boxed_slice() and event.raw.to_vec().into_boxed_slice() could panic mid-loop and leak earlier Box::into_raws plus the std::alloc::alloc(layout) array. Entry points now catch_unwind; panic = "abort" for the cdylib closes the residual.
• slice::from_raw_parts(ptr, len) lacked len <= isize::MAX validation — a C caller passing sign-extended -1 triggered immediate UB before any guard fired. Affects every wide-input FFI entry point: net_ingest, net_ingest_raw, net_ingest_raw_batch, net_ingest_raw_ex, mesh.rs::collect_payloads, net_mesh_publish, net_redex_file_append, net_identity_sign, net_identity_install_token, net_parse_token. All now reject above the isize::MAX boundary.
• net_generate_keypair / net_free_string feature-gated, header unconditional — consumers linking against a cdylib built without net got load-time missing-symbol errors despite the header promising the symbol. Stubs added.
• net_free_poll_result not idempotent — frees events and next_id but left the struct fields holding the freed pointers. A defensive caller / destructor wrapper double-free'd. Now nulls fields after free; subsequent calls and null-pointer calls are no-ops.
• bus_taken defense-in-depth claim was doc-only — doc said "FFI ops also check this," but the field was read only inside net_shutdown. Either gate or remove the doc; we gated.
• Concurrent net_shutdown callers raced the bus_taken swap — a second/third caller returned Success while the first was still inside runtime.block_on(bus.shutdown()), falsely signaling completion. Now serialized.
• runtime().block_on(...) panics unwound across extern "C" — Handle::try_current() guard added at every cortex.rs and mesh.rs block_on site; catch_unwind shim added.
• FFI handle accessors &*handle without alignment check — misaligned *mut NetHandle from C is immediate UB before the null check. is_aligned_to::<HandleType>() now precedes every dereference.
• Arc<InnerType>-wrapped FFI handles lacked compile-time Send + Sync audit — static_assertions::assert_impl_all!(InnerType: Send + Sync); placed next to each handle.
• c_str_to_str lifetime elision dangled — signature unsafe fn c_str_to_str(p: &*const c_char) -> Option<&str> bound the returned &str to the local stack slot, not the underlying C buffer. Today's call sites are stack-only, but a future refactor moving the result into tokio::spawn(async move { ... }) would have compiled cleanly and dangled. Now unsafe fn c_str_to_str<'a>(p: *const c_char) -> Option<&'a str> with explicit lifetime.
• net_ingest_raw_batch silently dropped null and invalid-UTF-8 entries — function returned count - 1 accepted; bindings attributed the drop to backpressure, retried the wrong indices, and double-published the good ones. Now surfaces dropped indices via out_failed_indices: *mut size_t, out_failed_len: *mut size_t.
• parse_config_json silently fell back to DropNewest on unknown backpressure_mode — "DropOldset" (typo) or "FailProduce" got a different durability profile with no error at deploy time. Now errors on unknown values; added the Sample { rate } arm with rate validation.
• retention_max_* accepted zero, fsync params did not — retention_max_events = 0 meant "evict everything immediately on first append" — almost certainly a config mistake intended as "no limit." Now rejected at the same gate.
• Net heartbeat_interval_ms / session_timeout_ms and mesh heartbeat_ms accepted zero — heartbeat-every-0ms busy-looped the heartbeat task and saturated a CPU. Now validated.
• Cortex non-success paths didn't write *out_json/*out_len — pre-zero is the contract; some paths violated it. Fixed.
• CString::new failure reported as InvalidUtf8 but caused by interior NUL — error variant retitled.
• NetEvent / NetReceipt #[repr(C)] lacked cross-arch alignment pinning — const asserts on layout added.
• TokioMutex held across JSON serialization in cortex FFI — per-cursor latency stall. Serialization now happens outside the held mutex.
• Mesh FFI g.fp16_tflops_x10.map(|tf| tf as f32 / 10.0) lossy for u32 ≥ 2²⁴ — the neighboring tops_x10 already used saturating_u16_cap. Matched.
• parse_modality_cap unknown modality strings silently fell back to Modality::Text — used for both capability announcements and capability filters; a typo in require_modalities returned wrong nodes with no error. Switched to Option<Modality> and surfaces NET_ERR_CHANNEL on unknown.

Compute SDK error surface

• MigrationError::TargetUnavailable(0) → NoTargetAvailable — variant addition; the integration test that asserted the pre-fix variant has been updated.
• start_migration returns Vec<MigrationMessage> instead of single — see breaking changes.

Test hygiene

• Migration chunked-snapshot regression — pins that locally-initiated migration of a daemon with a serialized state ≥ 7 KB chunks correctly, and the SDK's transport-identity seal path reassembles, seals, and rechunks in order.
• Snapshot reassembly age-sweep regression — pins that the pending entry is evicted at the head of the next feed past the age cap.
• active_count budget under concurrent activate — pins that three concurrent activates can't transiently overshoot max_shards.
• PollMerger from_id echo on stalled poll — pins the cursor-context preservation.
• flush() Phase 2 barrier delta-snapshot — pins that post-flush ingest can't satisfy the inequality.
• shutdown_was_lossy no longer false-positives on deadline-triggered shutdown — pins that final-sweep drains are not counted against events_dropped.
• next_seq observer consistency — committed_seq is the lock-free invariant readers see.
• Anti-replay received == u64::MAX rejection — pins that one hostile authenticated packet can't poison the receive path.
• TokenScope::contains(NONE) is false — pins the no-op-action authorization closure.
• JetStream cold-stream bail gated only on first_seq == 0 — pins that populated sparse streams are walked past arbitrary deletion gaps.
• net_free_poll_result idempotency — pins single + multiple + null-pointer free.
• net_poll minimum-buffer rejection — pins that buffers below MIN_RESPONSE_BUFFER are rejected before the cursor is touched.

Known issues — queued for the next release

mesh.rs deep-read audit

A separate single-file audit of adapter/net/mesh.rs (~8 K LOC) surfaced 9 additional defects that are scoped to that file. None of them are addressed in this release; all are slated for the next phase. For consumers running production deployments, the most consequential are listed below — the full audit is in docs/misc/BUG_AUDIT_2026_05_03_MESH.md.

• spawn_heartbeat_loop holds a DashMap shard guard across .await — the heartbeat broadcast loop iterates peers.iter() and awaits socket.send_to(...) (heartbeat + pingwave, twice per peer) while still holding the iterator's Ref guard. Every other task touching the same shard blocks for the cumulative round-trip.
• accept / start mutual exclusion uses AcqRel where the comment relies on SeqCst — Dekker-style mutual exclusion needs both sides SC. On x86 the LOCK'd RMW happens to fully fence so the race is unobservable; on AArch64 / RISC-V the dispatcher can race handshake_responder for the inbound msg1.
• Routed-handshake key rotation silently overwrites a live session — the replay guard only fires for the same remote_static_pub; a routed msg1 with a different static for the same peer_node_id falls through and peers.insert overwrites the existing legitimate session.
• commit_reclassify_observations torn (nat_class, reflex_addr) snapshot — when every probe failed, nat_class is updated but reflex_addr keeps its previous value, violating the traversal_publish_mu invariant.
• authorize_subscribe rejects idempotent re-subscribes with TooManyChannels — a peer at the cap re-subscribing to a channel it already holds is rejected even though SubscriberRoster is set-typed.
• Routed-handshake peers.get → peers.insert not atomic — concurrent routed handshakes for the same peer_node_id race the insert; the loser's pending_handshakes initiator state is wedged until handshake_timeout.
• publish_to_peer does not propagate the reliable flag to the packet header — every other sender (send_to_peer, send_routed, send_on_stream, etc.) computes if reliable { PacketFlags::RELIABLE } and threads it in. publish_to_peer hard-codes PacketFlags::NONE. Latent today (per-stream reliability is set on open) but the inconsistency will silently bite when a receiver-side path consults the packet flag.
• process_local_packet migration loopback unbounded synchronous self-bounce — a buggy / attacker-influenced "trusted" handler that always emits a self-bound message can spin the dispatch task synchronously, starving every other peer's packets.
• connect_via does not refresh addr_to_node after a successful direct upgrade — the upgraded session's dispatch fast path falls back to a linear peers.iter().find(...) per packet for exactly the sessions that benefit most from the addr → nid index. Performance only.

Items deferred from the main audit

The following remain open from BUG_AUDIT_2026_05_03.md and are tracked for the next release: #1 (Windows compact_to non-atomic — MoveFileExW/MOVEFILE_WRITE_THROUGH), #6 / #7 / #8 (cortex watermark + checksum coverage), #13 (registry replace in-flight quiescing), #23 / #24 / #25 (cortex / mesh handle-lifetime contract on FFI), #39 (msg-id sequence_start monotonicity test), #56 (origin_hash u32 collision boundary; rename / wire bump), #64 (orchestrator target_head parent-hash 0), #68 (registry::unregister in-flight Arc clones), #73 (per-shard cap clamps cursor advancement under filtered single-shard requests), #81 (adapter/redis.rs pipeline timeout duplicate hazard — depends on RedisStreamDedup wiring), #97 (session.rs racy tx_bytes_sent watermark — see notes about credit-window invariant), #102 (envelope v0/v1 prober), #118 (rule window reset), #121 (select_power_of_two degenerate on len == 2), #125 (per_source.clear() minute-boundary RPM cap exceedance), #127 (initiator handshake HandshakePacer), #128 (router.rs lost-wakeup window).

Breaking changes

Rust core (net crate)

MigrationOrchestrator::start_migration returns Vec<MigrationMessage>

start_migration now returns Result<Vec<MigrationMessage>, MigrationError> instead of Result<MigrationMessage, MigrationError>. The local-source path returns one or more SnapshotReady chunks (sized to MAX_SNAPSHOT_CHUNK_SIZE = 7000); the remote-source path returns a single-element vec![TakeSnapshot { .. }].

Why: pre-fix the orchestrator emitted chunk_index: 0, total_chunks: 1 regardless of payload size; the wire encoder rejected anything past 7 KB and locally-initiated migration of any stateful daemon with a non-trivial state vector simply could not be sent.

Migrate:

// Before
let msg: MigrationMessage = orchestrator.start_migration(origin, src, dst)?;
send_migration_message(dest_node, &msg).await?;

// After
let msgs: Vec<MigrationMessage> = orchestrator.start_migration(origin, src, dst)?;
for msg in &msgs {
    send_migration_message(dest_node, msg).await?;
}

If you opted into transport-identity sealing, reassemble all chunks → seal → chunk_snapshot(daemon_origin, sealed, seq_through) → re-dispatch in order. The SDK's start_migration_with and MigrationHandle::reinitiate_attempt route through a new maybe_seal_chunked_snapshot helper that does this for you.

MigrationError::NoTargetAvailable (variant addition)

start_migration_auto now returns MigrationError::NoTargetAvailable when the scheduler finds no candidate, instead of TargetUnavailable(0) (which surfaced "target node 0x0 unavailable" to operators).

Migrate: match arms over MigrationError need to add the new variant; with #[non_exhaustive] already in place this is forward-compatible, but exhaustive match-on-variant code will refuse to compile.

ConsumeResponse::failed_shards

A new failed_shards: Vec<u16> field reports per-shard adapter errors that previously were silently swallowed at warn level (in contrast to stalled_shards, which was already surfaced).

Config validation rejects zero in places it used to accept

• retention_max_events = 0, retention_max_bytes = 0, retention_max_age_ms = 0 are now rejected at the JSON-config gate (matching the existing fsync zero-rejection). Set them to null or omit the field for "no limit."
• Net heartbeat_interval_ms = 0, session_timeout_ms = 0, mesh heartbeat_ms = 0 are now rejected. A 0-ms heartbeat saturates a CPU; this was almost always an unintended config.
• BatchConfig max_size > 1_000_000 is now rejected. Default is 10_000; the cap closes the current_batch_size * 3 + target overflow path.
• parse_config_json errors on unknown backpressure_mode values instead of silently selecting DropNewest.

BackpressureMode::Sample { rate }

New variant; existing match arms must add a wildcard or the new arm.

behavior::diff::to_bytes deprecated

Returns Vec::new() on cap-violation, indistinguishable from a legitimate empty diff. Migrate to try_to_bytes which returns Result.

WatermarkingFold caps inputs at u64::MAX - 1

A peer publishing seq_or_ts == u64::MAX previously poisoned per-origin monotonicity. Inputs at the boundary are now rejected. Operators feeding the watermarking fold with a synthetic max-seq must pick u64::MAX - 1.

consumer/merge::PollMerger failed/stalled shard surfacing

PollMerger::poll now echoes back the caller's from_id when no shards make progress (instead of None, which callers were interpreting as "no events" and re-fetching from zero). Callers that relied on None as the stall signal need to switch to next_id == request.from_id.

Cross-backend cursor migration enforced

compare_stream_ids's mixed-format lex fallback wedged the cursor across backend migrations (e.g. JetStream → Redis: "1700-0" < "42" lex-compared). The cursor format is now persisted alongside the cursor; cross-backend migration without explicit reset is refused.

StoredEvent serialization passes raw bytes through

Pre-fix StoredEvent::Serialize round-tripped self.raw through serde_json::Value, discarding original whitespace and key order, normalizing number formatting (1.0 → 1). Downstream signatures or hashes against the serialized form silently failed verification. Now uses &serde_json::value::RawValue passthrough — byte-equality is preserved.

Rust SDK (net-sdk)

The SDK's public surface is unchanged. The migration kickoff paths (DaemonRuntime::start_migration_with and MigrationHandle::reinitiate_attempt) handle the new chunked Vec<MigrationMessage> internally; if you call the orchestrator directly via DaemonRuntime::orchestrator_arc() (or equivalent) you must update to the new return shape.

FFI / bindings

Behavioral fixes that may surface as test breakage

These aren't strictly API-breaking, but tests that asserted the pre-fix behavior will need updating:

• MigrationError::NoTargetAvailable: tests asserting TargetUnavailable(_) from start_migration_auto need to switch.
• shutdown_was_lossy = false on a clean deadline-triggered shutdown: tests that asserted the false-positive behavior will fail.
• PollMerger::poll echoes back from_id on stall: tests that asserted next_id == None on stall will see the input cursor instead.
• active_count cannot transiently exceed max_shards: tests that relied on the budget overshoot to construct a degenerate state will need a different vector.
• flush() Phase 2 barrier respects pre-flush ingest: tests that satisfied the inequality with post-flush traffic will hang to the deadline.
• Anti-replay received == u64::MAX is rejected: tests that asserted the boundary was accepted will see the rejection.
• TokenScope::contains(NONE) == false: tests that asserted the old true will need to flip.
• JetStream Other PublishErrorKind is fatal: retry-loop tests that simulated Other and asserted retry will see the call return immediately.
• Memories STORED → DELETED → STORED does not resurrect: tests that asserted resurrection will see the post-tombstone behavior.
• gateway.rs::ParentVisible is now strictly upward; tests that asserted descendant-side leakage will fail.
• route.rs route tie-break is strictly better, not equal-or-better: tests that asserted equal-metric overwrite will see preserved routes.

How to upgrade

1. Bump your Cargo.toml / package.json / requirements.txt / go.mod to the v0.10 line.
2. Recompile. The signature changes (start_migration → Vec, BackpressureMode::Sample, ConsumeResponse::failed_shards, MigrationError::NoTargetAvailable) will surface as compile errors at the exact call sites that need updating — follow the Migrate snippets above.
3. Audit your config for fields that previously accepted zero where they shouldn't have (retention_max_*, heartbeat_interval_ms, session_timeout_ms, mesh heartbeat_ms). Replace zeros with null (or omit) for "no limit," or pick a small positive value for the heartbeat fields.
4. Cross-backend cursor migrations require an explicit reset. If your deployment is migrating from JetStream to Redis (or vice-versa), drop the persisted cursor and let the consumer re-tail from the explicit start position.
5. If you call MigrationOrchestrator directly (rather than through the SDK's DaemonRuntime::start_migration_with), update to the chunked Vec<MigrationMessage> return shape and reassemble + seal + rechunk on the transport-identity-sealing path.
6. If your test suite covers the items in Behavioral fixes that may surface as test breakage, update the assertions.
7. Re-run your full suite. The lib + binding suites run green; the FFI / bindings layer now uses catch_unwind + panic = "abort" so any unwind across the boundary that previously "worked" is now a hard failure pointing at an unhandled panic source.

Net is a mesh runtime. Identity is cryptographic, channels are hierarchical, state is causal, and compute moves. There is no broker, no leader, no central directory. Every node is its own keypair. Every event is signed into a chain you can verify without trusting the network underneath. The network is the substrate; the entities are what matter.

This is what we have to show on day one.

Mikoshi

The piece worth naming first.

A daemon in Net is a stateful event processor whose identity is its public key and whose location is the mesh. You don't address it by "node X, slot 3." You address it by its origin_hash, and that fingerprint doesn't change when the daemon moves.

Mikoshi is how it moves.

A running program on one node becomes a running program on another without losing its history, its pending work, or its place in the conversation. The source packages its state, the target unpacks it, and for a brief moment the entity exists on both nodes at once — spreading, superposed, then collapsed onto the target as routing cuts over. The daemon doesn't know it moved. Neither does anything talking to it. Observer nodes watching the stream see the same causal chain continue uninterrupted, the same sequence numbers, the same entity speaking. The hardware underneath shifted. The stream didn't notice.

What moved wasn't a copy. It was the thing itself, carried across.

Six phases, signed at every boundary, with continuity proofs that verify the chain didn't fork. Standby groups and replica groups compose on top — the active dies, the warmest standby promotes, the mesh keeps moving. The daemon is the object, and the object persists.

That is the headline of v0.8.

What's underneath

A non-localized event bus. Encrypted UDP transport with AEAD on every data packet, multi-hop forwarding, NAT traversal, and pingwave swarm discovery. ed25519 identity stamped on every header. Capability announcements that drive routing — a request for inference flows toward the nearest node with a matching GPU, not toward a fixed endpoint. Permission tokens with delegation chains. Bloom-filter authorization checks at sub-10ns per packet. Hierarchical subnets that keep observation cost bounded as the mesh grows.

A storage stack that is embedded, not a service: RedEX as the append-only log, CortEX folding the log into typed domain state, NetDB exposing it as queries and live watches. Disk persistence is a flag. Durability is a knob (Never, EveryN, Interval, IntervalOrBytes). Snapshots round-trip the whole stack in one blob. There is no database to run alongside the runtime. The runtime is the database.

Bindings for Node, Python, and Go. Ergonomic SDKs in TypeScript and Python. The same MeshDaemon interface whether the event came from this process, the next node over, or three hops away. Code written against a single-node prototype runs unmodified on a multi-hop mesh.

What this release means

Net is built on the conviction that distributed compute should not be a control-plane problem. No broker to provision, no orchestrator to fail over, no service registry to keep consistent with reality. The mesh routes around what's down. The chain proves what's true. The daemon is wherever it needs to be.

We chose the Cyberpunk frame because it's the right one. Mikoshi is the engram store — minds persisting outside the hardware that bore them. Net's daemons persist outside the nodes that host them. That is not a metaphor we are reaching for. It is what the migration state machine does, packet by packet, with cryptographic receipts.

v0.8 is the version of Net we are willing to put a name on. The codename does double duty. The song — Echo & the Bunnymen, 1984 — is about the part of yourself you don't get to negotiate with. The mission — Phantom Liberty's final act — is V carrying Songbird (Somi) to the Moon, where the system that would destroy her can't reach.

The release ships when it's ready, not when it's convenient. It happens to ship on May 1, 2026, under a full moon. We didn't plan that. We're taking it.

Codename

"Killing Moon" — Echo & the Bunnymen (1984) / Cyberpunk: Phantom Liberty (2023). Released May 1, 2026.