Truss v0.0.49

Truss v0.0.49

Release closeout: the exact-tag Linux campaign and independent public Mac ARM64 driver30, worker21 and HF62 checks passed. Public verification proof. Actual Lakebase acceptance remains a separate, unrun gate.

Release scope

This release adds explicit managed platform grants for Python embedders and
operators to the v0.0.48 runtime. The selected tuple is Python3.11+,
PostgreSQL18.6, psycopg3.3.6, mini-racer0.14.1, UMF0.10 and Weft0.4.51 with its
exact qualified compiler cohort. Release assets and the package guide are the
delivery channels. The macOS ARM64 campaign at commit 19d7bbe5 and hosted
Linux campaign at commit 4188141f pass on the same exact wheel and native
manifest below. Release completion requires the matching tag's mandatory Linux
campaign and independent public-download
verification, as defined in the
managed grants plan.

The native release label remains truss-catalog-runtime/0.74-candidate; the
selected candidate manifest SHA-256 is
288801f7177338328441b5d3ce9328af31740ebf513f04ea45e30ae316a9f3a4.
The preceding 35fd797b… candidate has the exact local receipts described below;
they do not qualify this audit-accumulation target. Paired native captures
and additive migration packaging are complete. The current native target has
complete selected installed macOS ARM64 and branch Linux qualification below.
Exact manifest identity distinguishes these targets from v0.0.48's c4339ac7…
target. A shared release label alone never establishes compatibility.

The selected Weft0.4.51 dependency is public. Its
asset and packaging verification
binds compiler source 55715373… separately from its release tag/workflow
commit d4b0b985….
The public v0.0.48 input audit
and paired source48 admission
are also complete. The earlier native manifest 35fd797b… macOS campaign passes for its exact
recorded artifacts. The current native target passes both selected installed
macOS ARM64 and hosted branch Linux campaigns below. The final tag campaign and
public verification are separate final release gates.

Highlights and fixes

• Fresh installation accepts tolerated_grantees, a bounded tuple of exact
  existing platform-role names. The default empty tuple preserves strict
  installation. Selected grants and grant options remain in place; immutable
  installation metadata records their native name/OID identities and initial
  access-control-list (ACL) observations.
• Subsequent administration verifies the stored identities. Initial ACL evidence
  remains historical provenance; later grants to selected identities are allowed
  within the explicit trusted platform boundary. Ordinary privileges, private
  defaults, ownership and effective-access checks retain their exact requirements.
• A contained InstallRefused(code="third_party_grant") identifies the unlisted
  role and safe object-class/phase context after confirmed operation rollback.
  The local CLI prints the safe refusal as JSON and exits with status1. Prior
  caller work survives; the caller still owns outer settlement.
• Separately protected activation refuses a nonempty policy with
  unsupported_profile before effects. Ordinary catalog registration, module
  access, mutation, journal and feed workflows remain available within their
  selected profile.
• Strict preparation source verification accounts for ordered routine
  replacements, exact overload signatures and the finite declared ACL profile.
  It preserves declared public and registrar grants while refusing native drift.
• Whole-group audit collection accumulates owners and entries in native arrays
  before the existing JSON construction. This removes repeated JSON copying
  while preserving order, duplicates, nulls, exact owner reduction, limits and
  authorization. The original 10-second SQL and 30-second operation limits and
  independent event budget remain unchanged.

The HF changes described in v0.0.48 remain part of the baseline; this release
adds the managed policy and its integration fixes.

Required actions and migration

Only the latest runtime is supported. Startup never migrates an installation.
Operators must quiesce writers, back up the database and host recovery registry,
and follow the migration guide: inspect
status, prepare and retain the reference, apply it, reconcile uncertain
settlement, and verify before resuming application work. Install the matching
checksum-verified Weft0.4.51 compiler cohort.

The required release lineage retains v0.0.44, shared v0.0.45/46 and v0.0.47 and
now includes the actual published v0.0.48 target. Its checksum-verified wheel
1aedf614… supplies native manifest c4339ac7…; paired America/New_York and UTC captures
admitted its route to native manifest 35fd797b…. The source profile, original migration
manifest 7d165e4a… and all prior migration artifacts retain their exact bytes. The
current migration manifest is
96addcdb95523f478d8f50b0b47198e47a860680c7400dd359711930e837e535.
It retains the preceding manifest 86bcf785… and adds the representation-only audit
collector edge from manifest 35fd797b… to 288801f7…. All four complete routes and
recovery cases pass on the exact macOS ARM64 and hosted Linux artifacts below.

Forward migration installs an empty strict managed policy on existing admitted
installations. It does not opt them into platform trust. Only fresh installation
selects tolerated identities. Missing, renamed or recreated selected roles refuse;
automatic policy widening or role remapping is unavailable. Administrators must
use a separately reviewed recovery procedure for such drift.

Hold and recovery

Hold on native drift, failed verification or uncertain settlement. Reconcile
the original attempt without resubmitting effects. Pre-commit failure rolls back;
committed changes require a forward fix or the qualified backup
restore/remigration route. Installing an old package is not database rollback.

Qualification and known limits

The installed macOS ARM64 campaign
passes on source 19d7bbe5793e61e4034769a18b1d9a03b5c7e959, with Python3.11.17,
PostgreSQL18.6, psycopg3.3.6 and the exact public Weft0.4.51 Mac cohort from
compiler source 557153731e9f5d0583193a1189a07c6ed485d3d3. Its eight steps cover
module boundaries and 20 allowed/forbidden controls, 21 managed modules/130 tests,
HF62, nine strict protected tests, all 106 migration/recovery tests over four
actual public source wheels, lifecycle controls and the original public workload.
Test campaigns have zero skips, failures or errors. Lifecycle checks preserve
the initial carrier through supported additive evolution, contained unsupported
record-retirement refusal and later selected ACL changes. The independent
UMF commit 5ba77cff / Bun1.4.3 oracle, all 1,206 frozen inputs, identities, installed payload and
owned worker cleanup verify unchanged. The retained-file index
binds 53 original outputs retained losslessly.

The complete hosted Linux branch campaign
passes at source 4188141faf3e51a7a25711a6fc22751cb37c7ae4, using the exact
public Weft0.4.51 Linux cohort from the same compiler source. It includes all
mandatory branch installed regressions, the 21-module/130-test managed campaign,
HF62 and the 106-case migration campaign,
with zero skips, failures or errors in those selected campaigns. Cleanup,
unchanged-input/payload and pinned oracle controls pass. Its publish job is
skipped because this is a branch qualification, rather than a release tag.

Both platforms use wheel
57fd9520a453dcafa52dabe6aa75a143c162593237e80177acaebdbd51202790,
native manifest
288801f7177338328441b5d3ce9328af31740ebf513f04ea45e30ae316a9f3a4
and migration manifest
96addcdb95523f478d8f50b0b47198e47a860680c7400dd359711930e837e535.
All 467 runtime payload files agree across source, wheel, sdist and installed
Mac package. The independent archive SHA-256 is
ae5726d745e6ce52f1229ad1d1b46ca6a5ff55d8cb0bb0aa73751f2dd8fd0eb6;
its corpus retains 62 cases, fixed limits and all 363 prior producer digests,
adding two semantic controls as the 364th producer binding. Each platform's
public w...

Truss v0.0.48

Truss v0.0.48

Release scope

Published for Python embedders and operators. Python3.11+, PostgreSQL18.6,
psycopg3.3.6, mini-racer0.14.1, UMF0.10 and Weft0.4.51 form the selected tuple.
Native0.74-candidate has manifest SHA-256
c4339ac7f09ab5a004c272ab00962107a970938004c1765ec4163e4d5ca9b6f0.
The public verification record binds the exact source, platform assets, compiler
cohort, checksums and selected test receipts: public release validation.
The final asset count is 15; the release page is
https://github.com/DocumentDrivenDX/truss/releases/tag/v0.0.48.

Highlights and changes

• Finite person entrypoints return typed nonmembership refusals while actual
  damaged EXECUTE grants remain native execution errors. Statement-stable data
  sources retain their original snapshot with independently current authorization.
• Frozen complete group requests support observer-only recovery. Missing,
  conflicting or unauthorized observations never execute the group again.
• Empty Records allow the paired core/DDD required-field addition; populated
  Records refuse it, including retained matching values. Existing qualified
  core-only retained-value rebinds continue to work.
• Weft-owned descriptors, explicit ordered entity facts and relationship
  projections, typed resolver diagnostics, selected indexed predicates and key
  pages use query ABI1.2. Other domains retain bounded complete fallback reads.
• Completion and group dry-run force only Truss's deferred constraints and
  publish observation carriers after host-owned rollback. They preserve prior
  caller work and produce no durable receipt or committed created identity.
• Authorized cross-module audit discovery, whole mutation metadata up to4,096
  events within its byte bound, and optional reader-authorized archived key/version
  projections. Relationship-only load discovery/details now retain exact owners
  and actor names; old incomplete headers remain unavailable.
• Deduplicated import owner inventories reduce measured residual import work;
  all original inputs still receive authorization checks. Performance evidence
  is workload-specific and establishes no general latency/p95 target.
• Original arras.view version0.1.0 Record/Field metadata is preserved through queries
  under its exact owning-document declaration; unsupported selected declarations
  refuse. Unknown unselected content and source bytes/pins remain intact.
• The independent corpus archive and installed runner are release assets.

Required actions and migration

Only the latest runtime is supported. Admitted previous databases migrate
forward without a release-age cutoff. Previous application releases do not
remain supported. This release retains the original0.0.44, shared0.0.45/46 and
0.0.47 migration sources and all immutable prior recipe/receipt evidence.

Quiesce writers and back up both database and host recovery registry. Follow
the migration guide:
inspect status, prepare and retain the reference, apply that reference, reconcile
uncertain settlement, and verify before resuming latest application work.
Startup never migrates. One complete route publishes one final receipt; prior
receipts remain unchanged. Install the matching Weft0.4.51 query dependency.

Exact text ACL inventories now distinguish sibling overloads. Separately pinned
supplements strengthen old-profile admission without rewriting published source
profiles. Native drift refuses before effects. Logical restores require the
original backup-metadata companion for PostgreSQL's omitted row-type ACLs.

Hold and recovery

Hold on drift, failed verification or uncertain settlement. Reconcile the same
original attempt; do not repeat effects with a new request. Pre-commit failure
rolls back; committed changes require a forward fix or the qualified backup
restore/remigration workflow. Installing an old package is not database rollback.

Qualification and known limits

The source-F local candidate remains separately recorded in the
source-bound qualification packet.
It passes 80 migration cases, 62 independent corpus cases, six compiler-cohort
controls, 14 policy executions covering 10 distinct controls, and the original
1,000-object/1,000-edge workload. The actual compiler/build source is
557153731e9f5d0583193a1189a07c6ed485d3d3; all 455 runtime payloads match source,
wheel and sdist. Earlier skipped/failed attempts remain preserved, including the
statement-timeout failure and same-limit serialized retry. The archive's reviewed
one-pin producer update preserves the old source, corpus and refusal log; no
assertion changed.

Public receipts separately bind the clean published wheel to the selected
platform gates: 80 lineage cases on Linux and macOS, 62 independent archive cases
on Linux and macOS, the selected 30-driver checks and the two-instance uvx
restart check: Linux 80-case migration receipt, macOS 80-case migration receipt,
Linux 62-case conformance receipt, macOS 62-case conformance receipt,
30-driver receipt, two-instance uvx receipt. The public
verification record checks the final asset inventory and exact count
(15): public release validation.

No pre-0.10 or protected-profile migration, downgrade, managed-service support,
other driver qualification or perpetual old runtime execution is added. Unknown
extension content remains preserved. Ordinary receipts remain indefinitely
retained; expiry observer fixtures do not establish an expiry writer. Broader
query domains and p95 targets remain outside the selected evidence.

Truss v0.0.47

Truss v0.0.47

Release scope

Restores explicit forward runtime migration
for populated UMF 0.10 databases. Only the latest application runtime is supported;
previous databases are supported by migrating forward to it. Older application
runtimes, pre-0.10 migration and downgrades remain outside support.

Python 3.11+, PostgreSQL 18.6, psycopg 3.3.6, mini-racer 0.14.1, UMF 0.10 and
Weft 0.4.49 form the selected tuple. Native 0.73-candidate has manifest SHA-256
7ac989147f22d437b1ce0d814ebbfaa25aa868ab5495de125aa5e2bda7b963ea.
Business layout 1.0 remains unchanged; the immutable administrative receipt
adjunct is modeled separately through UMF and included in the exact inventory.

Audience and changes

Python embedders use truss.migrations.RuntimeMigrations or truss-migrate.
Operators use the package guide
and execution plan. This release
also adopts the published v0.0.46 private local PostgreSQL socket/environment
isolation baseline.

The admitted native sources are v0.0.44 and the identical v0.0.45/v0.0.46 tuple.
Exact manifest, native definitions, privileges and metadata-owner configuration
decide admission. Changed or unknown installations refuse before migration effects.
Application startup never migrates. Old-wheel operations refuse after commit.

The administrative tool owns its transaction and persists original attempt
custody in a restart-durable host registry before submission. Receipts retain
complete original request, recipe, inventory, ordered effects and preservation
bytes. Actual lost COMMIT responses reconcile the same attempt without repeating
steps. A known commit with unavailable verification remains committed-unverified.

Required actions and recovery

1. Quiesce writers and back up the database together with its host recovery registry.
2. For the qualified logical dump/restore workflow, save backup-metadata too.
   PostgreSQL 18.6 omits private table-row-type ACLs; explicitly apply that original
   companion during offline restore before verification or application access.
3. Run status, then prepare and retain the returned reference. Run apply with
   that reference. Reconcile uncertainty with the same reference, then verify
   before resuming latest application work.

Default limits are 256 MiB per preservation pass, 10s per statement and 30s per
operation. Larger finite limits are explicit and require workload qualification.
Failure before commit rolls back the initial route. After commit use a forward
fix or the qualified backup restore/remigration flow; installing an old package
is not database rollback. Original receipt lookup remains in latest tooling.

Qualification and known limits

The original evidence
records local macOS ARM64 installed-wheel migration checks, focused regressions,
package byte correspondence and module controls. Populated original wheels seed
keyed objects, retained unknown/null content, edge/history, import provenance,
mutation replay and a committed feed acknowledgment. Native fingerprints cover
all original table/sequence state; independently authored API assertions verify
latest reads, primary/alternate key lookups, writes and continuation.

The final installed migration matrix passes all 52 cases without skips on local
macOS ARM64 and hosted Linux x86_64; source-bound Linux receipt
and package correspondence
verify all 445 runtime payload files in the wheel and sdist. The complete
Linux release workflow
also passes selected installed-runtime workflows and the original 1,000-object/
1,000-edge public workload under unchanged SQL/operation limits. Publication
requires the tag workflow to repeat these gates at the merged source; its original
migration receipt and native evidence archive ship with the checksummed assets.
The execution plan records publication and subsequent public-install verification.
Optional large-capacity/stress jobs and broad discovery are outside this result.
Protected query profiles, pre-0.10, managed services, physical restore/incarnation,
large-database capacity and exhaustive scalar/container/ownership migration
corpora are not claimed. Logical restore evidence covers a new database identity
before target writes, followed by migration from either admitted source.

Every future release must keep all admitted sources reachable with the latest
tool, retain immutable published artifacts and archive original manifests. A
package-only unchanged tuple requires no-change evidence. The first real
subsequent edge must add native skip-release-chain execution proof; the current
pure graph test does not establish that future result.

Truss v0.0.46

Truss v0.0.46

Release scope

This release adds explicit, one-shot installation and probing for an isolated
local PostgreSQL 18.6 fixture through the Python CLI. It targets Python 3.11+
and the pinned pgserver-pg18==18.6.1 executable distribution. Installation
requires --install; it retains each selected data directory across process
restarts and does not run Truss schema migrations implicitly.

Audience and channels

Python developers using the package guide can install from a source checkout or
use the package-only uvx quickstart without cloning the repository. The
versioned release asset isolated-runtime-constraints.txt pins the complete
local runtime dependency set, including pgserver-pg18==18.6.1. Its SHA-256 is
recorded in both release-pins.json and SHA256SUMS.

Highlights and changes

• Run truss-local-postgres --data-dir PATH --install --probe to create or
  inspect a retained fixture. Repeated invocations target the same selected
  data directory.
• Each fixture uses a private Unix socket directory and disables TCP listening.
  Distinct data directories can therefore use the same Unix-socket port.
• The CLI reports the connection URI, socket directory and port after a
  successful probe.
• --install explicitly installs the current Truss schema and routines.
  Starting the PostgreSQL runtime alone does not install Truss, and neither
  path migrates an existing installation.
• The published package-only quickstart uses the versioned constraints asset,
  avoiding an implicit dependency resolution outside the pinned runtime set.

Required actions and compatibility

Choose and retain a dedicated data directory for each fixture. Keep its
directory private and use the emitted connection URI for local clients. The
fixture is PostgreSQL 18.6; it is not a managed-service compatibility claim.
The CLI requires the local and native package extras.

Breaking changes and actions

There are no changes to Truss database SQL or business semantics. Existing
LocalPostgres(data_directory) callers retain their data-directory behavior;
installation remains explicit and does not migrate an existing Truss schema.

Migration or rollback guidance

This release adds an opt-in fixture workflow. Existing databases and package
installations do not need migration. To stop using a fixture, close its runtime
and preserve or remove its selected data directory according to the operator's
normal data-retention policy.

Qualification and known issues

The available local qualification used CPython 3.11.17 on macOS ARM64 with
pgserver-pg18==18.6.1. The focused suite passed eight tests, and a clean
one-shot install was followed by a second invocation that confirmed the same
retained installation. Linux-native release qualification remains a required
CI gate before publication. Windows and managed PostgreSQL environments are
outside this release's qualified scope.

References and support

See the package guide,
local installation migration plan,
and implementation plan.

Truss v0.0.45

---

ddx:
id: RELEASE-PYTHON-0.0.45
type: release-notes
activity: deploy
status: draft
authoring:
home: repo
links:
- id: truss.implementation-plan
kind: informed_by

Truss v0.0.45

Release scope

2026-10-21 UTC; Python host performance and registration diagnostics for the
Hohfeld T1–T8/W1–W3 request. Cohort: Python3.11+, PostgreSQL18.6,
psycopg3.3.6, Weft0.4.49, UMF0.10.0 and mini-racer0.14.1.
The native identifier remains0.72-candidate; the manifest digest distinguishes
these new SQL bytes. Only fresh current installations are supported.

Audience and channels

Python embedders receive API/adoption instructions in the
package guide and these GitHub release
notes. Operators must retain the matching compiler/runtime cohort and follow
the fresh-install policy.

Highlights and changes

• Verify immutable runtime files once per process; return fresh manifest copies.
• Reuse bounded successful compiler results only for identical complete inputs.
  Parameter changes miss; current native authorization still runs on every call.
• A conditional query-binding observer omits the full source on unchanged
  digest/current-person checks. Conditional reader-catalog semantics remain
  access-aware and current.
• query_with_catalog_in_transaction returns catalog observation, source bytes
  and digests, and query rows in one operation on the caller's adopted transaction.
  Hosts must adopt this API to replace separate catalog/query transactions.
• Eligible independent rootless object imports share the native set-based group
  writer and indexed original provenance. Mixed/ineligible records retain the
  per-record behavior. Resource, stale, cancellation and transaction-retry failures
  are not retried by the batch fast path.
• Weft0.4.49 materializes each native entity-facts helper once per source row,
  retaining nested authority proofs and all outputs.
• Registration refuses unnamed Records/Fields with all element-specific
  TRUSS-NAME-MISSING diagnostics. The original UMF producer continues to accept
  optional names; no UMF schema or producer changes are made.

Required actions and compatibility

Supply nonempty authored names on every Record and Field before Truss registration.
Pin Weft0.4.49 from the release assets and verify SHA256SUMS. Package replacement
requires a process restart to discard immutable caches. Existing installations
cannot be upgraded in place; no reset or migration is performed automatically.

Migration or rollback guidance

Use the package guide for fresh installation. Hold adoption on authority,
source-preservation or integrity failures. Retain the previous matched release
and its database separately when evaluating this candidate; reverting the package
does not migrate a database created with different runtime bytes.

Qualification and known issues

Local macOS ARM64/PostgreSQL18.6 checks cover exact cache inputs/eviction,
concurrent immutable verification, current permissions and source digests,
read-only combined reads, compiled result parity, indexed provenance, fallback,
no retry, audits and the 153/3,072/3,073-condition bounds. The Weft artifact has
372 affected Rust tests and five native/actual-Chromium byte-parity cases.
Published Linux qualification has its separate workflow receipts.

The frozen historical Hohfeld samples omit names and now have explicit refusal
coverage. Positive sample workflows use separately hashed named fixture
revisions; the original compressed archive is unchanged. The benchmark's
--author-fixture-names option is explicit and records both original/revised
hashes. This does not qualify unchanged unnamed source for registration.

Measured public operation budgets exclude connection, transaction setup,
adoption and settlement: direct key/page/enumeration/catalog-hit/group-preparation
calls use three client statements; the tested single-create uses four; the
three-effect group uses three; compiled and combined reads use11.

The original Hohfeld adapter still uses separate catalog and query transactions.
In100 sequential warm calls under load29.9→22.0, singleton-with-facts p95 was
28.19ms, three-effect action208.51ms, enumeration10.51ms and51-record list13.66ms.
These samples establish neither quiet-host certification nor all proposed latency
targets. The earlier candidate sample with Weft0.4.48 under load12 measured
30.68/70.62/13.01/16.29ms respectively; different loads are not a controlled
compiler comparison. The51-record facts sample improved from315.1 to154.5ms,
with the same limitation. No general10× import claim is made.

ABI1.1 retains the10,000-row complete source-population bound before predicates,
joins, aggregates and LIMIT. Complete-entity related keys retain their100-key
bound. Wildcard duplicate names refuse; explicit aliases/projection lists are
the workaround. EXCLUDE/REPLACE syntax has no selected delivery date.

References and support

See exact evidence and reproduction,
delivery plan
and the issue tracker.

Truss v0.0.44

Truss v0.0.44

Release scope

Published 2026-10-21 (UTC). Python embedder delivery completing the adopted Hohfeld feedback, following
E0/E1 in v0.0.43. The release cohort is Python >=3.11, PostgreSQL 18.6
(pgserver-pg18==18.6.1), psycopg 3.3.6, Weft 0.4.48, UMF core 0.10.0 and
embedded V8 (mini-racer==0.14.1). Native identifier 0.72-candidate is
unchanged; the manifest digest identifies this release's distinct bytes.

Audience and channels

Python hosts and adapter developers receive the API and compatibility details
through these GitHub release notes and the package guide.
Database operators must follow the fresh-install and hold guidance below.
Qualification receipts belong to the delivery plan.

Highlights

• An explicit batched scalar import profile accepts 1,024 records and performs
  fixed client work per chunk, retaining ordered per-record create/skip/reject
  results, partial progress, exact source provenance and honest durability.
• Conditional reader-catalog observations, module source revisions,
  document/global registration expectations, a cheap registrar probe and
  validated paired DDD optional fields reduce host coordination work.
• Condition-only preview, person status, typed install refusals, authorized role
  recovery, atomic grant batches and independent group/load audit grants are
  public typed APIs.

Changes and fixes

BatchedImportInput selects truss-batched-scalar-import/0.1 with chunks of
1–128 records. Legacy ImportInput retains its 128-record bound and settlement
contract. A batch result wraps the original tagged report; an empty load has
its own pending/committed/rolled-back/commit-unknown/unresolved disposition.
Envelope and native resource limits remain independent of record count.

At 128 records, measured builder plus executor client submissions fall from
1,674 to nine in an already adopted transaction, excluding context acquisition
and settlement. A 1,024-record invocation uses three builder and 27 executor
submissions. Native enforcement still contains individual records server-side;
this release does not claim set-based native DML or a tenfold latency gain.

The conditional catalog API returns a snapshot or unchanged result with an
opaque validator. Both paths recheck current complete visibility before
publication. Validators are not credentials. Each module exposes its source
catalog revision. Registration can compare the global head or exact submitted
document revisions (zero requires absence); exact authorized replay retains
its original meaning. Known paired umf.ddd/0.1.0 optional field additions use
the pinned original UMF validator; unknown or incompatible edits still refuse.

Preview evaluates all predicates in one statement snapshot, then performs a
fresh authority/basis check before releasing observations. It admits read-only
transactions and produces no mutation receipt, mutation row/advisory locks, reservation or durable
write. Conditions remain bounded at 3,072 under the existing group profile.
A concurrent revocation during observation withholds all results.

Installer attempts serialize before namespace discovery and return typed known
refusals. Passive catalog checks reject incompatible objects before executing
marker reads. Person status discloses minimal installation/catalog state;
original role names require separate administrator recovery. Grant batches
preflight every indexed error before changing any configuration.

Audit access is an independent qualified document/module grant. Pages authorize
the entire retained owner union, including deleted entities, unchanged operations,
endpoints and cascade effects. Filters include scope, type/entity/business key,
native actor, original x-action, observation time and group. Pages are newest
observed first with a fixed committed visibility frontier; observation time is
not a claimed commit timestamp/order. Load listings aggregate observed committed
chunks into an explicitly partial or complete invocation summary with counts,
initiator and observation range. Exact original load origin is retained privately,
including empty attempts; public audit projections exclude raw origin, input,
key and property values.

Breaking changes and required actions

The new routes are explicit opt-ins. Preserve exhaustive narrowing of tagged
results, including BatchedImportExecutionResult, PreviewRefused,
InstallRefused and indexed grant-batch refusals. Existing import routes retain
their selected bounds and behavior. Ordinary consumers need a separate audit
grant to read group/load metadata; reader/writer membership does not imply it.
Consumers may adopt conditional catalog validation to avoid full warm projections.

Migration or rollback guidance

Install in a fresh database without an existing truss namespace. In-place
installation upgrades, automatic reset and a verified historical export/import
migration remain unsupported. Keep an existing database with its matching runtime
cohort; a package downgrade is not a database rollback. Hold rollout if fresh
installation or selected workflow checks fail. Preserve existing data while
investigating through the repository issue tracker.

Known issues and support

The original Hohfeld adapter does not automatically select these new APIs.
Its complete-record relationship projection still requires unused aliases and
retains the declared related-key cap. Its nine corpus limits and seven
replica-only exclusions remain explicit; selected consumer success is not full
provider conformance. Restrictive delete, explicit owned cascade and advisory
preview are the adopted variants; unconditional cascade and reusable authority
or receipt tokens are not introduced.

Hosted CI selects Linux x86_64 only. Local native evidence selects macOS ARM64.
Windows, managed services, all stress cases, a complete protected security profile
and upgrade support are not inferred. SQL/operation limits remain 10s/30s.

Qualification and references

PR21 was independently reviewed
and merged. Candidate Linux CI
and tagged Linux publication
passed. Each reports 494 unittest executions: 493 passed and one optional generated-
client preflight skipped. All 76 new API/review controls passed. The explicit
client/native opt-in path passed in the separate local 70-test selection.

The installed local wheel passed 74 new API/wire controls, two final read-only/
owned-audit controls,70 regressions and 44 host/guard controls. Original Hohfeld
sample workflows passed 21; corpus13 passed 63 with nine declared limits and seven
replica-only exclusions. Warm original consumer traces report 29 execute calls+
2 rollbacks for a read with facts and 31 execute calls+1 rollback+1 commit for
an update across two transactions. These are scoped statement budgets, not a
universal latency promise.

Public artifact verification
passed for all ten fresh unauthenticated assets (nine checksum entries), all 428
runtime files,436 RECORD members, package metadata/licenses, source-build files,
full release pins and published contracts/ABI. Public tag source:
5834509d641a2961b1871d00cb1fd59962c5f086.

• Wheel SHA-256: 7cdea3af955feb11bd3cb4ca58b2f0cd9f336412d64de14bcba272711f1638d8.
• Source archive SHA-256: 35d7a2d3cae87017be40eaa02006f05732a201a65a52f795d2960dbe54f9af5a.

The complete delivery record
and request-disposition review
retain exact scope, source identities and remaining declared consumer limits.
Historical v0.0.43 receipts retain their original bytes and platforms.

Truss v0.0.43

Truss v0.0.43

Published Python embedder release. Independent review and the candidate and tagged release matrices passed. Fresh public downloads passed checksum, metadata, complete RECORD, release-pin and exact source correspondence checks for all 413 runtime files in both wheel and source archive.

Scope and package cohort

Python >=3.11 and UMF 0.10.0 remain the selected interface/source versions.
Optional integrations retain psycopg[binary]==3.3.6, weft-sql==0.4.48,
experimental umf_access==0.1.0.dev5 and local
pgserver-pg18==18.6.1. Embedded JavaScript uses mini-racer==0.14.1.
The native identifier remains 0.72-candidate; the changed manifest digest
distinguishes these runtime bytes from the prior release.

These notes and the Python package guide
describe consumer-visible changes. Existing installations still require their
matching release cohort; this release supports fresh installations only.

Changes and fixes

This release retains the experimental synchronous registered umf.access/1
action host and strict native group-response admission from
v0.0.42. Exclusive leases, original source/request correspondence,
private staged receipts, confirmed settlement and uncertain-write handling keep
their existing contracts. The v0.0.42 qualification receipt
covers its registered create-action fixture under ordinary module ACLs. The combined-source checks below exercise that same generated create-action fixture; additional generated handlers and the protected profile remain unqualified.

The owned scalar-graph profile admits at most 1,024 operations and 3,072
preconditions per atomic group. The 1 MiB original group-input limit, scope,
lock, result and time bounds still apply independently. Conditions retain
unique IDs, original failure order and locked-prestate evaluation. Groups are
never silently split to fit a bound.

The query and disclosure original-source guards select frozen reference-wheel
cohorts using exact installed Weft 0.4.48 native-module identities for macOS
ARM64 and Linux x86_64. Release CI separately verifies the downloaded wheel
against that frozen archive digest and every RECORD entry before installation. Unknown
modules and crossed wheel/module selections still refuse; the existing macOS
consumer bytes remain unchanged. Both native query/disclosure gates passed on Ubuntu 24.04 x86_64 and macOS 14 ARM64, separately from the retained earlier packaging evidence.

Repeated exact object targets reuse one successfully validated type-metadata
row within an inventory invocation. All four validation passes and every
per-condition authority check remain. No authorization decision, object state
or condition truth is cached; SQL/operation deadlines remain 10s/30s.

Batched key conflicts report the original zero-based input ordinal, including
live keys, duplicate creates and retained deleted-key reservations. Multiple
conflicts select the earliest conflicting operation. A whole-group finalization
failure without qualified operation provenance omits the ordinal rather than
identifying an arbitrary operation. Failed groups retain operation-local rollback
and leave caller settlement under host control.

The owned edge import builder also contains a nested relationship permission
refusal instead of dereferencing it as a definition. It preserves its existing
outer execution-error contract and passes through unrelated original errors.

Contained permission denials have typed results across group context,
catalog references/planning and direct object/key/edge/page/traversal reads.
They disclose no hidden entity existence, role inventory or native diagnostic
prose. Transport failure, cancellation, retry, unusable transactions and unknown
commit remain outer execution failures.

Valid unnamed Records and Fields retain their stable UMF IDs. Regression
qualification confirms registration, create/update/query and reopen behavior;
this release adds no UMF authored-name requirement.

The package guide documents current import/group limits and complete-entity
relationship output collisions. When selecting a.*, choose an unused alias
for an additional RELATED_KEYS output, for example
RELATED_KEYS(a."A-B",100) AS "_A-B". Duplicate output names retain the explicit
WFT-OUTPUT-NAME refusal. Complete relationship columns still refuse above
100 keys; bounded explicit related-key projections retain their reported
truncation semantics.

API compatibility and required actions

Consumers must update exhaustive result handling for these widened unions:

Surface	Permission refusal
group_context_in_transaction	UnauthorizedPerson, code unauthorized_person
Catalog revision, group preparation and type/relationship references	CatalogRefused, code unauthorized
Direct object/key/edge/page/traversal reads	ObjectReadRefused, code unauthorized

Narrow the value inside Ok before using a context, reference or read result.
A permission refusal is distinct from an absent entity and an unavailable
observation. Group apply retains GroupFailed(UnauthorizedPerson()).

GroupOperationFailure.code remains group_failed. Its new operation_code
is one of invalid_input, key_conflict, expected_version, not_found or
dependencies; inner_error retains the complete original native artifact.
operation_index is now str | Absent. Handle ABSENT before converting or
indexing, and supply operation_code when constructing this carrier in fixtures.
Group-input invalidity retains its separate InvalidGroupInput result.

The retired rootless inventory component retains its 128-condition bound.
Its synthetic component check does not readmit retired group execution.
Legacy ImportInput remains bounded at 128 records; larger and batched import
delivery is outside this release.

Fresh installation and rollback guidance

Install into a fresh database without an existing truss schema. Installation
upgrades remain unsupported: upgrade_in_transaction refuses without issuing
SQL, and the CLI has no --upgrade option. No automatic migration or verified
export/import upgrade route is provided. Retain an existing database with its
matching runtime cohort; changing package versions is not an in-place migration
or rollback procedure.

Qualification and known limits

The combined-source local gate adds six generated/native tests and 36
action-transport, group-result-wire and whole-group tests. All six native tests
pass; the 36-test run passes with one generated-client preflight unit skipped
because its opt-in source-root/Bun environment was not enabled in that run. The
separate generated native test did run. The receipt records the exact Python,
dependency versions, frozen UMF generator source hashes and Truss runtime
source hashes. This local result is focused composition evidence. The hosted and downloaded-artifact gates are recorded separately below.

The earlier E0/E1 evidence
qualifies its local macOS ARM64, Python 3.11.17, PostgreSQL/libpq 18.6, psycopg
3.3.6 and Weft 0.4.48 payload before the v0.0.42 merge. That development wheel
has 412 exact matching
source/wheel/installed runtime files. All 65 selected broad tests and two final
targeted tests pass; final test-delta evidence binds the two updated methods
to their targeted run and the unchanged methods to the broad snapshot.

Coverage includes the 153-condition heterogeneous workload, repeated and mixed
3,072-condition workloads, 3,073 refusal, malformed identities, collision
ordinals/reservations, rollback, replay, current permission checks and unchanged
1,024-operation capacity controls. The mixed ceiling combines existence and
property equality over A/B identities. It does not qualify every possible
3,072-condition key-route or relationship workload.

For that earlier payload, static checks pass generated SQL/manifest
correspondence, 1,526 Python import edges, 18 boundary controls and
positive/exact-negative typed consumers.
Earlier failed attempts remain in the evidence. No deadlines were raised.

The candidate and tagged release matrices pass selected installed-wheel, native strict receipt, E1, query/disclosure, negative-control and public-workload gates on Ubuntu 24.04 and macOS 14. This is selected-workflow qualification; full test discovery, Windows, managed-service and upgrade qualification remain outside this release. The earlier three-schema and stress benchmark results retain their original scope; the new runs repeat selected schema registration, replay and public workflow controls.

Statement samples cover calls inside an already adopted transaction, excluding
setup, BEGIN/COMMIT, round trips and server-internal work. They establish no
end-to-end speedup, latency distribution or universal write count. No import
throughput improvement or larger-import capacity is claimed.

Verified delivery

• Reviewed and merged PR #18. Independent exact-head review completed with no findings.
• Candidate matrix and tagged release matrix.
• Release commit: c8af523ac3f7e64f3be180e81e04e2d11f53601e.
• Wheel SHA-256: ee81c0c9ac138046d56b5eccd7c84a8fe0c9085e62962c8a8f6e0a3c1e4463a6.
• Source archive SHA-256: 0df33beb2318496e0ab04bbb52cf363e76b3d6960488626a2ba594bc6a51765c.
• All 9 checksummed assets, 413 runtime files, complete wheel RECORD, exact metadata and release pins...

Truss 0.0.42

Truss 0.0.42

Release Scope

Truss 0.0.42 adds an experimental synchronous registered umf.access/1 action
host and strict native group receipt decoding. The release date is 2026-10-20;
the wheel and source archive are distributed through GitHub release assets.
The optional query compiler remains Weft 0.4.48, the typed-sdk extra selects
umf_access==0.1.0.dev 5, and native use selects psycopg 3.3.6.

Audience and Channels

Python embedders compose source/action bindings and supply exclusive psycopg
leases. New applications can use UMF's generated SyncClient and SyncActions.
Existing caller-owned group and legacy typed read APIs retain their ownership
contracts. Native runtime delivery remains pgserver-pg 18==18.6.1 for SQL
PostgreSQL 18.6.

Highlights

• Source-bound schema/action registration supports single actions, whole atomic
  batches and advisory validation through trusted native group handlers.
• Complete detached wire receipts remain private until exact COMMIT
  acknowledgement and successful lease release. Unsafe settlement/cleanup is
  quarantined, cancellation keeps its original exception, and writes never retry.
• Native results admit only declared outcome/disposition/durability combinations
  with original replay-observation/locator correspondence. Invalid output stays
  contained by the operation savepoint, preserving earlier caller work.

Changes and Fixes

Strict native JSON decoding rejects duplicate members, invented success branches,
request-free receipt claims and mismatched native failure/observation evidence.
Attempt custody is published only after valid result admission. Empty receipt
arrays/count maps remain valid, including no-op results.

Preflight resource refusals retain the registered source digest, so generated
clients recognize definite limits without misclassifying them as unknown writes.
The whole invocation deadline includes input decoding and checks the budget before
leasing, dispatch, commit and receipt release. Trusted Python callbacks cannot be
forcibly interrupted; an expired budget is enforced when they return.

Breaking Changes and Required Actions

The new transport requires explicit host composition: accepted-source observer,
decoder, native action handler, receipt validator, and release-only exclusive
idle/autocommit lease with discard(). It supplies no general action interpreter.
Preserve complete original request and flag custody in native replay input, and
map original native results rather than reconstructing receipts from current rows.

Readers of malformed native wire now receive an execution error instead of an
invented successful receipt. Caller-owned pending groups remain pending; the new
transport owns only its explicitly leased transaction. Reads and non-atomic batch
modes return UNSUPPORTED through this new transport.

Migration or Rollback Guidance

Adopt each binding with original source and native result conformance tests. Keep
idempotency identities for uncertain settlement and recover through the original
native request boundary. Do not automatically retry. Rollback reinstalls the
prior wheel and matching cohort; historical receipts retain their original
meaning. No new schema migration or release of database authority is introduced.

Validation

Local macOS ARM64 with CPython 3.11.17, psycopg 3.3.6/libpq 18.6 and PostgreSQL 18.6
passed the focused component and native cases. An unpublished wheel also passed
all component controls. Native cases include original source comparison, advisory
native apply/rollback, creates, ordered atomic batches, exact replay, changed
input/flag conflicts, late failure rollback, actual commit acknowledgement loss
and explicit recovery, cancellation identity and malformed-result containment.
Native no-op compatibility preserves versions, timestamps and journals. The
execution receipt retains
its original source tuple; release assets record final package bytes and the
additional Astra admission/deadline corrections. CI remains native Linux.

Known Issues and Support

Native qualification covers one registered create-action fixture under ordinary
module ACLs. Its replay checks use unchanged rows; replay after later edits or
deletion and arbitrary handler registrations are not established by that fixture.
Generated no-op/update/delete/link registrations, protected execution, non-atomic
batches, generic umf.access/1 reads and exhaustive resource/platform qualification
remain open. Existing no-op/native receipt controls do not qualify a new generated
handler. Report issues with source/host/compiler versions and original request
custody; never include credentials or private business payloads in public reports.

Truss 0.0.41 — cached schema owners and Weft 0.4.48

Truss v0.0.41

Release qualification covers local macOS ARM64 with PostgreSQL 18.6.
The clean Truss wheel is
truss_toolkit-0.0.41-py3-none-any.whl, SHA-256
b47f0b3ba4b36561ccec3fb81608156a21ddeab0682adcea6a061b914c0c4cd2.

Scope and package cohort

The package requires Python >=3.11 and admits UMF 0.10.0 source. Its
optional integrations pin weft-sql==0.4.48 for compiled queries,
umf_access==0.1.0.dev4 for the experimental typed-sdk extra, and
psycopg[binary]==3.3.6 for native PostgreSQL use. The independently versioned
Weft runtime ABI, native module, backend, owner assets and source correspondence
remain separately checked.

The current macOS ARM64 qualification used PostgreSQL and libpq 18.6, UMF core
0.10.0, UMF access 0.1.0.dev4, and Weft 0.4.48 from source revision
db1e0dc5b1ec6aec0f12646421cefc314989d974. The Weft wheel SHA-256 was
def824d16bc00f9deb50c7c63bc08a728cff631eef25cf2616032b761e1c679c; the
native module SHA-256 was
36224fd006f525e26e79ad2504bee7ffd75439ce1c8367564cfeb7c826e736a4.

Changes

The optional query integration advances to Weft 0.4.48 and enrolls the matching
current query and disclosure consumer cohorts. The experimental typed SDK is
now exposed as an optional typed-sdk extra. Immutable installed query and
disclosure owner assets are verified once per process; source inputs continue
to be checked at each admission.

The clean wheel contains the 412 runtime files in the package source tree with
no missing, extra or mismatched runtime files. Its metadata includes the exact
query, typed-SDK and native optional dependency pins listed above, and all three
declared license files.

The bundled query/disclosure owner JavaScript assets and native SQL are unchanged from
v0.0.40. The three real-schema workflows and eleven stress cases are retained
from the v0.0.40 qualification and were not rerun for this draft. Their earlier
results do not constitute new v0.0.41 qualification.

Completed checks and limits

On local macOS ARM64, the focused cohort and originals controls passed 11/11.
The focused current-query and current-disclosure PostgreSQL runtime selectors
passed 9/9 against an existing PostgreSQL 18.6 cluster. No cluster lifecycle
changes were made. These are focused checks, not a full test-suite result.

Linux x86_64 Weft 0.4.48 packaging was checked for the wheel archive, RECORD,
metadata, ABI tag and notices. Its wheel SHA-256 is
8226b0cbc17b611abaaff30357aad7230e135fa713c8d3d4e05e0536a6d9a2c3, and its
native module SHA-256 is
de3289ad3d8779bd2e347c15379596495acb08381741991935b6f85c7a24b2fc. The
Python shim matches the macOS artifact. No Linux native functionality tests
were run. Windows qualification is not claimed. The three schemas and eleven
stress cases were reused from v0.0.40 evidence without rerunning them for this
release.

Source commit: da80416f8f918b84371cb9a6840db1ca84328412.

Truss v0.0.40

Truss v0.0.40

Publication requires installed-package qualification locally on macOS ARM64,
the three real schemas and all 11 unchanged stress workloads. The
operation cost ledger
records statement purposes, retained data and resource costs. Release artifacts
identify the exact source, package and qualification runs; earlier candidate
runs do not qualify a different package.

Scope and highlights

Qualification targets Python embedders using PostgreSQL18.6 on macOS ARM64;
the three real schemas and all 11 unchanged stress cases pass locally.
This update selects native 0.72-candidate, Weft 0.4.47, psycopg
3.3.6 and embedded V8 through mini-racer==0.14.1. Deployment needs no Bun,
Node or external JavaScript process.

Catalog preparation targets one source-only path for UMF 0.10.0. Older UMF
formats and upgrades from older Truss installations are unsupported. prepare_catalog,
prepare_acceptance retain original
documents and validation diagnostics without a mandatory inspector transcript.
The preparation interface is truss-registration-preparation/2.0; registration
reports use truss-catalog-registration-report/0.6. Reports retain effect counts
and applicable rebind/backfill profile identifiers. Consumers that inspect these
interfaces must accept the new versions rather than requiring the old transcript.

Loaded catalog views expose immutable application-memory schema indexes and
reuse them for an exact revision and source basis. Eligible rootless-create and
distinct stored-object update batches also use compiled application-memory
record schemas for value validation and canonical property-ID preparation. Warm
batches reuse schema across transaction/facade replacement, fetch no schema and
do not invoke the legacy per-record value validators.
Native admission still checks current authority and the exact revision, source
and registration identity. Mixed, owned and edge groups, unsupported preparation
subsets and historical prior images retain the existing native path. The retained
application cache holds at most two revisions within a 128MiB estimated-object budget. A reused
revision number with different source cannot reuse the old view. Prepared writes
also bind the registration UUID, so rollback followed by the same source at the
same revision cannot reuse obsolete native property IDs. Fresh native
context and permission checks still apply.

Changes and fixes

UMF string maxLength facets count Unicode scalar values; binary maxLength
facets count bytes. Catalog evolution checks existing stored values when a
current definition tightens either limit and refuses publication if any value
would violate the new facet. The catalog report distinguishes engine checks
from database constraints: business-key uniqueness is enforced by the engine
under the transaction writer gate; the database key-table primary key serializes
physical memberships. String and binary length checks are evaluated against
stored values by the engine.

Type and relationship qualification start with the indexed definition pin,
avoiding scans of unrelated source definitions for each object or edge.
Registration resolves property source pins together and compiles eligible key
codecs once for the revision, retaining original field definitions and facets.
Native cache initialization uses shared set-based stages rather than issuing
a sequence of catalog queries for every type. Conditions resolve their exact
object or relationship definition pin before inspecting the owning source.
Graph checks select the relationships for the affected type before resolving
their permissions and counts. Group admission compares each original schema
document once per call while retaining every operation's current owner and
permission checks. Bounded native value walks use an indexed array queue;
batch history and key metadata are collected once rather than repeatedly
copying growing JSON maps.
Batch creates and updates reuse compiled schema and key metadata. Independent
update transitions refer to canonical journal rows instead of storing another
copy of their event and origin payloads.
Import source attachment decodes its group once and stores one canonical source
row, preserving original input bytes without a second expected source image.
New object transitions also omit duplicate physical key-row images; canonical
memberships and retained reservations stay in their own tables.
Edge and cascade execution retain canonical history and expected-version/count
checks without full-image readback proofs or growing JSON payload concatenations.
Progress updates no longer compare unchanged whole request/document carriers.
Ownership-preserving groups capture only the existing independent edges being
changed. Unrelated owned definitions and growing unrelated independent-edge
populations do not force whole incident-edge snapshots. Stored owned endpoints
retain their required ownership component and root information; native final
cardinality and current authority checks remain. This applies to mixed value,
rootless-create and independent-edge operations as well as uniform batches.
Mixed and owned groups use indexed invocation-local working rows and adjacency
lookups, retaining one shared original snapshot and only changed members plus
root/endpoint header witnesses for each operation. Those headers are materialized
once in the working relation, so repeated children do not decompress an unchanged
root property map. Final forest validation visits each
node once; scope discovery and cascade walks use distinct membership rather than
repeated full-graph scans. Required historical frames remain recoverable from
the original snapshot and immutable transitions, including no-op updates followed
by catalog acceptance in the same transaction.
Historical public reads still materialize complete events. Batch writes check
affected-row counts and version-matched updates; finalization retains current
context, authority, and operation-completeness checks without replaying the trusted
producer's semantic work.

Independent update history is written in internal sets of at most 64 objects.
Each set writes ordered history and retains compact references to the actual
inserted journal rows. The full operation remains atomic: a later SQL failure
rolls back earlier sets. All sets share one protected native call and its
original SQL deadline. A
1,000-object update therefore uses 16 journal INSERT statements internally,
with no additional frontend guard submissions. Statement-level journal observers
see this changed batching cadence. Unrestricted multiplicity sides no longer
count edges; bounded checks, permissions and marker verification remain.
Within each set, history property order and pins are shared across both complete
images and all objects with the same revision/type. Entirely unbounded graph settlement needs no multiplicity counts or empty-marker
cleanup. Actual selected endpoint/root dependencies remain authorized; unrelated
relationship endpoint types do not create permission requirements. Bounded graphs
retain their count/marker checks. Current authority is checked at finish and commit.

The native query compiler admits a bounded 1,000-type catalog within its existing
4MiB model and binding byte limits. It indexes original module and element
coordinates once per prepared catalog. Its broader one-million-value parsing
budget applies only to the selected Truss runtime profile; other profiles retain
their previous limits.

A failed group condition takes precedence over a refused operation in that
group. Caller transaction ownership, operation-local rollback, original receipt
replay and current permission checks remain part of the qualified workflows.

prepare_group_in_transaction bundles the revision, group context and requested
type/relationship references. catalog_revision_in_transaction provides a small
revision probe for cached planning metadata. A write still checks its exact
current catalog basis and current authority. Group admission starts once rather
than issuing a separate replay-only group start.

Request-bearing AppliedPending results include the receipt token before commit.
The original token becomes included when the caller commits; another transaction
observes not_yet before that commit. A rolled-back token stays not_yet.
Possessing a pending token does not establish a confirmed commit or authorize
publication. Committed replay remains available for recovery.

Complete-entity SQL already supplies relationship columns through x.*.
Adding a second output with the same name remains an explicit WFT-OUTPUT-NAME
refusal. Stable UMF IDs continue to support unnamed records and fields.

Limits and qualification

Modern groups admit at most 1,024 operations; 10,000-operation groups remain
unsupported. Ordinary SQL and operation deadlines remain 10s and 30s. Catalog
preparation admits original documents up to 4MiB within a 16MiB request envelope;
the complete catalog-view wire budget is 16MiB with at most 65,536 definitions.
These are separate limits, not a promise that all maxima fit simultaneously.

Query callers can select the existing byte budget up to 16MiB for wider or larger
source sets. The default remains 1MiB. ABI 1.1 queries buffer complete source bags
before caller predicates and scan at most 10,000 rows per selected record or
relationship type. A small output limit does not bypass that source bound.
Complete-entity relationships contain at most 100 keys; excess is
refused. Use bounded RELATED_KEYS reads and their explicit truncation indicator
for higher-degree objects. No result is silently presented as complete.

The performance record records exact
functional workloads, timings and qualification limits. Release evidence
identifies the exact installed payload, distributed artifacts and local macOS qualification.

Local evidence c...