HydraCache 0.43.0

HydraCache 0.43.0

0.43.0 extends the production-grid hardening from 0.42.0 into
zone/region-aware placement and elastic membership. The release adds deterministic
production primitives, focused tests for each work item, compatibility
registration for control-plane snapshots, and explicit documentation for the
narrow invalidation atomicity boundary.

The 0.43 debt-closure work has also completed the live networked validation for
the 0.42/0.43 production-grid claims: raft messages, protected cluster routes,
replication, split-brain recovery, read-your-writes, zone-loss, resharding,
locality, and self-healing now have integration coverage over real transport
seams, not only deterministic in-process models.

It still does not add serializable cross-partition distributed transactions,
active-active multi-region writes, CRDT convergence, KMS ownership, TLS
termination, or certificate lifecycle management.

Highlights

• Added topology-aware placement primitives:
  RegionId, ZoneId, NodeTopology, TopologyAuthority,
  ZoneAwareReplicationStrategy, ZoneAwareReplicaSet, and
  ZonePlacementReadiness.
• Added online resharding primitives:
  MovePhase, PartitionMove, ReshardPlan, and
  validate_move_preserves_zone_quorum.
• Added locality-aware and hedged read helpers:
  ReplicaSelection, ReplicaObservation, ReplicaScorer, HedgePolicy,
  HedgedReadPlan, plan_hedged_read, and hedge_winner.
• Added opt-in tiered replicated value storage:
  TieredValueStore over the 0.42 ReplicatedValueStore seam.
• Added narrow invalidation atomicity:
  InvalidateBatch for single-partition multi-key atomic invalidation and
  InvalidationSaga for at-least-once idempotent cross-partition fan-out.
• Added operational self-healing primitives:
  AutoRepairPolicy, RepairMode, ControlPlaneSnapshot, SnapshotSink,
  InMemorySnapshotSink, restore_topology_from_snapshot, and UpgradeGuard.
• Added aggregate grid metrics for zone underspread, resharding, locality reads,
  hedging, tier promotion/demotion, invalidation batches/sagas, and auto-repair.
• Added whole-zone-loss modeling to the deterministic fault harness.
• Added tiered-values feature for the release matrix.

Continuation: Networked Control Plane

The 0.43 continuation adds executable network/control-plane seams that were
previously modeled and is now accepted by the debt-closure Phase F gates:

• RaftMetadataRuntime::durable(...) starts the runtime over
  DurableRaftLogStore and recovers committed metadata from retained log
  entries after reopen.
• RaftWireMessage and RaftMessageSink encode real
  raft::eraftpb::Message payloads for transport tests.
• hydracache-cluster-transport-axum now registers protected raft append,
  vote, snapshot, and replication routes with the existing node
  identity/authz boundary.
• SledRaftLogStore is backed by a real optional sled dependency under the
  sled-log-store feature.
• Live split-brain, read-your-writes, replication-window, and anti-entropy
  helpers bind the existing algorithms into integration-testable operations.

This does not change the documented non-goals: HydraCache still does not become
a transparent distributed database, a transaction coordinator, or an automatic
database write observer.

Verification

Focused gates:

cargo test -p hydracache --locked zone_placement
cargo test -p hydracache --locked online_reshard
cargo test -p hydracache --locked locality_reads
cargo test -p hydracache --locked tiered_values
cargo test -p hydracache --locked atomic_invalidation
cargo test -p hydracache --locked self_heal
cargo test -p hydracache --locked fault_injector_selftest
cargo test -p hydracache-cluster-raft --locked durable_runtime
cargo test -p hydracache-cluster-raft --locked networked_raft
cargo test -p hydracache-cluster-raft --features sled-log-store --locked sled_log_store
cargo test -p hydracache --locked split_brain_live
cargo test -p hydracache --locked read_your_writes_live
cargo test -p hydracache --locked replication_under_load_live
cargo test -p hydracache-cluster-transport-axum --locked cluster_auth

Full gates:

cargo fmt --all -- --check
cargo check --workspace --all-targets --locked
cargo test --workspace --all-targets --locked
cargo test --workspace --all-targets --locked --features durable-log,durable-values,tiered-values
cargo test --workspace --locked -- --ignored
cargo test --doc --workspace --locked
$env:RUSTDOCFLAGS = "-D warnings"; cargo doc --workspace --no-deps --locked

Debt-closure acceptance gates:

cargo xtask verify
cargo test --workspace --all-targets --locked --features durable-log,sled-log-store
cargo test --workspace --locked -- --ignored

Scope Boundary

InvalidateBatch is atomic only inside one partition. InvalidationSaga is not a
transaction; it is reliable eventual fan-out over an idempotent outbox-style unit.
Zone-aware placement and online resharding are explicit control-plane primitives,
not automatic capacity planning or active-active multi-region conflict
resolution.