reads on a small cache.

The mapped warm point target passes, and the five-pair final confirmation shows no latest-ten regression (see the first section). The final engine is rebased onto main 37feee99. Only durable-write p99p9999% of operations were faster than this. It shows how bad the slow cases get. non-regression remains unproven (not observed to regress). Keep mmapmmapMapping a file into memory so it can be read like an array, with the OS handling the disk. opt-in and do not claim the full requested goal is met.

Rebased source was frozen at 72e057a0f4886f48633f50999b0a6d632b2120c1. Engine hashes in rebased provenance identify the validated source independently of later evidence-only commits.

Final five-pair confirmation (supersedes the three-pair latest-ten verdict)

Five alternating main/candidate pairs, each side with an adjacent LMDBLMDBA widely used embedded database built on a B+tree and memory-mapped files, known for very fast reads. control, on every mode/layout/cache cell (CPU 6 only, 100,000 calls each, all 1M records verified) put candidate latest-ten at or below main within noise everywhere.

The three-pair 1.24x/1.51x at mapped/bulk/32 was a noise outlier, as the earlier independent five-pair control (1.029/0.966) already suggested. Engine source is unchanged: all 40 engine file hashes still match rebased-checks/source-hashes.json.

Diagnostics supporting this: in rebased-scan-cache the candidate latest-ten hot loop at 32 MiB has 0 misses and 0 evictions (110 resident blocks beside 32.6 MB of locators), with the same 1.7 block hits per call as main; the perf-stat run (rebased-latest-profile) shows user instructions per call 49,044 vs 49,117 and cycles 12,218 vs 12,550 (candidate vs main), so no extra copy, CRC, or page-touch work exists on the scan path.

Remaining mean differences track host load (load average about 24 on 22 CPUs during this work).

Latencies in microseconds, median of five alternating trials. Ratio is raw candidate/main p50p50The median: half of all operations were faster than this. / p99. LMDB columns are the control run next to each side. Trial ranges: mapped 32, mapped bulk 512/default, mapped normal, pread.

Worst latest-ten cells versus main: pread bulk/32 p50 +3.3% (3.968 vs 3.840), mapped bulk/512 p99 +2.9%; every other latest-ten cell is equal or faster. Point reads keep the win: mapped 32 MiB point p50/p99 is 3.584/6.144 -> 1.184/1.600 (bulk) and 3.328/5.248 -> 1.344/2.048 (normal), against LMDB 1.728/2.7 (Kiban/LMDB 0.685 bulk, 0.78 normal).

Larger-cache point cells are at parity or better than main (largest deviation: mapped bulk default p50 1.008 -> 1.056, +4.8%, p99 +4.3%, while still 0.56x LMDB).

Writes: five alternating pairs, fast and durable, index off/on (10k ops per stage, default cache)

Source: rebased-write-confirm. Microseconds, medians; main -> candidate.

Fast-write p50/p99 are equal within noise (index on: p99 +1.1% to +2.5%; trial ranges overlap). Durable p50 is within +5%. Durable p99 is dominated by fsync outliers and swings in both directions across the same code (index-off update 1.9 -> 3.3 ms and index-on remember 5.4 -> 3.3 ms are the same code path, both writers unchanged; LMDB controls moved 8.9 -> 11.8 ms).

The data show no consistent durable p99 regression, but five pairs cannot prove p99 non-regression on fsync-bound tails; this stays a limitation. Per-value CRC adds 4 bytes per version to the point section only when point_index is on, and does not touch WALWALWrite-ahead log. Every change is appended here first, so it can be replayed after a crash., flushflushWriting a full memtable out to disk as a new SST., or fsyncfsyncForces a file and its metadata onto the disk. ordering.

Gates

No engine source changed after the rebased gates, so they apply to the final source (hash-verified): 11/11 gates in rebased-checks/status.json passed (debug and release workspace tests, clippy -D warnings, fmt, fixed crash corpora, loom, both 20,000-seed suites, readbench clippy/test/fmt). cargo fmt --check and cargo clippy --all-targets --workspace -- -D warnings were also rerun clean on the final tree.

Limitations

• mmap stays opt-in (cold-storage tradeoff documented below). Durable-write p99 is not proven non-regressive, only not observed to regress. CPU 7 (sibling of CPU 6) was not provably idle. Ratios above 1 within a few percent in individual cells (listed above) are inside the trial ranges.

Rebased warm confirmation against current main

Three alternating pairs per layout, cache, and access mode. Every Kiban process has an adjacent LMDB control. Timed children use CPU 6; builds, gates, and coordinators use CPUs 12–21 at nice 10. Other host work remained active. Each trial runs 100,000 point calls and 100,000 latest-ten calls and verifies all 1M records. Ratios are medians of within-pair ratios. Latencies are microseconds.

Both binaries include main's SQLite benchmark support. Main fixtures are fresh flag-zero PH3PH3Kiban's compact on-disk format for the perfect-hash point index., while candidate fixtures are the frozen CRC-bearing PH3 datasets. The production engine logic matches the frozen campaign; the reader has only main's explanatory comment, and the ignored maintenance benchmark gains a trial selector. See source comparison.

Mapped trial ranges, pread trial ranges. Values above one in the adjusted columns remain visible; three pairs are a confirmation, not a replacement for the five-pair campaign.

Bulk control confirmation

Five additional alternating pairs repeat the three uncertain mapped bulk cache cases with the same binaries and fixtures. The original three-pair matrix is retained in full. Latencies are microseconds.

The large initial bulk/32 latest-ten slowdown does not reproduce at five pairs: adjusted p50/p99 is 1.029/0.966. Other controls remain above main. Default point is 1.038/0.899, 512 MiB point is 1.045/1.049, and default latest-ten is 1.050/1.139. The data do not establish the requested larger-cache and latest-ten non-regression bounds. All trial ranges and both series remain visible.

All five-pair controls and ranges.

Rebase and final gates

PH3 base 4feca511 is already present through squash merge f3d21dc1 and was dropped from the replay. Main's Bloom bypass is retained. Duplicate engine commit 0283fc7a was dropped, with its unique tools and measurement evidence preserved in the campaign evidence commit. The locator lookup follows the same exact-key-before-Bloom ordering.

The CRC extension, resident packing, exact reservation accounting, and L0 prefix fix remain. Main's PH3 field offsets and frozen flag-zero contract are retained in the design document. SQLite benchmarking from 37feee99 is unchanged.

All 11 gates passed again on the rebased source, including 353 debug and release library tests, fixed corpora, loom, and both complete 20,000-seed suites. No timing runs overlapped this task's builds or tests. See gate status, source hashes, and reproduction commands.

The verifier now adds only the niceness increment needed to reach nice 10. A partial run with inherited nice 19 was preserved under rebased-checks-inherited-nice19, then all 11 gates were repeated at effective nice 10. The final metadata records coordinator nice 10 and increment zero.

No task process uses sibling CPU 7, but the sibling was not established to be idle. Whole-child CPU 7 busy fractions were median 12.3% for mapped, 10.8% for pread, and 11.9% for the extra controls, with maxima 48.8%, 87.9%, and 23.2%. These samples include open and verification, so they do not isolate activity during API timers.

This is an active-host measurement, and strict idle-sibling acceptance is not established. See sibling summary and the per-child sibling.jsonl receipts.

Cold, concurrent, profiling, and write rows below retain the original five-pair campaign against 06a457db; they were not repeated against updated main. The separate write confirmation is also preserved. Those results establish the observed cold mmap tradeoff and leave durable-write p99 uncertain. The source comparison supports carrying that evidence forward, while the new three-pair warm matrix directly checks the rebased binary and main's PH3 baseline.

The frozen source patch reconstructs the archived engine and Rust readbench source from public main 37feee99, independently of old local commit reachability after rebase. Applying it to a private Git index reproduced all 40 frozen engine file hashes. See the reconstruction receipt.

Archived five-pair campaign

Engine source: 0283fc7af8cfba828ff05343c8b77bc27b228962; baseline main 06a457db. All timing children use CPU 6; build/test/coordinator processes use CPUs 12–21 at nice 10. No task work runs on sibling CPU 7. Other host workloads were active; this is not an isolated-host claim.

The opt-in configuration is CRC-bearing PH3 SSTs, point_index=true, block_cache_bytes=32 MiB, mmap_max_level=Some(u32::MAX). Both warm layout targets are evaluated on five alternating main/PH3 pairs, each side followed by its own LMDB control. Ratios use the median of within-trial ratios, rather than dividing unrelated medians. All five trials are retained. The warm read target is met; durable-write p99 non-regression remains uncertain after the additional confirmation block, as detailed below.

Verification and read path

PH3 feature bit 0 appends an IEEE value CRC per version, preserving flag-zero PH3 and PH2 reads. Admission checks the section CRC, every sorted block CRC, exact key/MVCC/address/coverage correspondence, and each stored value CRC. External hits copy exact value bytes and CRC the owned return buffer against immutable validated metadata.

Resident full-data hits retain verified owned backing; scans and sorted fallbacks retain block verification. No mapped value is returned unchecked. See DESIGN.md.

The resident view preserves the PH3 arena and packs its hash tables (u24 pilots, no redundant fingerprints; full keys still compare). The variable locator buffer is charged exactly to the same block-cache budget; fixed table/index bookkeeping remains outside that byte accounting. Actual 32 MiB locator charges are 32,601,232 bytes bulk and 32,503,515 bytes normal.

Locator mode retains no whole-SST heap backing for values; per-call owned return buffers remain necessary. Temporary open allocations, allocator retention and the OS page cache still contribute to RSSRSSResident set size: the physical memory a process is actually using.. Inspection receipts include peak/RSS and open time.

Admitted point indexes compare complete keys directly and skip redundant Bloom probes; the Bloom section is still verified at open and remains in the sorted fallback. The immutable Version caches its L0 prefix boundary, avoiding a per-point walk across every leveled table merely to filter L0. Probe order and cross-table sequence resolution remain unchanged. mmap_max_level retains its existing level-selection and best-effort fallback semantics.

The option is explicitly enabled for mapped rows, and remains None for pread rows. Only CRC-bearing PH3 tables qualify for locator-only admission; existing PH2 and flag-zero PH3 remain readable through their original full-resident or sorted paths. Reservations are decided when a table handle opens and are not dynamically promoted after another snapshot or compaction releases budget.

Measurement conditions

Mode labels refer to Kiban; LMDB always uses its native mmap-backed engine. Warm rows run 100,000 point calls and 100,000 latest-ten calls per trial, with complete 1M-record verification. Main indexed fixtures are PH2; candidate indexed fixtures use PH3+CRC, prepared from the same seed and logical workload.

Normal compactioncompactionBackground merging of SSTs into larger sorted files, which drops old versions and keeps reads fast. topology and bytes change with the section size; the measurements include that effect. Index-off fixtures and LMDB fixtures are shared. The computed default is 449,030,592 bytes on this host (about 428.23 MiB); explicit 512 MiB is separate.

Cold rows use cold.rs: post-open madvise(DONTNEED) and file-specific posix_fadvise(DONTNEED), then 10,000 point calls with an oracle check on each result. Pages warm during those calls. Four readers share CPU 6 and exercise I/O concurrency, not four-core CPU scaling. Storage bytes/faults are retained. Main can retain verified full backing for a subset of normal-layout tables even at 32 MiB; the new locator mode uses that budget for metadata instead.

Default/512 index-on configurations retain full verified heap values through file-page eviction, so those rows are retained-resident tests, not cold-storage speedups. Open time is excluded from latency, and locator validation reads the full data region at open.

All latency tables use microseconds, median of five trials. The adjusted PH3/main columns divide each side by its adjacent LMDB control before comparing the paired results. This shows host drift but does not remove every source of noise; full min/max ranges are linked. A value above one in an adjusted column is a measured relative regression, not hidden by the headline target.

Warm point: mapped

Mapped means Some(u32::MAX); pread means None.

Raw trials, controls and ranges: ph3-mapped-read/SUMMARY.md.

Warm latest-ten: mapped

Raw trials, controls and ranges: ph3-mapped-read/SUMMARY.md.

Cold-start point: mapped

Default/512 index-on rows retain heap values.

† Retained verified heap backing; file-page eviction does not make these values cold.

Raw trials, controls and ranges: ph3-mapped-cold/SUMMARY.md.

Warm point: pread

Mapped means Some(u32::MAX); pread means None.

Raw trials, controls and ranges: ph3-pread-read/SUMMARY.md.

Warm latest-ten: pread

Raw trials, controls and ranges: ph3-pread-read/SUMMARY.md.

Cold-start point: pread

Default/512 index-on rows retain heap values.

† Retained verified heap backing; file-page eviction does not make these values cold.

Raw trials, controls and ranges: ph3-pread-cold/SUMMARY.md.

10k writes

Each trial starts from a fresh 10k-record fixture and uses 10,000 operations per harness stage, both fast and durable modes, with index off/on. The write helper keeps its existing default cache/mapping settings; these populations fit the cache. Remember and update each perform 10,000 writes; mixed-90-10 performs 1,000 writes and 9,000 reads, with separate histograms retained in raw receipts. Flush/sync/final verification are outside call timers and retained in completion receipts.

Write confirmation

A second five-pair block uses the same active database path for both labels. It confirms fast indexed insert/update controls and repeats the uncertain unindexed durable case. The original run is retained in full; neither run replaces the other.

The fast indexed update slowdown does not reproduce: confirmation p50/p99 improves 0.848/5.504 to 0.816/5.248 us. Durable unindexed insert p99 changes direction (original 3.080 to 7.078 ms; confirmation 5.636 to 3.932 ms). Durable update confirmation p50 stays close (557 to 573 us), but p99 remains higher (3.539 to 3.932 ms; adjusted ratio 1.140).

The host data do not establish a durable-write p99 no-regression guarantee. All stored values and final 20k-record states verify. This uncertainty is separate from the passing warm read target and passing correctness gates.

Write trials and ranges, confirmation and ranges.

Profiling

Round 2 already rejected verified mapped points: bulk/32 improved 3.840/6.528 to 2.432/3.584 us and normal/32 4.096/7.296 to 2.688/4.352, but all remained behind LMDB; normal/512 p50 rose 2.368 to 2.688 us. Its four-reader cold mapped p99 was 2949.120 us versus pread 589.824 us in the same prototype. Those prior results use CPU 3 and are historical, not comparable absolute timings for this CPU-6 campaign.

This implementation retains full verified heap backing when the dataset fits, uses resident exact locators when it does not, and checks every returned external value rather than caching a per-block verification bit. The new cold/larger-cache matrices are required to judge the old tradeoffs. See round-2 rejection.

The original 32 MiB sorted path used about 9,916/10,432 user cycles and 13,881/15,447 instructions per bulk/normal operation, versus LMDB 5,154/5,614 cycles and 7,893 instructions. Exclusive samples placed about 13% in cache insertion, 8–13% in block loading and 5% in block CRC, with routing/index/seek work in the inlined getter. See baseline-profile and profile-summary.json.

The rejected PH2-derived path already used per-value CRCs, derived at open. Its remaining mapped profile put 18–22% of samples in memmove and about 2–3% in CRC, with locator reconstruction in the inlined getter. Normal routing sampled at 11.86%. PH3 removes key reconstruction, and the L0 prefix removes a topology-sized filter walk.

These samples identify hot code; they are not exact nanosecond attribution. DWARF reconstruction was incomplete and perf lost samples; raw coverage/loss receipts are preserved. User-only counters exclude kernel syscall instructions.

Full-path final counters and stacks: ph3-pread-profile and ph3-mapped-profile. Syscall interposition is diagnostic only: it counts positioned-read calls/bytes/time inside the perf FIFO operation boundary and includes clock overhead. It is never enabled for latency trials. The isolated component results overlap and must not be added into a full-read prediction.

Rejected experiments and gates

The private PH2-derived locator candidate is preserved only as experiments/ph2-locators.patch. Its final pread paired K/LMDB point p50 ratios were 1.065 bulk and 1.532 normal, missing the stricter target. Earlier bulk pilot p50/p99 improved 3.712/5.504 to 1.536/2.176 us, versus LMDB 1.344/1.824; near parity was explicitly rejected. Historical final-* directories, development receipts and old source hashes refer to that experiment, not this PH3 source.

The first frozen PH3 candidate, with the Bloom precheck retained, missed the full normal target: paired p50/p99 ratios 0.930/0.864, despite bulk 0.800/0.759. The pipeline stopped before cold/writes; all 240 warm commands remain in ph3-before-bloom-read. The direct no-Bloom pilot against that source reduced bulk paired p50 K/L from 0.857 to 0.732 and normal from 0.829 to 0.791.

Its p99 ratios remain below LMDB, and all trials are retained in no-bloom-pilot. The earlier PH3 mapped pilot before the L0 change measured 1.152/1.536 us bulk versus LMDB 1.504/2.240 and 1.248/1.600 us normal versus LMDB 1.440/2.176; paired p50 ratios 0.795/0.886.

It was superseded by the frozen full matrix above. A missing-SST classification failure in the earlier candidate was fixed at the admission prepass root, preserving DbError::Corrupt. It was a caught development regression, not an existing-engine integrity bug. decisions.tsv records the parent clarification and fix.

All 11 final-source gates passed: fmt, clippy -D warnings, debug and release workspace tests (353 library tests), fixed crash corpora, loom, site facts, readbench checks, and both 20,000-seed suites. New tests cover mixed PH2/PH3 flags, snapshots, tombstones, binary/empty keys, address widths, checksum metadata corruption with recomputed section CRC, pre-open backing corruption, post-open repeated mapped/pread value corruption, short pread, concurrent reads after unlink, address-space eligibility, and exact reservation release.

See gate receipts, source hashes, provenance, design, and reproduction.

Across modes, the candidate four-reader cold p99 is also higher with mmap: bulk 1540.096 us versus pread 434.176 us, normal 2097.152 us versus pread 491.520 us (about 3.5x and 4.3x).

The existing option lets deployments choose this warm-page-cache advantage explicitly, and the report separately measures pread. Open-time validation, mixed old tables, and snapshot-dependent admission also argue against a default change. The complete acceptance decision and any other material controls are recorded in decisions.tsv.