Verified execution runtime unifying state, persistence, and replication. http://git.yeowoo.org/pure/atom?h=master 2026-09-27T12:14:38Z 2026-09-27T12:14:38Z eunhhu necpition205@gmail.com 2026-09-27T12:14:38Z urn:sha1:37d3a1e152707d2da587440c4cea8601b9ef0fd2 The app model, the tree store and the HTTP host lived in prototypes/connections among the earlier document runtime, the store was known only by its format's name, and Vega compiled six Pure sources by path. Now, as the README's principle has it: core/ runtime, flow and the app model (module*.c), with what the core asks of storage (state.h, store.h) store/ the tree store (PURETRE3, PUREREC1) serve/ pure-serve: HTTP host, outbound delivery, JSON in place cli/ pure-run, pure-edit-module A top-level make builds libpure.a (app model and store, for hosts to link) and the hosts; make check runs the store's and the app model's tests. The earlier runtime still builds from prototypes/connections against core/ and store/ (check, check-tree and check-core pass). Design 009 records the rule: parts by role behind libraries; git repositories split by coupling, so the store stays here while its contract moves with the core, and Vega stays apart. 2026-09-26T22:24:31Z eunhhu necpition205@gmail.com 2026-09-26T22:24:31Z urn:sha1:2e7ad9f8488d4f02c688ec24d6d0b571b3fa61ec A tree store commit wrote its bytes over the written zeros of the tail and its head into a slot at the start of the file: two ranges, and on the Pi's SD card a sync of two ranges costs about twice one (2.4 ms against 1.2 ms). A commit now writes a 128-byte record (its head) at the published end and its bytes right after it, then syncs once. Every 16 commits the head also goes into the older slot. The newest commit is found from the newer slot's head, or from the newest head this process has seen in the file while its record is still there, along the records whose bytes are whole; a torn record or bytes end the walk at the commit before, which the next writer overwrites. Slots of this format are PURETRE3; files of the earlier one are read and continued. Store commits went from 220-233/s to 371-396/s (p50 2.5 to 1.3 ms), and the scoreboard's durable posts from 13-16k/s to 21-26k/s with 64 connections and from 2.2-2.4k/s to 2.9-3.9k/s with 8, measured alternately with the previous build. The torn head check now tears a slot (the walk goes on from the other) and the newest record (a new process sees the commit before); a new check walks 42 commits from the slots, in a fresh process too, and stops at a damaged record. 2026-09-26T06:12:17Z eunhhu necpition205@gmail.com 2026-09-26T06:12:17Z urn:sha1:46fd0601c89a535a6501b475ff08ae11b3137ea9 A commit used to sync its nodes, then write the head and sync again: the order of writes was forced by syncs. Now the head carries where the commit's bytes start and their digest, and one fdatasync makes the bytes and the head durable together. A crash during it can leave a head whose bytes did not all reach the device; its digest then fails and the older slot stands, which is safe because a writer only builds on a durable head. Commits overwrite written zeros kept after the published end, so the sync changes neither the size nor the block map and needs no journal commit. On the SD card this is 2.4 ms per commit against 9.1 ms for two syncs; the store commits 289-304 times a second instead of 94-109, and pure-serve answers 2,012-2,611 durable PUTs a second against 583 for crash-safe axum. A process remembers the heads it published or checked, so it reads a commit's bytes at most once and never its own. Its readers pass over the head it is still making durable and so never answer with a commit a crash could take back. Head slots get a block each and the format becomes PURETRE2; a handle's refresh reads the slots through its mapping. 2026-09-26T05:30:03Z eunhhu necpition205@gmail.com 2026-09-26T05:30:03Z urn:sha1:9408c57e0f2485fd7960135c931aa120dcb3fa8f Threads that commit at the same time now share one commit: they queue, the first becomes the leader and publishes every queued request of the same store with one head, and the others wait for its result. Each request stays all or nothing on its own: one with a stale draft is left out, and so is one whose key an earlier request of the group changes. When several threads have been committing together, a leader waits up to 2 ms for as many to join as groups held lately; a single thread never waits. A test pauses a publication and checks that five commits make exactly two publications. Under eight writers on three pure-serve shards, 1,234 bursts went out in 421 publications. pure_store_group_counts reports the groups, and pure-serve prints them. 2026-09-26T04:48:40Z eunhhu necpition205@gmail.com 2026-09-26T04:48:40Z urn:sha1:c7ae77cdf4623c3eb07935081510478be9063024 A burst now looks at the store once (pure_store_pin) instead of once per request; another shard's commit ends before its answer is sent, so a request made after that answer still reads it. With this alone one thread serves 125k small keep-alive reads per second, as many as axum on three cores, with a shorter p99. --threads N runs a shard per thread: its own SO_REUSEPORT listener, epoll set, runtime domain, app and store handle. Writer sessions of the tree store now take turns inside a process with a mutex (the file lock belongs to the process and does not keep threads apart), and revisions settle concurrent edits of a key. A module with states runs on one thread. Three shards serve 151k reads per second; they still commit one by one, so durable writes and 1 MiB reads are better on one thread for now, which stays the default. Note 075 records the numbers. 2026-09-26T04:39:47Z eunhhu necpition205@gmail.com 2026-09-26T04:39:47Z urn:sha1:e4bc782d09fe1c80098a38380b3959863dfe188f Opening a draft by path opened the directory and the file, mapped the whole file, read the head, and undid all of it on close: nine system calls for every GET. pure_store_open keeps the store open for one owner thread; drafts opened through it share a reference-counted mapping of the newest version, and opening one only checks whether the file changed (its identity and its head: two system calls). A commit of its drafts maps the new version once and moves them all onto it. A compaction by another writer is noticed and followed, while drafts of the old file keep reading it and relocate their extents when they commit. pure_store_data gives modules the same through a handle. 2026-09-25T14:37:53Z eunhhu necpition205@gmail.com 2026-09-25T14:37:53Z urn:sha1:49c29a1255e1ad3f7fde6c64910c7d2c38edad78 pure_draft_commit_all publishes drafts of one store with a single head: every key must still be at its draft's base revision, all new extents and catalog records are written and synced once, and either every document becomes visible or none does. A single draft commit is the one-draft case. pure_state_open stores runtime-owned values (app states) under '.' plus a key. Document keys never start with '.', listings skip these values, and document operations refuse their names, so an app's state cannot collide with a document a client names. Tests kill a process at every commit stage of a three-draft batch and see all or none, inject each fault, stop a batch on one stale draft, and commit fifty keys in no order at once. 2026-09-25T10:57:33Z eunhhu necpition205@gmail.com 2026-09-25T10:57:33Z urn:sha1:08056bb65bb9d1cfa4ccb1cd0b9cb67554d560a3 Runtime-owned values such as an app's text need the same extent tree as stored documents without a store file. pure_draft_new creates such a draft; it edits, lends versions and reclaims like any draft but refuses to commit. pure_draft_restore returns a held draft to an earlier version, so a failed event can abandon its edits. A test runs 4,000 random edits with a fifth abandoned against a flat oracle under ASan/UBSan. 2026-09-25T10:40:05Z eunhhu necpition205@gmail.com 2026-09-25T10:40:05Z urn:sha1:12410be7ec2a030e8c3adcf318d87d5ac2954e1d A module event may read a document and then edit it; the value it read must not change. pure_draft_version captures an immutable version and pure_draft_read_version lends its extents; pure_draft_hold suspends arena reclamation while a transaction still reads earlier versions. A test reads the original 200 KB after 400 held edits and checks reclamation on release. 2026-09-25T08:34:34Z eunhhu necpition205@gmail.com 2026-09-25T08:34:34Z urn:sha1:65386f68fb53e5a9a20a284b06afd872172c30eb state.h gives any app a runtime-owned working version of a stored value on the tree store. A draft shares unchanged extents with the stored version, edits in memory by path copying, lends ordered extents without copying, and commits only its new nodes when the key is still at its base revision. A failed commit changes neither the draft nor the store; a draft whose file was replaced by compaction copies its stored extents on commit. Unreachable arena nodes are reclaimed once they outweigh max(reachable, 32 KiB). Typing into the middle of a 1 MiB document and saving each character peaked at about 1,660 KiB RSS with a draft against about 4,480 KiB for an app copy compared with storage on save; saves were only 1-2 ms faster. This corrects 073, which had attributed the TUI's remaining 8 ms to that comparison. Drafts are not yet charged to the runtime budget or visible to .pure definitions.