v0.1.25.50 — runtime correctness, replay integrity, and int64 fidelity
Rolls up the v0.1.25.49 runtime hardening and the v0.1.25.50 replay/int64 follow-up. This release keeps the public protocol schema unchanged while closing correctness, liveness, and scaling gaps in reservation lifecycle processing.
Correctness and replay integrity
- Stores immutable reserve/commit/release response snapshots inside their atomic Redis mutations and repairs missing fast caches without synthesizing a potentially different response.
- Uses a PENDING → BASE/EVIDENCE state machine so concurrent replay repair cannot overwrite a canonical evidence-bearing response.
- Preserves exact signed-int64 ledger arithmetic and response values across reserve, commit, release, expiry, direct events, and extend through one shared Lua decimal helper.
- Saturates only the commit-level debt observability aggregate at
Long.MAX_VALUE; per-scope debts and balances remain exact. - Restores commit/release replay metrics with
IDEMPOTENT_REPLAYwhile avoiding overdraft double-counting.
Expiry and audit hardening
- Emits expiry events only for a true
status=EXPIREDtransition and hydrates the correct timestamp fields. - Quarantines reservations with missing, malformed, or negative estimate data outside the bounded TTL sweep index, leaving state and budgets untouched for operator reconciliation and logging a WARN.
- Makes admin-release audit persistence part of the same Lua transaction and centralizes audit-entry preparation with fail-closed tenant validation.
Performance and operations
- Releases Redis connections before BCrypt verification.
- Replaces hot reservation
HGETALLcalls with explicitHMGETprojections, shares name-keyed projection mapping, and hoists projection arrays. - Adds resilient event/delivery pointer retention cleanup and fixes jqwik configuration discovery.
- Updates production and full-stack compose defaults to
ghcr.io/runcycles/cycles-server:0.1.25.50.
Compatibility
- No public schema or successful-response shape changes.
- Finalized reservations created before immutable snapshots existed still replay through their canonical body cache; if both that cache and a snapshot are absent, the server returns the existing retriable 500 rather than a non-identical reconstruction.
Validation
- 1,111 tests: 31 model, 525 data, 555 API; zero failures, errors, or skips.
- Contract coverage 11/11; JaCoCo line coverage 95.09% data and 95.56% API.
- Real-Redis regressions cover
2^53 + 1,10^14 + 1, andLong.MAX_VALUEledger/refund/replay cases. - Same-host benchmark medians: reserve/commit/release p50 14.5/13.7/14.3 ms and 698.2 ops/s at 32 threads, with no regression signal versus v0.1.25.49.
Full details: CHANGELOG.md [0.1.25.49] and [0.1.25.50], AUDIT.md 2026-07-12/13 entries, PRs #235 and #237, issue #236.