Ship Keldra 0.17.0 with three-node recovery and index corrections

[zcourts]

Outcome

Prepares Keldra 0.17.0 as a fresh-volume minor release. It retains the measured single-lane ingest/index path and fixes the security, recovery, v6 catalog, cluster-growth, outage, atomic-executor, and accounting-assignment defects found during 0.16 qualification.

Keldra 0.17 changes the cluster/data-peer protocols and uses a clean storage/index generation. Every node must start with fresh authoritative and derived-index volumes; mixed 0.16/0.17 operation and in-place upgrades are unsupported. Move older data through the public API as new writes.

The release also pins Zanzibar 0.5.0 candidate f805ae35180bfe3333e496c0707bbf35ac9d40c6, which depends on exact keldra = "=0.17.0".

Correctness, recovery, and security

• Binds current-object quorum observations to the requested stable tenant, bucket, and exact path before selection.
• Recovers alias-expanded source-journal entries from canonical mutation-quorum proof after interrupted metadata publication, including page boundaries and restart.
• Treats an ahead local reference cursor as retryable publication debt, makes already-durable stale settlement idempotent, and lets proven reference progress repay journal-capacity pressure.
• Keeps peer admission cluster-mTLS authenticated and placement-fenced; Raft authority remains ACTIVE-only.
• Allows distributed built-in object transactions to use their canonical zero stored-program hash while retaining nonzero hashes for stored and legacy programs.

Index and accounting corrections

• Builds multi-definition TypedJson physical families with dense temporary field IDs before canonicalization.
• Grows query memory only with retained query data under the existing permit and configured bounds.
• Rebuilds a stale v6 physical catalog generation from live authoritative objects and uses the prior object version only as the replacement CAS guard.
• Keeps physical Index assignment placement shared by tenant/bucket, while Accounting assignment placement remains definition-scoped by tenant/bucket/accounting-definition ID. The latter is the final correction for the reproduced bucket-accounting activation failure.

Cluster growth and outage behavior

• Repairs learner catch-up after Raft log purge and keeps join migration/replica activation in the background after membership acknowledgement.
• Routes joining-gateway reads and writes through existing authenticated peer APIs with stable request identity.
• Refreshes stale placement and moved atomic-executor responses and retries the same request identity/deadline.
• Tracks atomic-executor nomination with the current ACTIVE Raft leader through the durable nomination fence.
• Completes ordinary logical/object/current/exact-version reads once an exact quorum is available and returns erasure-coded payloads after enough verified shards arrive.
• Propagates BulkWrite deadlines, deduplicates distributed payload/mutation work, preserves destination authorization failures, and reconciles replica-local retention during handoff without making it quorum authority.

Release surface

• Versions the workspace, API crate, Rust client, CLI/server assertions, documentation, and qualification entrypoints at 0.17.0.
• Publishes one GHCR tag, ghcr.io/keldra-store/keldra:0.17.0, containing only Linux AMD64 and ARM64 variants.
• Uses the unprefixed Keldra tag 0.17.0; Zanzibar uses v0.5.0.
• Keeps the post-publication three-node workflow pinned to the immutable release tag and exact published image.

Validation

Exact release candidate: dc2e2eede799ace8bbdd0cbb43a39eb7dedc76c0.

Verified now:

• The exact candidate and Zanzibar gitlink are clean and pushed at the SHAs above.
• dc2e2eed is a release-version/documentation/workflow-assertion update over behavioral candidate 08719fd504c669afd0a63dbf6f81f2c1344c32cb; it introduces no additional runtime implementation change.
• Behavioral-candidate CI run 33981883542 passed static checks, the complete locked workspace tests, and native AMD64/ARM64 image builds plus real gRPC smoke tests.
• Exact 0.17.0 CI run 33986624089 passed static checks, the complete locked workspace tests, and native AMD64/ARM64 image builds plus authenticated gRPC smoke tests.
• Locked workspace metadata resolves all Keldra workspace crates at 0.17.0 and Zanzibar at 0.5.0. Publishable file lists for keldra-api, keldra, and zanzibar were inspected and contain only their intended manifests, READMEs, sources/protos/tests, generated Cargo metadata, and the Keldra license files where configured.
• The bounded outgoing diff passes git diff --check; focused publication scans found no credentials, private keys, local VM paths, or suspicious package filenames.

Pending and not claimed yet:

• exact keldra:qa-dc2e2eed image build/identity attestation;
• real public-API accounting regression on the exact image;
• complete fresh release-mode three-node qualification on the exact image;

Publication remaining

After those gates pass: fast-forward main to the exact candidate, create immutable tag 0.17.0, publish and verify the two crates in dependency order (keldra-api, then keldra), wait for the tag workflow to publish the two-platform GHCR image and GitHub Release, run the published-image three-node workflow, then qualify and publish Zanzibar 0.5.0 from its exact candidate.

At this preflight point the Keldra/Zanzibar tags and GitHub Releases, GHCR :0.17.0, and all three new crate versions are intentionally absent. Bounded non-release work remains tracked in #266, #267, and #269.