Guarantees

Durability

• With the default synchronous durability, an acknowledged write has been committed to a checksummed write-ahead log, and a crash does not lose it.
• A write whose outcome the engine cannot state is reported as indeterminate, never as failed, and can be resolved later by its mutation id - including after a restart, within the retained history.

Recovery

• Snapshots are published atomically as new generations; a snapshot is never overwritten in place.
• Recovery is deterministic: it replays the log over the last published generation and classifies what it finds.
• Ambiguity recovery cannot resolve stops writable startup. It is not skipped or quietly quarantined, and every session leaves a report.

Ownership and lifecycle

• One process owns a store for writing; a second writer is refused.
• One database per process, enforced.
• Reads and writes are admitted only in engine states that allow them.

Queries and indexes

• An index that is not ready is never used; a query falls back to a scan and returns a correct answer.
• A filter means the same thing from LINQ, a filter string or a JSON filter; an untranslatable construct is refused with a classified error.
• Approximate vector results are labelled approximate.

Operations

• Diagnostic codes and metric names, units and labels do not change meaning once released.
• Diagnostic output never contains document values, credentials or key material.
• Diagnostics never block a write.

Replication

Convergence, per-collection ordering from one source, and recognised redelivery - and no more. See Clustering & replication.

How the guarantees are tested

The engine's test suites run on Linux x64, Windows x64 and macOS arm64, and a release is certified only after crash, chaos and stress test campaigns in addition to unit and integration tests. NetlyDB does not yet publish performance or scale figures; they will be published once they are measured and certified.