From the durable-effect architecture study, 2026-07-24. Deferred future-proofing, not needed today.
What
Add one additive conditional-write verb to wit/nexum-host/local-store.wit: swap(key, expected: option<list<u8>>, new: option<list<u8>>) -> result<bool, fault>, implemented inside the single begin_write that set already opens in crates/nexum-runtime/src/host/local_store_redb.rs.
Why not now
The study found atomicity buys nothing under the current model: redb is single-process (Database::create refuses a second opener) and dispatch is single-actor serialized, so there is no read-modify-write race for a CAS to win. The reserve/commit/release SDK wrapper composes plain verbs and is sufficient. Build this only if the single-actor dispatch or single-process invariant ever weakens.
Constraints when it is built
Reuse the entry_cost and counter quota discipline exactly: mutate the counter after commit, on the landed branch only, or the quota drifts. The SDK trait method must bind directly in every WitBindgenHost adapter, never via a non-atomic default body that would ship into production. Track a separate multi-key batch verb for WatchSet::remove, which wants ordered multi-delete atomicity, a distinct primitive.
Sequencing
A WIT edit fans into three repos after the M5 carve (a coordinated nexum:host bump across nexum-runtime, videre-nexum-module and shepherd). If ever pursued, land before the carve or not until a real multi-writer or multi-process need appears.
Acceptance criteria
Deferred. This issue is the record of the decision and the design, to be actioned only on a demonstrated need.
What
Add one additive conditional-write verb to
wit/nexum-host/local-store.wit:swap(key, expected: option<list<u8>>, new: option<list<u8>>) -> result<bool, fault>, implemented inside the singlebegin_writethatsetalready opens incrates/nexum-runtime/src/host/local_store_redb.rs.Why not now
The study found atomicity buys nothing under the current model: redb is single-process (
Database::createrefuses a second opener) and dispatch is single-actor serialized, so there is no read-modify-write race for a CAS to win. The reserve/commit/release SDK wrapper composes plain verbs and is sufficient. Build this only if the single-actor dispatch or single-process invariant ever weakens.Constraints when it is built
Reuse the
entry_costand counter quota discipline exactly: mutate the counter after commit, on the landed branch only, or the quota drifts. The SDK trait method must bind directly in everyWitBindgenHostadapter, never via a non-atomic default body that would ship into production. Track a separate multi-key batch verb forWatchSet::remove, which wants ordered multi-delete atomicity, a distinct primitive.Sequencing
A WIT edit fans into three repos after the M5 carve (a coordinated
nexum:hostbump across nexum-runtime, videre-nexum-module and shepherd). If ever pursued, land before the carve or not until a real multi-writer or multi-process need appears.Acceptance criteria
Deferred. This issue is the record of the decision and the design, to be actioned only on a demonstrated need.