# Unified Search Platform: Roadmap Status: Active Updated: 2026-03-22 Planning Horizon: 2026-03-01 to 2027-02-28 Target Scale: 1B collections, 5 EB raw data (storage + online query) Architecture Invariants: Strict CQRS, shared TSO ordering, S3 as sole durable source of truth, durability-stateless query/ingest execution plane (ephemeral runtime state allowed) with stateful HA control plane This roadmap has two layers: - Delivery governance layer: external commitments, milestone dates, exit criteria, and go/no-go gates. - Implementation decomposition layer: concrete component tracks by phase. - Naming convention: external product name is `Unified Search Platform`; architecture layer name is `Search Fabric`. ## 1. External Commitments (Customer-Facing) - Commitment A (MySQL compatibility): deliver MySQL FULLTEXT SEARCH compatible product capability, including ad-hoc multi-field metadata predicates. Default applicability boundary is `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` unless a phase-scoped addendum explicitly expands it. - Commitment B (Elasticsearch compatibility): deliver Elasticsearch-style Vector + Metadata Hybrid Search compatible product capability. - Commitment C (Hyperscale): improve system scalability to support 1B collections and 5 EB raw data for durable storage and online query. ## 2. Milestone Calendar (Committed Time Nodes) - 2026-03-31: Phase 0 complete (contracts frozen, control-plane onboarding baseline ready). - 2026-05-31: Phase-1 architecture-and-enabling checkpoint complete (accepted Query Gateway / CDC frozen-delivery revisions named + TiDB identity/schema-fencing and integration seams closed + minimum viable write-authority baseline closed + scale-program harness foundation ready). - 2026-06-30: Phase 1 complete (integrated core-architecture delivery for TiDB federated-table integration plus the Phase-1 MySQL FTS Boolean Search Compatibility Profile [Profile 1] and Elasticsearch Core Read/Write Compatibility Profile [Profile 1] slices; external federated identity-provisioning contract, TiDB-side identity verification, first-generation schema fencing, mandatory TiDB-side integration seams, prerequisite harnesses, evaluation assets, minimum viable CCS-backed write-capacity authority for admitted write routes, and pre-validation are complete; query-side RCU admission remains deferred). - 2026-07-31: Phase 2 complete (MySQL FTS Full Query Syntax Compatibility Profile [Profile 2] + Elasticsearch Expanded Query Compatibility Profile [Profile 2] + Commitment A/B public-preview gates passed + preview-grade ingest hardening baseline complete for the public-preview surfaces on the minimum viable CCS-backed write-capacity authority). - 2026-08-31: TiDB private-preview checkpoint complete (TiDB Enhancement Flexible Filtering Index Profile [Profile 1] private-preview gates passed + accepted checkpoint-local private-preview evidence package published). - 2026-08-31: Platform-readiness checkpoint complete (CDC preview-readiness closed + TiDB DDL/schema-sync readiness closed + query/background CCS quota-authority readiness closed + Query Gateway / CDC frozen-contract readiness evidence accepted + RCU design-freeze prerequisite closed for the Phase-3 GA-critical rollout). - 2026-09-15: Phase-3 GA-baseline prerequisite checkpoint complete (production-grade external-truth CDC path closed + RCU foundation closed + formal-verification execution baseline closed for the October external-GA minimum bar). - 2026-09-30: Scalability checkpoint complete (`10^8` logical-table validation evidence closed; this checkpoint is a prerequisite to October GA-readiness validation but is distinct from the October single-collection volume envelope). - 2026-10-15: Phase-3 evidence-freeze checkpoint complete (accepted candidate October artifact families are frozen for closeout use, and only invalidation-triggered or defect-driven reruns may supersede them before the end-of-October dual verdict). - 2026-10-31: Phase 3 closeout date (external GA minimum-bar verdict for Commitment A/B complete + same-date platform-qualification verdict complete + TiDB Enhancement Flexible Filtering Index Profile [Profile 2] GA Readiness gates passed). - 2026-12-15: Phase-4A foundation checkpoint complete (claim matrix frozen + stateful-simulation/scenario foundation closed + certification-critical scale primitives and qualification-package shape frozen before January execution closure). - 2027-01-31: Internal engineering qualification checkpoint complete (scale-out engineering package ready for the 1B collections + 5 EB objective + internal engineering qualification closed + MySQL FTS Full Transaction Semantics Compatibility Profile [Profile 3] phase-scope complete at development-delivery maturity + TiDB Enhancement Profile [Profile 3] MySQL-blocking subset delivered). - 2027-01-31: Post-GA expansion checkpoint complete (Turbopuffer Core Read/Write Compatibility Profile [Profile 1] delivery complete on gated production traffic + post-GA rerank expansion lane complete + TiDB-only multilingual extension tail, if admitted in Phase 4, closed). - 2027-02-28: External scale certification checkpoint complete (partner-facing top-end claim certification closes only after the `2027-01-31` internal engineering qualification checkpoint passes; the same-date post-GA expansion checkpoint is not on this dependency path). ## 2.1 Unified Phase/Checkpoint Profile Matrix (MySQL / Elasticsearch / TiDB Enhancement / Turbopuffer) | Phase / Checkpoint Window | MySQL Compatibility (`docs/compatibility/mysql-fulltext.md`) | Elasticsearch Compatibility (`docs/compatibility/elasticsearch.md`) | TiDB Enhancement (`docs/compatibility/tidb-enhancement.md`) | Turbopuffer Compatibility (`docs/compatibility/turbopuffer.md`) | Delivery Posture | |---|---|---|---|---|---| | Phase 0 (`2026-03-01` ~ `2026-03-31`) | Profile contracts frozen (no customer delivery). | Profile contracts frozen (no customer delivery). | Track contracts frozen (no customer delivery). | Profile contracts frozen (no customer delivery). | Control-plane baseline only. | | Phase 1 (`2026-04-01` ~ `2026-06-30`) | Profile 1 (`Boolean Search Compatibility`) delivered as a Phase-1 acceptance slice. | Profile 1 (`Core Read/Write Compatibility`) delivered as a Phase-1 acceptance slice. | Federated-table write/read integration plus `COLLECTION_TRUTH_MODE_SEARCH_FABRIC` ownership enablement land in this phase outside the Flexible Filtering Index profile track. | Not in delivery window. | Integrated architecture and federated SQL foundation; the `2026-05-31` internal architecture/enabling checkpoint closes owner-freeze and seam work before the `2026-06-30` integrated-delivery close; minimum viable CCS-backed write-capacity authority lands for admitted write routes; `10^8`-scale validation continues into the September checkpoint; query-side RCU admission is explicitly deferred; execution assumes explicit parallel workstreams for shared substrate, external-truth delivery, Search-Fabric-truth delivery, and bootstrap/evidence closure rather than one serial team. | | Phase 2 (`2026-07-01` ~ `2026-07-31`) | Profile 2 (`Full Query Syntax Compatibility`) public preview expansion. | Profile 2 (`Expanded Query Compatibility`) public preview expansion. | Public-preview milestone decoupled from this track; TiDB private preview closes on the same-date `2026-08-31` private-preview checkpoint instead of the July public-preview milestone. | Not in delivery window. | Public-preview surface expansion plus ingest/runbook hardening for the public-preview audience only. | | Checkpoint Window (`2026-08-01` ~ `2026-08-31`) | No new MySQL profile; public-preview surfaces stay on the already-closed July milestone. | No new Elasticsearch profile; public-preview surfaces stay on the already-closed July milestone. | Profile 1 (`Flexible Filtering Index`) private-preview checkpoint closes on its own evidence package. | Not in delivery window. | Same-date dual closure: one TiDB private-preview checkpoint plus one separate platform-readiness checkpoint for Phase-3 prerequisites. | | Phase 3 (`2026-09-01` ~ `2026-10-31`) | Profile 1/2 external GA minimum-bar hardening and production-readiness validation. | Profile 1/2 external GA minimum-bar hardening and production-readiness validation. | Profile 2 (`Flexible Filtering Index`) GA Readiness after the `2026-08-31` Profile-1 private-preview checkpoint. | Not in the Commitment-A/B GA-critical window. | Two September closures and one mid-October evidence freeze precede one October same-date dual verdict: `2026-09-15` GA-baseline prerequisites, `2026-09-30` scalability checkpoint, `2026-10-15` evidence-freeze/rerun-buffer checkpoint, then `2026-10-31` external-GA minimum bar plus same-date platform qualification. | | Phase 4A (`2026-11-01` ~ `2027-01-31`, internal qualification critical path) | Profile 3 (`Full Transaction Semantics Compatibility`) phase-scope complete at development-delivery maturity (not GA Readiness in this phase). | No new profile committed; any Profile 1/2 hardening in this window is same-window continuation unless the accepted Phase-4A claim matrix explicitly promotes a regression-blocking subset. | Profile 3 MySQL-blocking subset (table-level stopword/tokenizer config, CJK hardening, and partitioned-table support) delivered for MySQL Profile-3 handoff. | Not on the internal-qualification critical path. | Scale-out engineering and internal engineering qualification; `2026-12-15` closes the certification-critical foundation package, and only the remaining claim-matrix-labeled execution/measurement closure is checkpoint-closing on `2027-01-31`. | | Phase 4B (`2026-11-01` ~ `2027-01-31`, post-GA expansion lane) | No new MySQL compatibility profile. | No new Elasticsearch profile. | TiDB-only multilingual extension tail (for example Myanmar analyzer support), if admitted in Phase 4, closes here and is not a prerequisite for MySQL Profile 3. | Profile 1 (`Core Read/Write Compatibility` subset in Sections `3` to `6`) delivery on gated production traffic. | Post-GA expansion work stays off the external-certification dependency path even when it closes on the same date as Phase 4A. | ## 2.2 Critical Path Snapshot ```text Phase 0 contract freeze -> 2026-05-31 Phase-1 architecture-and-enabling checkpoint (Query Gateway / CDC freeze + TiDB seams + write-authority baseline + harness foundation) -> Phase 1 integrated delivery (integrated MySQL/Elasticsearch slices + semantic/hybrid subset + CDC preview evidence + pre-validation assets) -> Phase 2 public preview (MySQL/Elasticsearch Profile 2 + preview ingest hardening + public-preview workload/evidence closure) -> 2026-08-31 platform-readiness checkpoint (CDC preview-readiness + TiDB DDL/schema-sync readiness + query/background quota authority + RCU design freeze) -> 2026-09-15 GA-baseline prerequisite checkpoint (RCU production foundation + first production-grade external-truth CDC path + executed formal-verification baseline) -> 2026-09-30 scalability checkpoint (`10^8` logical-table evidence closure) -> 2026-10-15 evidence-freeze checkpoint (accepted candidate October artifact families frozen + rerun buffer preserved) -> 2026-10-31 GA Readiness (external GA minimum bar + same-date platform qualification) -> 2026-12-15 Phase-4A foundation checkpoint (claim matrix freeze + simulation/scenario foundation + qualification-package shape freeze) -> 2027-01-31 internal engineering qualification checkpoint (planning envelope + certification-feeding qualification evidence + MySQL-blocking Phase-4 semantics) -> 2027-02-28 external certification (partner-facing top-end claim checkpoint) Side branches that share dates but do not redefine the main critical path: + 2026-08-31 TiDB private-preview checkpoint (not part of the July public-preview path and not part of the Commitment-A/B October GA minimum bar, but still a parallel prerequisite for TiDB Profile-2 GA Readiness and therefore for full `2026-10-31` phase completion) + 2027-01-31 post-GA expansion checkpoint (Turbopuffer + rerank + TiDB-only multilingual tail; not a prerequisite for external certification) ``` ## 2.3 Time-Node Minimum-Bar Summary | Time Node | Closure Type | Minimum Bar | Same-Date / Parallel Lanes | Required Artifact Families / Frozen Owners | Explicitly Non-Blocking | |---|---|---|---|---|---| | `2026-03-31` | Delivery milestone | contracts frozen + onboarding baseline ready | none | contract set + release-gate checklist | customer traffic | | `2026-05-31` | Internal checkpoint | Query Gateway / CDC frozen revisions + TiDB enabling seams + write-authority baseline + scale-program harness foundation | inside Phase 1 only | accepted frozen owner revisions + enabling-checkpoint record | June-only integrated-delivery evidence | | `2026-06-30` | Delivery milestone | integrated Phase-1 MySQL/ES slices + federated read/write + semantic/hybrid subset + CDC preview evidence + pre-validation | bootstrap/evidence lane remains explicitly tagged | Phase-1 workload bundle + benchmark bundle + accepted closeout record naming frozen owner revisions | later `10^8` execution work | | `2026-07-31` | Delivery milestone | MySQL/ES public-preview surface + preview ingest hardening | none | Phase-2 workload bundle + accepted closeout record | TiDB private preview, platform readiness | | `2026-08-31` | Internal checkpoint | TiDB Profile-1 private preview | same-date platform-readiness checkpoint | TiDB private-preview workload bundle + accepted checkpoint record | July public-preview closure | | `2026-08-31` | Internal checkpoint | platform-readiness prerequisites for Phase 3 | same-date TiDB private preview | specialized platform-readiness closeout package + frozen Query Gateway / Background Governance / CDC revisions | TiDB private-preview economics | | `2026-09-15` | Internal checkpoint | external-GA baseline prerequisites: production-grade CDC path + RCU foundation + executed formal-verification baseline | same-month `10^8` checkpoint prep/close | accepted GA-baseline prerequisite record | October-only hardening and qualification work | | `2026-09-30` | Specialized checkpoint | final `10^8` logical-table closure | same-month GA-baseline lane already closed | scalability-checkpoint package + accepted August precheck artifact set | October single-collection validation | | `2026-10-15` | Internal checkpoint | accepted candidate October artifact families frozen + rerun buffer preserved | same-month end-of-October dual verdict still open | evidence-freeze package naming candidate October artifacts | net-new October feature scope | | `2026-10-31` | Same-date dual verdict | external GA minimum bar for Commitment A/B + platform qualification verdict | one date, two explicit verdicts | multi-tenant workload bundle + benchmark bundle + single-collection package + comparison-group artifacts as required | Phase-4A / 4B expansion work | | `2026-12-15` | Internal checkpoint | claim matrix freeze + simulation/scenario foundation + certification-critical primitive closure | January execution/measurement lane remains open | Phase-4A foundation package + frozen claim-matrix baseline | same-window continuation work and final January measurements | | `2027-01-31` | Certification-feeding checkpoint | claim-matrix-labeled internal qualification subset only | same-date post-GA expansion checkpoint | internal qualification package + accepted claim matrix | same-window continuation work not promoted into claim matrix | | `2027-01-31` | Expansion checkpoint | Turbopuffer / rerank / TiDB-only multilingual tail | same-date Phase-4A qualification checkpoint | post-GA expansion closeout package + fresh benchmark/workload evidence when retrieval-affecting | external certification | | `2027-02-28` | Certification checkpoint | partner-facing certification only after accepted `2027-01-31` qualification package is frozen | none | certification package cross-referencing accepted internal qualification package | same-date January expansion checkpoint | ## 2.4 Execution Baseline Assumptions This roadmap is written against the current contract-first repository state rather than against an already-running production codebase. Execution assumptions: - the checked-in repository baseline is still pre-runtime bootstrap on the implementation axis: current Rust/Go workspace roots and test trees establish ownership/layout, but they do not yet constitute runnable production services, generated clients, or milestone-closing suites by themselves; - Phase 1 therefore assumes explicit concurrent bootstrap workstreams for: - runtime/service skeleton bring-up across the declared query/ingest/control/stateful/background modules, - integration/performance/chaos harness bring-up for the milestone/checkpoint evidence families, - compatibility/conformance harness bring-up for the phase-bound profile commitments, - and ordinary feature-delivery work on top of those foundations; - if those bootstrap assumptions are not met early in Phase 1, dates MUST be re-baselined explicitly rather than silently absorbing bootstrap delay into downstream milestone closure; - first-half closeout records MUST state whether they depend on newly closed bootstrap foundations or on previously accepted bootstrap assets, so the plan remains auditable from the actual repository baseline. ## 3. Execution Strategy and Non-Negotiables - Prioritize customer commitments first, then subsystem purity. - Terminology guardrail: `Profile` defines capability boundary and test scope; `Milestone`/`Phase` define time commitment and go/no-go gates. - Maturity guardrail: `complete` means declared phase-scope gates are satisfied; it does not imply GA Readiness unless explicitly labeled `GA Readiness`. - Execution-baseline guardrail: this roadmap assumes a contract-first but still pre-runtime repository baseline. Dates are admissible only if runtime/bootstrap, test-harness, and conformance-harness workstreams are staffed explicitly rather than being treated as invisible background work. - MySQL compatibility boundary guardrail: roadmap commitments for MySQL profiles are normative for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` unless explicitly expanded in a phase-scoped addendum. - Commitment-A decomposition guardrail: MySQL-compatible FTS syntax/semantic/transaction behavior is governed by `docs/compatibility/mysql-fulltext.md`, while ad-hoc multi-field metadata predicate acceleration is governed by `docs/compatibility/tidb-enhancement.md` (`Flexible Filtering Index` track) in the same canonical applicability mode. - Commitment-A phase-boundary guardrail: Phase 1 delivers the MySQL Boolean Search slice plus the TiDB federated-table write/read foundation and the metadata retrieval path required for federated SQL. Profile-scoped indexed acceleration for ad-hoc multi-field predicate execution remains governed by `docs/compatibility/tidb-enhancement.md` starting at the `2026-08-31` TiDB private-preview checkpoint (Profile 1) and continuing with Phase-3 Profile-2 GA Readiness. - Public/private preview decoupling guardrail: the customer-facing `2026-07-31` public-preview milestone MUST NOT be blocked by the separate TiDB private-preview track; same-date internal closure for that track is handled by the dedicated `2026-08-31` TiDB private-preview checkpoint, while the distinct `2026-08-31` platform-readiness checkpoint closes Phase-3 prerequisites. - Preview-write authority guardrail: any admitted write-capable preview surface MUST close minimum viable CCS-backed write-capacity authority before the preview milestone that exposes it; this baseline is intentionally narrower than the later query/background quota-authority readiness checkpoint. - Phase-1 isolation guardrail: query-side RCU admission control is explicitly out of scope for Phase 1 and is deferred to later hardening cycles. Phase 1 may still close minimum viable CCS-backed write-capacity authority plus interim non-RCU isolation controls needed to protect shared infrastructure during engineering acceptance. - Phase-1 parallel-workstream guardrail: Phase 1 is executable only as an explicit multi-workstream program. At minimum it MUST track `shared substrate`, `external-truth delivery`, `Search-Fabric-truth delivery`, and `bootstrap/evidence` workstreams separately rather than implying one serial implementation lane. - Phase-1 governance-lane guardrail: Phase 1 MUST keep three internal lanes explicit in governance review: `architecture-freeze lane`, `blocking integrated-delivery lane`, and `bootstrap/evidence lane`. Query Gateway and CDC Adapter freeze work MUST close before dependent delivery/evidence lines may claim closure, and bootstrap work for later checkpoints MUST NOT silently widen the `2026-06-30` minimum bar. - Phase-1 architecture/enabling-checkpoint guardrail: the `2026-05-31` internal checkpoint closes accepted Query Gateway / CDC owner revisions plus enabling seams before the `2026-06-30` milestone. The June milestone may consume that closure, but it MUST NOT silently reopen architecture-freeze scope except through an explicit accepted replacement revision. - Phase-3 checkpoint-priority guardrail: the August scalability-precheck artifact set is a hard prerequisite to the September final checkpoint run. If that artifact set is incomplete when September starts, checkpoint-closing work takes priority and October-only hardening work MUST yield rather than jeopardizing the `2026-09-30` checkpoint. - Phase-3 dual-September guardrail: the `2026-09-15` GA-baseline prerequisite checkpoint closes production-grade CDC, RCU-baseline, and executed formal-verification-baseline work; the `2026-09-30` scalability checkpoint closes cardinality evidence. They may share preparatory assets, but they MUST publish distinct closeout records and MUST NOT be treated as one undifferentiated September gate. - Phase-3 evidence-freeze guardrail: the `2026-10-15` checkpoint freezes one accepted candidate set for each required October artifact family. After that checkpoint, only invalidation-triggered reruns or defect-driven reruns may supersede those candidates before the `2026-10-31` closeout. - Phase-3 October-hardening guardrail: the October validation month is for GA hardening and validation of already-closed production-path prerequisites. The first production-grade external-truth CDC synchronization lane MUST close before the October validation month begins and MUST NOT use October as its first production closure window. - Phase-3 dual-verdict guardrail: the `2026-10-31` closeout date MUST publish one explicit `external GA minimum-bar` verdict and one explicit same-date `platform qualification` verdict. The roadmap may require both for full Phase-3 closeout, but it MUST NOT hide their different dependency and evidence shapes behind one undifferentiated verdict. - Phase-3 split-outcome guardrail: the roadmap MUST define the release disposition for each October verdict combination (`pass/pass`, `pass/fail`, `fail/pass`, `fail/fail`) so audit clarity also yields executable release governance. - Phase-3 critical-path guardrail: net-new retrieval-affecting surfaces that are not required for Commitment A/B October GA closure (currently Turbopuffer Profile 1 delivery and the two-stage rerank expansion lane) MUST remain off the `2026-10-31` critical path and MUST NOT be prerequisites for the October GA-readiness verdict. - Phase-4 critical-path guardrail: the `2027-01-31` internal engineering qualification checkpoint is the only Phase-4 node that may gate `2027-02-28` external certification; same-date post-GA expansion closure MUST NOT become an implicit certification prerequisite. - Phase-4A foundation-checkpoint guardrail: the certification-critical foundation package (claim matrix, simulation/scenario foundation, and mandatory scale primitives) MUST close before January final qualification execution begins. The `2027-01-31` checkpoint closes final measurement/qualification on top of that foundation; it is not the first time those foundations are reviewed. - Phase-4A claim-matrix guardrail: only claim-matrix-labeled checkpoint-closing items may block the `2027-01-31` internal engineering qualification checkpoint. Same-window engineering continuation work MAY land in the same window, but it MUST NOT silently expand the certification-feeding minimum bar unless explicitly promoted into the accepted claim matrix. - Phase-4A narrowing guardrail: by default, only claim-bearing scale primitives, mandatory Scenario A/B evidence, MySQL Profile-3 work, the TiDB MySQL-blocking subset, and explicitly listed reliability/extrapolation guardrails are checkpoint-closing in Phase 4A. Elasticsearch delivered-scope hardening and broader efficiency tuning are same-window continuation unless the accepted claim matrix explicitly promotes a regression-blocking subset. - Background-governance guardrail: Phase-3 background-governance closure is limited to owner-bound controls named by `docs/governance/background-governance.md`: quota-tier admission, long-tail / whale pool-routing policy, tiered quota enforcement, and predictive scheduling on the background-compute surface. Broader resource-economics strategy not bound to an owner document MUST NOT be counted as delivered Phase-3 scope, and no roadmap gate may close against that scope without naming an accepted frozen owner-document revision. - Evidence reuse / invalidation guardrail: every milestone/checkpoint closeout MUST declare which accepted artifact families are reused from prior nodes, which are fresh for the current node, and which policy/configuration changes would invalidate reuse. A reused artifact family becomes inadmissible as soon as `docs/testing/roadmap-workload-bundles.md` or `docs/testing/search-quality-evaluation.md` says the underlying behavior changed materially. - Elasticsearch compatibility boundary guardrail: roadmap commitments for Elasticsearch profiles (read + write) are normative for collections whose authoritative descriptor declares `collection_truth_mode=COLLECTION_TRUTH_MODE_SEARCH_FABRIC`. For `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL`, write compatibility is out of scope and MUST be rejected by ownership policy, and any read/query exposure is non-normative unless explicitly expanded in a phase-scoped addendum. - TiDB-enhancement boundary guardrail: roadmap commitments for TiDB enhancement profiles are normative for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` unless explicitly expanded by a phase-scoped addendum. - Error-code governance guardrail: canonical `SF_*` error-code definitions are centralized in `docs/specs/core/error-codes.md` (source of truth); profile specs may define scenario-to-code mapping only. - Addendum governance guardrail: any phase-scoped scope expansion MUST follow Section `3.1`; otherwise it is non-normative and MUST NOT enter phase/profile acceptance. - Keep the CQRS boundary strict: command-side durability and query-side visibility are separated and joined by ordered publish. - Treat S3 as the only durable data source; local disks/NVMe are cache only. - Keep shared `commit_ts` / `read_ts` semantics across metadata and semantic paths. - Enforce control-plane-first rollout: no customer preview traffic before policy/onboarding baseline is operational. - Use functional + reliability + economics gates for every delivery milestone, and explicit checkpoint-specific gate/evidence models for specialized scalability and certification checkpoints. ## 3.1 Phase-Scoped Addendum Governance (Normative) Any phase-scoped addendum that expands default profile applicability/scope MUST satisfy all requirements below: - Approval authority: architecture owner + affected profile owner + release/governance owner. - Publication location: `docs/addenda/--.md` with immutable review date and approvers. - Required content: - exact scope delta (`included` / `excluded`) and affected `collection_truth_mode` values; - effective phase window (absolute dates); - conformance-suite delta (new/changed tests and acceptance gates); - rollback/sunset rule (when the addendum expires or is folded into base spec). - Traceability: - the addendum MUST be linked from `docs/governance/roadmap.md` milestone/gate entries and each affected profile spec; - behavior not linked through this process is non-normative and MUST NOT be counted as delivered scope. ## 3.2 Milestone and Checkpoint Evidence Governance (Normative) Delivery-milestone economics and throughput gates MUST be closed on the explicitly declared milestone-closing workload bundle set defined by `docs/testing/roadmap-workload-bundles.md`. The `2026-08-31` TiDB private-preview checkpoint also reuses that workload-bundle model for its economics gate. The `2026-08-31` platform-readiness checkpoint, the `2026-09-30` scalability checkpoint, the `2026-10-15` evidence-freeze checkpoint, the October single-collection validation package inside the `2026-10-31` GA milestone, the `2026-12-15` Phase-4A foundation checkpoint, the `2027-01-31` internal engineering qualification checkpoint, the `2027-01-31` post-GA expansion checkpoint, and the `2027-02-28` certification checkpoint close on specialized checkpoint/evidence packages when this roadmap says so explicitly. Normative rules: - every declared milestone-closing workload bundle MUST publish one immutable manifest, environment summary, cache/warm-up policy, sample-window definition, and raw result artifact set; - every milestone or checkpoint closeout MUST publish one accepted evidence record naming the accepted workload `bundle_id` set, benchmark-bundle version(s), comparison-group identifier(s) when applicable, any accepted checkpoint-package identifier, any frozen owner-document revision required by the gate, and any superseded run/package identifiers that were not accepted for closure; - throughput/latency values MUST come from the corresponding declared milestone-closing workload bundle, not from ad-hoc spot measurements; - normalized query cost MUST be reported using Query Gateway `RCU_estimated` plus Query Broker `object-store touches` from successful-query execution stats; - where a delivery milestone contains multiple profile lines, profile-scoped economics closure uses the metric subset exercised by that profile's declared workload bundle; if closure would otherwise require multiple distinct bundle families, the roadmap MUST either split them into separate milestones/checkpoints or declare an explicit aggregate closure rule for that milestone; - if admission policy, routing policy, background-governance state, or other gate-bearing economics behavior changes materially after an accepted workload run and before milestone close, the affected gate MUST publish fresh admissible evidence rather than silently reusing the older run; - specialized checkpoints such as the `2026-08-31` platform-readiness checkpoint, the `2026-09-30` scalability checkpoint, the `2026-10-15` evidence-freeze checkpoint, the October single-collection validation package, the `2026-12-15` Phase-4A foundation checkpoint, the `2027-01-31` internal engineering qualification checkpoint, the `2027-01-31` post-GA expansion checkpoint, and the `2027-02-28` certification checkpoint MUST publish the checkpoint-specific evidence package declared for them and MUST NOT be treated as implicit single-bundle economics milestones; - Phase 2 shadow metering is admissible for auditability and does not require the full Phase-3 distributed token-bucket enforcement path to be active. ### 3.2.1 Artifact Reuse and Invalidation Matrix (Normative) | Artifact Family | First Closing Node | Reusable For | Mandatory Refresh / Invalidation Triggers | Non-Substitutable Boundaries | |---|---|---|---|---| | milestone-closing workload bundle | the milestone that accepted it | later audit context or same-family economics comparison only when bundle rules still match | any admission-policy, routing-policy, background-work, predictive-scheduling, quota, or other gate-bearing economics change declared material by `docs/testing/roadmap-workload-bundles.md` | cannot replace specialized checkpoint packages or benchmark bundles | | benchmark bundle | the milestone/checkpoint that accepted it | later retrieval-quality comparison until a fresh bundle is required by retrieval-affecting change control | any material route/planner/rerank/analyzer/embedding or other retrieval-affecting behavior change declared by `docs/testing/search-quality-evaluation.md` | cannot replace workload bundles or specialized checkpoint packages | | accepted August precheck artifact set | `2026-08-31` scalability-precheck lane | only the `2026-09-30` scalability checkpoint close | harness, instrumentation, gateway-resolution, CCS-watermark, or ramp-shape changes that make the staged-ramp evidence a materially different experiment | cannot close October single-collection validation or multi-tenant economics | | `2026-09-15` GA-baseline prerequisite package | `2026-09-15` | October external-GA and platform-qualification audit context | any material change to the production CDC path, RCU-baseline behavior, or formal-verification execution assumptions after acceptance | cannot replace the `2026-09-30` scalability package or October workload/package families | | scalability-checkpoint package | `2026-09-30` | October audit context for cardinality-preparedness only | any material checkpoint-environment or threshold-affecting behavior change before October close | cannot replace the October single-collection validation package or the Phase-3 multi-tenant workload bundle | | `2026-10-15` evidence-freeze package | `2026-10-15` | `2026-10-31` verdict preparation and audit context only when explicitly named by the closeout record | any invalidation-trigger or defect-driven rerun that supersedes one of the frozen candidate artifact families | does not itself close the October dual verdict | | `2026-12-15` Phase-4A foundation package | `2026-12-15` | `2027-01-31` qualification entry and evidence reuse only | any claim-matrix, simulation-foundation, or primitive-readiness mutation after acceptance is prohibited unless the checkpoint is formally re-opened | does not replace the `2027-01-31` internal qualification package | | internal engineering qualification package | `2027-01-31` | `2027-02-28` certification entry and evidence reuse | any threshold, claim-matrix, or accepted-package mutation after checkpoint close is prohibited; certification may only reference the frozen accepted package set | cannot be reopened or relaxed by the same-date Phase-4B expansion checkpoint | ## 3.3 Economics Envelopes (Normative) ### Phase-1 Engineering-Validation Envelope (`2026-06-30`) - federated write throughput `QPS >= 100` - federated / projected read throughput `QPS >= 200` - federated write `P99 <= 150 ms` - metadata query `P99 <= 50 ms` - Query Gateway `RCU_estimated` `P95 <= 120` per successful query - Query Broker `object-store touches` `P95 <= 16` per successful query ### Phase-2 Public-Preview Envelope (`2026-07-31`, MySQL / Elasticsearch preview surfaces) - hybrid-search throughput `QPS >= 1000` - semantic search `P95 <= 300 ms` - hybrid search `P95 <= 700 ms` - metadata search `P99 <= 80 ms` - Query Gateway `RCU_estimated` `P95 <= 250` per successful query - Query Broker `object-store touches` `P95 <= 32` per successful query ### TiDB Private-Preview Envelope (`2026-08-31`, TiDB Enhancement Profile 1 preview surfaces) - federated / projected query throughput `QPS >= 200` - federated / projected query `P95 <= 400 ms` - metadata search `P99 <= 80 ms` - Query Gateway `RCU_estimated` `P95 <= 180` per successful query - Query Broker `object-store touches` `P95 <= 24` per successful query ### Phase-3 Multi-Tenant GA-Readiness Envelope (`2026-10-31`) - representative multi-tenant mixed-query throughput `QPS >= 3000` - metadata search `P99 <= 80 ms` - semantic search `P95 <= 250 ms` - hybrid search `P95 <= 600 ms` - Query Gateway `RCU_estimated` `P95 <= 320` per successful query - Query Broker `object-store touches` `P95 <= 40` per successful query - similarly provisioned tenants in the same quota tier MUST stay within `20%` admitted-throughput skew across the steady-state sample windows defined by `docs/testing/roadmap-workload-bundles.md` ### Phase-4 Planning / Scale-Out Envelope (`2027-01-31`) - capacity-model forecast error for shard/node/storage planning `<= 20%` against the mandatory internal qualification scenarios - extrapolated cost-performance confidence interval width `<= 30%` of the projected mean at the final accepted planning point - no planning metric required by the internal qualification gate may regress by more than `15%` between adjacent internal scale points without an explicit derated acceptance note in the evidence package Phase-3 single-collection quantitative envelope remains governed by Section `6.6`. ## 3.4 October Split-Verdict Disposition Policy (Normative) The `2026-10-31` closeout publishes two explicit verdicts because they carry different release consequences. | External GA Minimum Bar | Platform Qualification | Release / Claim Disposition | Required Follow-Up | |---|---|---|---| | pass | pass | Full Commitment-A/B GA launch is admissible; platform-qualification and top-end platform claims may be used according to the accepted verdict records. | Phase 4 may treat both October verdicts as closed inputs. | | pass | fail | Customer-facing Commitment-A/B GA launch is admissible only for the external-GA minimum-bar claim set. Platform-qualification, single-collection envelope, and any top-end platform-economics claims remain withheld. | Publish a corrective qualification plan; later checkpoints may reuse only the still-admissible external-GA artifact families. | | fail | pass | No external GA launch is admissible. Platform-qualification evidence may be retained as internal qualification input only if the accepted verdict record proves it is still admissible after the required external-GA remediation. | Re-open the failed external-GA minimum-bar items and reissue the closeout train before any launch claim. | | fail | fail | No external launch or qualification claim is admissible. | Re-baseline the closeout train and regenerate the invalidated artifact families before retry. | ## 4. Phase Plan (Implementation Decomposition + Exit Criteria) ### Phase 0 (2026-03-01 to 2026-03-31): Architecture Contracts and Control-Plane Baseline Goal: - Freeze interface/data contracts and establish onboarding-critical control-plane baseline. Implementation scope: - Freeze S3 object layout and naming (data objects, WAL chunks, checkpoints, manifests, catalogs). - Freeze canonical write envelope (`namespace_id`, `collection_id`, `stream_identity`, `batch_id`, `source_seq`, `doc_id`, `modality_mask`, `commit_ts`). - Freeze control-plane RPC/API contracts (`Commit Coordinator`, `Visibility Barrier`, `Manifest Publisher`, `Catalog Control Service` interactions). - Freeze external API profiles for ingest/query gateways (MySQL FTS, Elasticsearch-style hybrid scope, and Turbopuffer Profile-1 subset contracts) plus TiDB-enhancement track contracts. - Freeze and publish canonical `SF_*` error-code registry (`docs/specs/core/error-codes.md`) as a Phase-0 contract artifact for all profile mappings. - Deliver baseline tenant onboarding controls: provisioning, authz integration, policy attribution, quota/feature flags, audit trail, kill switch. Exit criteria: - Functional: all contracts (including `docs/specs/core/error-codes.md` canonical `SF_*` registry) published and accepted; compatibility harness baselined in CI/nightly. - Reliability: rollback policy and release gate checklist defined; control-plane policy checks enforceable before serving traffic. - Economics: baseline quota/admission knobs and observability are in place for pilot cost control. ### Phase 1 (2026-04-01 to 2026-06-30): Integrated Core Architecture and Federated TiDB Foundation Goal: - Establish the core architecture and deliver TiDB federated-table integration together with the Phase-1 MySQL/Elasticsearch compatibility slices, using the `2026-05-31` internal architecture/enabling checkpoint to remove owner-freeze and enabling-seam risk from the final `2026-06-30` close while starting the `10^8` logical-table validation program that completes at the September checkpoint. Implementation scope: - Scope guardrail: - Query-side RCU admission control is excluded from this phase and deferred to later hardening cycles. - Minimum viable CCS-backed write-capacity authority for admitted write routes is in scope in this phase; it is a narrower baseline than the later query/background quota-authority readiness checkpoint. - Interim tenant isolation in this phase is limited to that write-capacity baseline plus static connection limits, quota rails, and other non-RCU controls required for engineering acceptance. - Program workstreams inside Phase 1: - `Shared substrate workstream`: Query Gateway, CCS-backed admission/resolution seams, semantic/hybrid retrieval substrate, and common control/query infrastructure consumed by both truth-mode families. - `External-truth workstream`: TiDB federated query/readiness path, CDC readiness/evidence, and the `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` Commitment-A path. - `Search-Fabric-truth workstream`: Search-Fabric-owned write/read foundation for the `collection_truth_mode=COLLECTION_TRUTH_MODE_SEARCH_FABRIC` Commitment-B path and the TiDB federated-table route subset that depends on that ownership mode. - `Bootstrap/evidence workstream`: runtime skeleton bring-up, milestone/checkpoint harnesses, and later `10^8`-program precheck assets. - Governance split inside Phase 1: - `Architecture-freeze lane` (hard prerequisite to dependent delivery): the Query Gateway owner contract MUST freeze before federated-read/optimizer delivery may claim closure, and the CDC Adapter owner contract MUST freeze before CDC preview evidence or any later external-truth synchronization lane may claim closure. - `Blocking integrated-delivery lane`: federated write/read, TiDB seams, minimum viable write authority, MySQL/Elasticsearch Profile-1 slices, and the declared semantic/hybrid retrieval subset form the minimum integrated-delivery bar for `2026-06-30`. - `Bootstrap/evidence lane`: `10^8` harnesses, pre-validation assets, and preview-scope CDC evidence prepare later checkpoints but MUST remain explicitly tagged as later-path bootstrap work rather than silently widening the Phase-1 minimum bar. #### Phase 1.1 (April 2026): Ingest, Federated Write, and Storage Scalability - Goal: - Establish the write path from TiDB or native callers to S3, close the external federated-identity provisioning contract, TiDB-side identity verification, and schema-fencing prerequisites, and build the harnesses required for the later staged scale ramp. - Weeks 1-2: - Deliver `Catalog Control Service (CCS)` metadata ownership for `COLLECTION_TRUTH_MODE_SEARCH_FABRIC` so federated tables can be Search-Fabric-truth collections. - Deliver the external control-plane provisioning contract plus TiDB-side verification flow for pre-provisioned Search-Fabric-truth namespace / collection identities; TiDB query/write/DDL callers resolve and validate these identities but MUST NOT create them through `PutNamespaceMetadata` / `PutCollectionMetadata`. - Deliver first-generation schema-fencing support for pre-provisioned federated collections through authoritative `PutCollectionSchema` apply with generation fencing. - Define and implement the TiDB Remote DML entry point that lowers direct `INSERT` requests into `Ingest Gateway`. - Deliver the mandatory TiDB-side integration layer skeleton for Search Fabric (`pkg/searchfabric/{client,acl,planner,executor,write}` or equivalent ownership split), so planner, executor, DDL, and write paths do not continue to depend on ad-hoc direct integration seams. - Implement S3 prefix sharding based on `hash(collection_id)`. - Deliver the million-prefix stress harness and observability hooks needed for the later staged scale ramps; defer the actual `1,000,000`-prefix validation run to the August-September ramp-up window. - Weeks 3-4: - Deliver `Metadata Stream Writer` for Flow-B federated/native write execution, including canonical `commit_ts` injection and WAL persistence. - Implement `Manifest Publisher` CAS plus `wait_for_visible` so successful federated writes satisfy SQL read-your-write expectations. - Deliver deterministic TiDB remote-DML request shaping and caller-identity stamping for the admitted federated SQL write subset, including replay-stable request IDs, deterministic batch shaping, and canonical client-kind assignment. - Deliver minimum viable CCS-backed write-capacity leasing for Search-Fabric-owned write gateways and the admitted Remote DML route subset, including lease spend, refill, expiry, and unavailable-authority fail-closed behavior; query-side RCU admission remains deferred. - Deliver the zero-payload descriptor-injection harness, but defer the actual multi-million logical-table cardinality runs to the later staged ramp-up window. #### Phase 1.2 (May 2026): Query, Federated Read, and Resolution Optimization - Goal: - Support TiDB federated queries, close optimizer-readiness prerequisites, and harden metadata-resolution behavior needed for the later `10^8` checkpoint. - Weeks 1-2: - Promote the currently proposed `Query Gateway` architecture to a frozen delivery contract covering `RelationalQueryService`, broker readiness serving, `GetCollectionStatistics`, and the Phase-3 RCU admission surface before gateway delivery moves into milestone-critical status. - Deliver `RelationalQueryService.ExecuteProjectedQueryOrFallback` / `ExecutePrimaryQuery` support in `Query Gateway` for TiDB federated-engine snapshot reads. - Deliver `GetCollectionStatistics` so TiDB optimizer/cardinality costing uses canonical Search Fabric statistics rather than readiness or metadata side channels. - Deliver MySQL Boolean Search Compatibility Profile (Profile 1) and the Elasticsearch Core Read/Write subset required by the integrated Phase-1 acceptance scope. - Deliver the mandatory TiDB planner/executor seam and query-request stamping rules for Search Fabric, including dedicated route-kind separation, replay-stable request IDs, and canonical caller identities for projected and primary query RPCs. - Implement tiered gateway resolution caching (`CollectionNameBinding` LRU plus negative cache) so `100M`-table name resolution does not collapse onto S3. - Weeks 3-4: - Implement predicate pushdown in `Query Broker` to reduce metadata retrieval cost for federated SQL. - Deliver the broker readiness lane and visibility-wait integration required for strict / bounded-staleness federated-table reads and the immediate read-after-write acceptance path; `GetCollectionStatistics` remains optimizer-only and does not replace readiness serving. - Promote the currently proposed `CDC Adapter` architecture to a frozen delivery contract covering replay identity, checkpoint semantics, ownership boundary, and exactly-once hardening before June delivery work and later external-truth synchronization consume it as a milestone-critical dependency. - Deliver the `10^8`-scale simulation loaders, latency probes, dashboards, and acceptance thresholds for CCS memory watermarks and `GetCollectionMetadata` P99 `<= 50 ms`; defer the staged descriptor runs themselves to August-September. #### Internal Checkpoint (`2026-05-31`): Phase-1 Architecture and Enabling Foundation - Goal: - Close architecture-freeze and enabling-seam work early enough that June can focus on integrated-delivery closure rather than still carrying unresolved owner-contract risk. - Closeout boundary: - accepted frozen revisions of `docs/architecture/query-gateway.md` and `docs/architecture/cdc-adapter.md` are named; - external federated identity provisioning, TiDB-side identity verification, first-generation schema fencing, and dedicated TiDB planner/executor/write seams are production-closed for the declared Phase-1 route subset; - minimum viable CCS-backed write-capacity authority and the Phase-1 scale-program harness foundation are production-closed for the declared engineering-validation environment; - the accepted enabling-checkpoint record explicitly distinguishes these closed foundations from the June integrated-delivery and bootstrap-evidence closures that still remain. #### Phase 1.3 (June 2026): Multimodal Integration, TiCDC, and Integrated Delivery Closure - Goal: - Integrate semantic search and TiCDC synchronization on top of already-frozen owner contracts, and close the integrated-delivery evidence needed before the later September scalability checkpoint. - Weeks 1-2: - Deliver `Semantic Search Reader` (`SPFresh + RaBitQ`) so vector distance results can be projected as virtual columns in federated tables. - Add hybrid query planning in `Query Broker` for mixed metadata-predicate plus vector-search SQL shapes. - Close the metadata-predicate carrier contract required for pre-filtered ANN path selection in hybrid retrieval (`PK set`, aligned bitmap, and Bloom-filter outputs plus planner-selection rules). - Validate tenant-based static connection limits as the interim isolation control before query-side RCU admission exists. - Deliver the semantic/hybrid search-quality benchmark corpus plus Top-K recall evaluation harness required by the Phase-1 search-quality gate, with normative evaluation rules in `docs/testing/search-quality-evaluation.md`. - Weeks 3-4: - Deliver the preview-scope CDC conformance harness, replay/checkpoint evidence package, and bounded dry-run for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL`; first delivery-critical incremental synchronization moves to Phase 3 after the CDC architecture is frozen and the `2026-08-31` platform-readiness checkpoint closes. - Execute end-to-end pre-validation runs for the September scalability program on representative non-checkpoint scale, including federated write -> immediate federated read and vector ranking. - Publish a Phase-1 completion report covering MySQL/ES Profile-1 scope, federated consistency, search-quality baseline evidence, Query Gateway / CDC architecture-freeze status, and the open `10^8`-scalability workstream status. Exit criteria: - Target date: `2026-06-30`. - Federated capability: - TiDB native SQL `INSERT` via Remote DML and federated `SELECT` are both supported for the declared Phase-1 route subset. - Compatibility: - `docs/compatibility/mysql-fulltext.md` Profile 1 (`Boolean Search Compatibility`) and `docs/compatibility/elasticsearch.md` Profile 1 (`Core Read/Write Compatibility`) both pass their declared Phase-1 conformance slices. - TiDB integration readiness: - the dedicated TiDB-side integration layer, planner/executor seam, deterministic remote-DML shaping, and canonical caller-identity stamping are production-closed for the declared Phase-1 route subset. - Consistency: - federated write-then-read succeeds with immediate visibility after ACK through the `wait_for_visible` path. - Readiness and visibility: - broker readiness serving and visibility waiting are production-closed for the declared strict / bounded-staleness federated read subset. - Semantic/hybrid retrieval: - `Semantic Search Reader`, hybrid query planning, and the metadata-predicate carrier contract for pre-filtered ANN path selection are production-closed for the declared Phase-1 retrieval subset used by the milestone-closing search-quality evidence. - Interim isolation and write admission baseline: - static connection limits, quota rails, and the minimum viable CCS-backed write-capacity authority are validated for the engineering-validation tenant set, and no unresolved blocker remains for Phase-1 shared-infrastructure protection. - CDC preview evidence: - the `CDC Adapter` architecture is frozen, and the preview-scope conformance harness, replay/checkpoint evidence package, and bounded dry-run are complete for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL`. - Economics: - the Phase-1 engineering-validation workload bundle defined by `docs/testing/roadmap-workload-bundles.md` satisfies the Phase-1 envelope declared in Section `3.3`. - Search quality: - `Recall@10 > 90%` for both semantic-search and hybrid-search evaluation cohorts as defined by `docs/testing/search-quality-evaluation.md`, and the milestone publishes the required benchmark-bundle artifact family. - Evidence publication: - the Phase-1 completion report is published with federated consistency, Phase-1 compatibility evidence, search-quality baseline evidence, architecture-freeze status, and the open `10^8`-scalability workstream status. - Internal-checkpoint reuse boundary: - the `2026-05-31` accepted enabling-checkpoint record is referenced by the milestone closeout record, and any later Phase-1 evidence that consumes it explicitly states whether it reuses or supersedes those accepted frozen revisions and enabling artifacts. - Architecture-freeze boundary: - the accepted frozen revisions of `docs/architecture/query-gateway.md` and `docs/architecture/cdc-adapter.md` are named in the closeout record for the delivery surfaces consumed by Phase 1 and later checkpoints. - Bootstrap-boundary rule: - the closeout record explicitly distinguishes already-closed Phase-1 bootstrap assets from later checkpoint-owned execution work in the `10^8` program so the `2026-06-30` milestone does not implicitly absorb later scalability obligations. ### Phase 2 (2026-07-01 to 2026-07-31): Public-Preview Expansion Goal: - Expand the customer-facing preview query surface and close the public-preview hardening needed for the `2026-07-31` external milestone without coupling that close to the separate same-date TiDB private-preview and platform-readiness workstreams. Implementation scope: - Week 1-2: Advanced Query Syntax (Commitment A/B) - Deliver `docs/compatibility/mysql-fulltext.md` Full Query Syntax Compatibility Profile (Profile 2), including full `MATCH ... AGAINST` syntax support for `IN NATURAL LANGUAGE MODE` and `WITH QUERY EXPANSION`. - Deliver `docs/compatibility/elasticsearch.md` Expanded Query Compatibility Profile (Profile 2), including `_count`, `_update_by_query` subset, `_delete_by_query` subset, complex aggregations, highlighting, and the other declared Profile-2 query-surface additions. - Closed loop: run the Profile-2 conformance suites early in the month to get functional feedback before the isolation changes land. - Week 3-4: Public-Preview Release Hardening - Harden observability, rollback drills, and runbooks for the public-preview release posture. - Close the preview-grade ingest-hardening baseline for the admitted public-preview write routes on top of the already-landed minimum viable CCS-backed write-capacity authority, including preview-tier quota configuration, replay/rollback drills, and write-path observability. - Close the public-preview workload-bundle evidence package for the MySQL / Elasticsearch preview surfaces. - Keep the TiDB private-preview line, CDC preview-readiness line, and Phase-3 platform-readiness gates out of this milestone; those close on the dedicated `2026-08-31` checkpoints instead of the public-preview milestone. Exit criteria: - Functional: `docs/compatibility/mysql-fulltext.md` Full Query Syntax Compatibility Profile (Profile 2) conformance suite and `docs/compatibility/elasticsearch.md` Expanded Query Compatibility Profile (Profile 2) conformance suite complete for public-preview scope. - Public-preview ingest hardening: admitted preview write routes are production-closed on the minimum viable CCS-backed write-capacity authority with declared preview-tier quota policy, rollback drills, and observability. - Reliability: replay/failover/chaos suites pass for the expanded public-preview cohorts with no release-blocking defects, and rollback/runbook assets for the public-preview surfaces are complete. - Economics: the public-preview workload bundle declared by `docs/testing/roadmap-workload-bundles.md` satisfies the public-preview envelope in Section `3.3` by `2026-07-31`. ### Checkpoint A (2026-08-01 to 2026-08-31): TiDB Private Preview Goal: - Close the TiDB Enhancement Profile-1 private-preview scope on its own conformance/economics/evidence package without re-coupling that close to the July public-preview milestone or to the separate platform-readiness checkpoint. Implementation scope: - Deliver `docs/compatibility/tidb-enhancement.md` Profile 1 private preview for the Flexible Filtering Index. - Close the TiDB private-preview workload/evidence package separately from both the July public-preview bundle and the same-date platform-readiness checkpoint package. - Publish the accepted private-preview checkpoint record naming the accepted workload bundle and any superseded reruns. Exit criteria: - Functional: `docs/compatibility/tidb-enhancement.md` Profile 1 private-preview conformance gate passes for declared scope. - Reliability: replay/idempotency, failover, and declared private-preview fault-injection checks pass for the preview cohorts with no release-blocking defects. - Economics: the TiDB private-preview workload bundle declared by `docs/testing/roadmap-workload-bundles.md` satisfies the TiDB private-preview envelope in Section `3.3` by `2026-08-31`. ### Checkpoint B (2026-08-01 to 2026-08-31): Platform Readiness Goal: - Close the internal platform-readiness prerequisites that feed the September-October GA-critical work without re-coupling them to either the July public-preview milestone or the same-date TiDB private-preview checkpoint. Implementation scope: - CDC preview-readiness and schema-sync readiness - Close the CDC preview-readiness package for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL`: preview-scope conformance, replay/checkpoint evidence review, cutover rehearsal, and rollback runbook on top of the already-frozen CDC owner contract. - Close the TiDB DDL/schema-sync readiness prerequisite explicitly: search-affecting DDL classification, typed `PutCollectionSchema` / `DropCollection` fencing, persisted DDL session-context capture, and convergence-before-resume behavior are all production-closed for the admitted search-affecting DDL subset. - Query/admission platform readiness - Use the already-frozen `docs/architecture/query-gateway.md` contract as the accepted owner surface for preview/GA-critical readiness closure rather than re-promoting a second freeze event. - Freeze the accepted owner revision of `docs/governance/background-governance.md` for the Phase-3 quota-tier admission, long-tail / whale pool-routing, tiered quota-enforcement, and predictive-scheduling surfaces before the October economics/fairness gates may close. - Freeze the Phase-3 RCU admission design, including estimator inputs, token-bucket leasing model, adaptive-shedding policy, asynchronous reconciliation policy, mid-execution pre-emption policy, and rollout hooks. - Close CCS quota-authority readiness explicitly for the query/background surfaces: private quota-allocation/refill, `quota_epoch` invalidation, retryable-unavailability behavior, and the lease semantics required by Query Gateway and background-governance rollout are production-closed. - Complete formal-verification harness preparation (reference models, scenario matrix, automation plumbing, and ownership sign-off) so September executes prepared model-checking and fault-testing campaigns instead of building them from zero. - Ingest hardening - Harden ingest for later GA-readiness work: establish exactly-once replay guardrails, canonical replay anchors, and idempotent filters for TiCDC-driven ingestion. - Scalability precheck lane (blocking prep for September, but not part of the platform-readiness closeout package) - Execute the deferred smaller-scale prefix and logical-descriptor ramp runs as soon as the Query Gateway freeze, gateway-resolution instrumentation, and CCS watermark instrumentation prerequisites are closed, and publish one accepted August precheck artifact set (`ramp-stage summary`, gateway-resolution telemetry export, CCS watermark export, and referenced harness/instrumentation revisions) so September only needs the final `10^8` checkpoint run plus issue triage rather than the entire staged ramp from zero. - Checkpoint closeout package - Publish one accepted platform-readiness closeout package naming the frozen Query Gateway / Background Governance / CDC contract revisions plus the accepted CDC, DDL/schema-sync, background-governance-readiness, quota-authority, formal-verification-preparation, and RCU design-freeze evidence identifiers. Exit criteria: - Functional: TiDB DDL/schema-sync readiness is production-closed for the admitted search-affecting DDL subset; the accepted Query Gateway and Background Governance owner-contract revisions are named for the preview/GA-critical surfaces; the Phase-3 RCU design freeze is closed. - Reliability: CDC preview-readiness artifacts, replay/checkpoint evidence, cutover rehearsal, rollback/runbook assets, and the platform-readiness closeout package are complete with no release-blocking defects; query/background CCS quota-authority readiness is closed for lease refresh, epoch invalidation, and unavailable-authority behavior. - Evidence publication: the checkpoint publishes the accepted platform-readiness closeout package declared by `docs/testing/roadmap-workload-bundles.md`, including the frozen owner-document revisions and accepted sub-evidence identifiers. ### Phase 3 (2026-09-01 to 2026-10-31): GA Readiness and Production-Readiness Validation Goal: - Close the external-GA minimum bar through two September prerequisite checkpoints, one mid-October evidence-freeze checkpoint, and one October same-date dual verdict: first close the multi-tenant isolation and production CDC baseline, then close the `10^8` logical-table checkpoint, then freeze the candidate October artifact families with real rerun slack preserved, and finally publish separate `external GA minimum-bar` and `platform qualification` verdicts on the `2026-10-31` closeout date while keeping post-GA expansion work off that path. Implementation scope: - September 2026: split prerequisite closure before October - Week 1-2: `2026-09-15` external-GA baseline prerequisite checkpoint - Implement the deferred RCU-aware query-admission foundation on top of the already-closed query/background CCS quota-authority readiness checkpoint: distributed token buckets, whale shielding, estimator refresh, and the admission observability / rollout controls frozen on `2026-08-31`. - Implement compaction/GC admission budgets so query performance is protected by `safe_ts` and GC-lag backpressure. - Execute the already-prepared stateless model-checking campaigns to explore concurrent interleavings and prove linearizability / invariant preservation. - Execute the already-prepared property-based fault-testing campaigns with automated injection for fail-stop crashes and S3 IO errors. - Close the first delivery-critical `CDC Adapter` incremental synchronization path for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` after both the `2026-08-31` platform-readiness checkpoint's CDC preview-readiness gate and the explicit TiDB DDL/schema-sync readiness gate have closed. - Evolve the isolation baseline into quota-tier admission, long-tail / whale pool routing, and tiered quota enforcement on the owner-defined Query Gateway, deployment-routing / pool-assignment, and background-compute surfaces in `docs/governance/background-governance.md`. - Publish one accepted `2026-09-15` GA-baseline prerequisite record naming the accepted production-CDC, RCU-foundation, and executed-formal-verification-baseline evidence identifiers. - Week 3-4: `2026-09-30` scalability checkpoint and October validation preparation - Promote `docs/compatibility/tidb-enhancement.md` Profile 2 (Flexible Filtering Index) to GA Readiness. - Consume the August-completed smaller-scale prefix and logical-descriptor ramp package as the prerequisite evidence base for the checkpoint-close run. - Execute the final `10^8` (`100M`) logical-table scalability checkpoint run plus focused issue triage by `2026-09-30`, including the gateway-resolution and CCS acceptance thresholds prepared in Phase 1. - Complete adaptive shedding, asynchronous estimated-vs-actual reconciliation, and mid-execution pre-emption as the October-validation hardening closure of the same RCU admission system; this lane MUST close by `2026-10-31` but does not block the `2026-09-30` checkpoint. - Closed loop: run full-stack chaos campaigns to verify crash consistency and idempotent recovery before the formal validation month begins. - Conflict-priority rule: - if the accepted August precheck artifact set is incomplete when September begins, the order of work is: `(1)` close missing checkpoint-prerequisite artifacts for the `2026-09-15` and `2026-09-30` September checkpoints, `(2)` preserve the final `10^8` run plus checkpoint evidence package, `(3)` defer October-only hardening work that is not required for the September checkpoints. - October 2026: same-date dual verdict closeout - `2026-10-15` evidence-freeze checkpoint - Publish one accepted evidence-freeze package naming the accepted candidate Phase-3 multi-tenant workload bundle, the accepted candidate October single-collection validation package, the accepted candidate benchmark bundle, and any accepted candidate predictive-scheduling comparison-group artifacts. - Preserve a deliberate rerun buffer after the checkpoint: only invalidation-triggered reruns or defect-driven reruns may supersede the accepted candidate artifacts before the final `2026-10-31` verdict records. - External-GA minimum-bar lane - Use the already-closed `2026-09-15` GA-baseline prerequisite checkpoint plus the `2026-09-30` scalability checkpoint as fixed inputs rather than as unfinished October bring-up work. - Close adaptive shedding, asynchronous estimated-vs-actual reconciliation, and mid-execution pre-emption as the final production hardening of the already-running RCU admission system. - Close rollback/runbook hardening for the already-running delivery-critical external-truth CDC path. - Platform-qualification lane - Operationalize predictive scheduling through background compute autoscaling and predictive compaction logic, with milestone-closing paired A/B evidence proving no unacceptable online-query regression versus the same comparison-group workload bundle with predictive controls disabled. - October 2026: Dedicated Validation Month - Validation scoping rule: - the `2026-09-15` checkpoint closes external-GA baseline prerequisites (RCU foundation, production-grade CDC path, and executed formal-verification baseline). - the `2026-09-30` checkpoint validates catalog/control-plane cardinality and gateway-resolution behavior. - the October scale envelope validates single-collection data volume and serving performance. - the September prerequisite package, the September scalability package, the October external-GA bundle family, and the October platform-qualification package family are all distinct evidence objects even when they close on the same release train. - Validation artifact rule: - the Phase-3 multi-tenant workload bundle, the dedicated October single-collection validation package, the fresh search-quality benchmark bundle, any paired predictive-scheduling comparison group, and the September prerequisite/scalability packages are distinct auditable artifact families; the `2026-10-31` closeout date is incomplete unless every required family is published, cross-referenced, and named in the accepted verdict records. - Validation track: Scale envelope - single-collection target: `15B` rows, `20 TB` metadata, `50 TB` vector. - Validation track: Performance gate - hybrid-search throughput `QPS >= 5000` - semantic search `P95 <= 200 ms` - hybrid search `P95 <= 500 ms` - metadata search `P99 <= 50 ms` - Validation track: Search quality - semantic-only `Recall@10 > 90%` - hybrid `Recall@10 > 90%` - hard-negative hybrid `Recall@10 > 85%` - no Phase-3 gate cohort regresses by more than `2` percentage points versus the most recent accepted milestone-closing bundle unless a refreshed bundle is published under `docs/testing/search-quality-evaluation.md` - Validation track: Correctness gate - model checking proves zero invariant breaks for commit ordering and manifest CAS progression. - Validation track: Reliability gate - zero release-blocking defects during prefix hot-spot and S3 throttling chaos tests. Exit criteria: - External-GA minimum-bar closure: - GA Readiness checklist for Commitment A/B is complete, including mixed customer and TiDB bounded-integration acceptance suites. - Search quality: the Phase-3 GA-Readiness gate defined by `docs/testing/search-quality-evaluation.md` closes on a fresh milestone-closing benchmark bundle, including the hard-negative hybrid cohort; the milestone-closing workload bundle explicitly cross-references that benchmark bundle and states the inclusion/exclusion disposition for every retrieval-affecting route closed by the milestone. - TiDB enhancement GA closure: - `docs/compatibility/tidb-enhancement.md` Profile 2 GA Readiness acceptance suite passes. - External-GA operations and economics closure: - CDC production-path hardening gate: the first delivery-critical `CDC Adapter` incremental synchronization path is already production-closed for the declared `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` scope before October begins, and the October milestone closes only its hardening/rollback/runbook validation rather than the first production-path bring-up. - Query-admission production gate: distributed token buckets, whale shielding, adaptive shedding, asynchronous estimated-vs-actual reconciliation, and mid-execution pre-emption are complete and validated under representative multi-tenant load. - Tenant-isolation governance gate: quota-tier admission, long-tail / whale pool routing, and tiered quota enforcement are complete with their declared milestone evidence on the owner-defined Query Gateway, deployment-routing / pool-assignment, and background-compute surfaces in `docs/governance/background-governance.md`, and the accepted frozen owner-document revision used for this gate is named in the closeout record. - Economics: the Phase-3 multi-tenant GA-Readiness workload bundle defined by `docs/testing/roadmap-workload-bundles.md` satisfies the Phase-3 envelope declared in Section `3.3` by `2026-10-31`. - Same-date platform-qualification closure: - Reliability: the accepted `2026-09-15` executed formal-verification baseline plus October chaos campaigns together show zero invariant breaks for commit ordering / manifest CAS progression and no release-blocking defects under prefix hot-spot and S3 throttling pressure. - Predictive-scheduling qualification gate: predictive scheduling completes with paired comparison-group evidence showing no more than `10%` online-query `P99` regression versus the same milestone-closing comparison-group workload bundle with predictive controls disabled. - Quantitative platform-qualification load envelope (single-collection) is validated through the dedicated October single-collection validation package declared by `docs/testing/roadmap-workload-bundles.md`: - Row count: up to `15B`. - Metadata volume: up to `20 TB`. - Vector data volume: up to `50 TB`. - Hybrid search throughput (sustained): `QPS >= 5000`. - Metadata search latency: `P99 <= 50 ms`. - Semantic search latency: `P95 <= 200 ms`. - Hybrid search latency: `P95 <= 500 ms`. - Evidence publication: - the accepted `external GA minimum-bar` verdict names the accepted multi-tenant workload bundle, fresh benchmark bundle, and any reused September prerequisite/scalability package identifiers it depends on. - the accepted same-date `platform qualification` verdict names the accepted October single-collection validation package, predictive-scheduling comparison-group artifacts, and any reused September prerequisite/scalability package identifiers it depends on. ### Phase 4A (2026-11-01 to 2027-01-31): Scale-Out Engineering and Internal Qualification for 1B Collections and 5 EB Goal: - Complete the scale-out engineering package and the internal engineering qualification required for the 1B collections + 5 EB trajectory, using one `2026-12-15` foundation checkpoint to narrow the final January critical path, and close the MySQL-blocking Phase-4 semantics needed for MySQL Profile 3 without coupling that checkpoint to post-GA expansion work. Implementation scope: - November-December 2026: Certification-critical qualification foundation (blocking lane for the certification-feeding checkpoint) - Build sharded namespace/collection catalog control services and partitioned control-plane ownership. - Scale object-store layout: entropy-sharded prefixes, stream multiplexing, and manifest write-amplification controls. - Build the semantic-storage efficiency tracks required by the accepted Phase-4A claim matrix: compaction/tiering pipelines (RaBitQ + residual), object lifecycle policies, and amplification control. - Deploy the claim-bearing capacity models (`raw_bytes -> indexed_bytes -> durable_s3_bytes -> hot_cache_bytes`) required to justify the planning envelope named in the checkpoint. - Scale and stress the already-established control-plane verification framework for hard-to-scale stateful components (`Commit Coordinator`, `Visibility Barrier`, `Manifest Publisher`, `Catalog Control Service`, `Background Compute Coordinator`) so previously proven correctness properties are regression-checked under Phase-4 cardinality and failure pressure. - Use cardinality-first simulation (`1B` collection/namespace metadata scale with sampled payload) to validate control-plane correctness and queue dynamics without requiring full physical `5 EB` materialization. - Add deterministic fault matrix scenarios in simulation: leader failover storms, network partitions, duplicate/reordered intents, catalog-head lag bursts, WAL replay spikes, and S3 throttling backpressure. - Same-window engineering continuation lane (may close in the same broad window, but MUST NOT widen the `2027-01-31` certification-feeding minimum bar unless explicitly promoted into the accepted Phase-4A claim matrix) - Continue broader semantic-storage efficiency tuning beyond the minimum claim-matrix scope when helpful for long-range economics work. - Promote explicit query routing/partition-filter pushdown (`SearchPayload.routing`) for early partition pruning in large time-window workloads where it materially improves the same-window engineering package, but do not treat it as checkpoint-closing unless the accepted claim matrix says so. - Continue non-claim-bearing large-scale observability refinements in the same window without turning them into hidden qualification blockers. - Continue delivered Elasticsearch Profile 1/2 hardening and scale validation in the same window as audit-only or regression-tracking work unless the accepted Phase-4A claim matrix explicitly promotes a regression-blocking subset into the checkpoint-closing set. - Parallel Phase-4A semantics lane (must close by `2027-01-31`, but MUST NOT block early qualification-harness bring-up) - Implement `docs/compatibility/mysql-fulltext.md` Full Transaction Semantics Compatibility Profile (Profile 3), including immediate read-your-write behavior for successful writes. - Deliver the MySQL-blocking subset of `docs/compatibility/tidb-enhancement.md` Profile 3 enabling work for `docs/compatibility/mysql-fulltext.md` Profile 3 (table-level stopword/tokenizer config, CJK hardening, partitioned-table support) with cross-document handoff completion. - `2026-12-15` Phase-4A foundation checkpoint - Freeze the accepted Phase-4A claim matrix before January final qualification execution begins. - Close the stateful-simulation/scenario foundation: executable reference-model set, deterministic fault matrix, scenario matrix, and qualification-package schema are all accepted. - Close certification-critical primitive readiness: control-plane sharding foundation, claim-bearing storage-efficiency baseline, capacity-model structure, and qualification-scenario topology/environment definitions are accepted for January execution. - Publish one accepted Phase-4A foundation package naming the frozen claim-matrix baseline, accepted simulation/scenario foundation artifacts, and the primitive-readiness evidence identifiers that January may consume but not silently redesign. - January 2027: Internal engineering qualification closure (critical path) - Establish Phase-4A verification as one internal engineering-qualification checkpoint; external certification is a later checkpoint after this checkpoint closes. - Consume the already-frozen Phase-4A claim matrix: - explicit claims: `1B` collection cardinality, `5 EB` durability trajectory, latency/QPS SLO, `safe_ts` lag, and recovery behavior. - each checkpoint-closing claim MUST already map to measurable acceptance tests and durable evidence artifacts before January execution starts. - Internal scale evidence (cost-controlled): - run shape-preserving scaled tests with mandatory non-Samsung internal minimum data volume of `50 TB` per scenario and production-like workload skew, write/read mix, compaction pressure, and tenant distribution. - mandatory Scenario A: `1,000,000` collections x `50 MB`/collection (about `50 TB` total). - mandatory Scenario B: `10,000` collections x `5 GB`/collection (about `50 TB` total). - emulate extreme collection cardinality in control plane even when payload is sampled. - require trend linearity and bounded degradation across multiple scale points (single-point benchmarks are insufficient). - Failure and operations evidence: - run soak + chaos campaigns covering failover, replay backlog, S3 throttling, compaction debt, and catalog lag. - treat these as mandatory operational-proof evidence, not optional benchmark supplements. - Extrapolation with guardrails: - extrapolate using measured per-node/per-prefix/per-collection-unit economics to `1B/5EB` target. - apply conservative derating factors and confidence bounds. - reject extrapolation when slope bends or confidence bounds violate planning thresholds. Exit criteria: - Functional: control-plane and storage scale primitives are complete and their functional correctness is validated. Production implementations of stateful components must be validated against simplified, executable reference models using property-based testing. The accepted `2026-12-15` Phase-4A foundation package freezes a claim matrix with measurable test coverage and evidence artifacts and explicitly distinguishes checkpoint-closing claims from same-window continuation work; `docs/compatibility/mysql-fulltext.md` Profile 3 conformance suite passes at development-delivery maturity; the MySQL-blocking subset of `docs/compatibility/tidb-enhancement.md` Profile 3 and its cross-document handoff gate pass. Any Elasticsearch delivered-scope hardening that continues in the same window is audit-only unless the accepted claim matrix explicitly promotes it into the checkpoint-closing set. - Reliability: prefix hot-spot, replay lag, compaction debt, and S3 throttling behavior stay within guardrails at projected Phase-4A scale. Phase-3-proven linearizability/invariant and crash-consistency/idempotent-recovery properties show no regression under Phase-4A scale qualification and deterministic fault-matrix runs. - Economics: the internal engineering qualification package defined by `docs/testing/roadmap-workload-bundles.md` satisfies the Phase-4 planning / scale-out envelope by `2027-01-31`; verified control-plane capacity models remain within the planned shard/node envelope; extrapolation guardrails (derating + confidence bounds) pass without slope-bend rejection; same-window continuation items do not block checkpoint close unless explicitly promoted into the accepted claim matrix, and January closeout explicitly references the accepted `2026-12-15` foundation package it consumes. ### Phase 4B (2026-11-01 to 2027-01-31): Post-GA Expansion Closure Goal: - Close post-GA product and platform expansion work intentionally kept off both the October GA verdict and the `2027-02-28` external-certification dependency path. Implementation scope: - Controlled platform-expansion lane - Add a controlled TiCDC high-lag degradation snapshot-sync lane for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` data (`StartSnapshotSync` -> `UploadSnapshotChunks` -> `CommitSnapshotSync`), allowing immutable artifact staging and fenced manifest CAS only as internal execution details of the admitted snapshot session and preserving deterministic rollback back to the online TiCDC path; TiDB Lightning/direct data-file upload remains out of scope. - Close any TiDB-only multilingual extension tail admitted in Phase 4 (for example Myanmar analyzer/tokenizer support) only after the MySQL-blocking subset has already closed in Phase 4A. - Post-GA retrieval/product lane - Deliver Turbopuffer Core Read/Write Compatibility Profile (Profile 1) subset defined in `docs/compatibility/turbopuffer.md` Sections `3` to `6` for gated production traffic. - Implement two-stage reranking through `fetch_spec.rescore`, integrating bounded Top-K cross-encoders for complex RAG workloads. - Treat Turbopuffer delivery and rerank as post-GA expansion work: they MAY reuse Phase-4 validation assets, but they MUST NOT reopen the Commitment-A/B October GA verdict or the external-certification dependency chain. - Closeout package - Publish one accepted post-GA expansion checkpoint record naming the accepted gated-production workload bundle(s), fresh benchmark bundle(s), comparison-group artifact(s), and any platform-expansion evidence package(s) used for closure. Exit criteria: - Functional: `docs/compatibility/turbopuffer.md` Profile 1 delivery gate passes for the declared gated-production subset; the high-lag snapshot-sync lane passes its declared lifecycle/rollback contract; any TiDB-only multilingual extension admitted in this phase closes on the declared post-GA expansion scope and is not required for MySQL Profile 3. - Reliability and search quality: the post-GA expansion work satisfies the continuation rules in `docs/testing/search-quality-evaluation.md`, including the fresh-benchmark requirement for retrieval-affecting changes and the no-material-regression rule for previously gate-bearing cohorts unless an explicit re-baseline is published. - Evidence publication: the post-GA expansion checkpoint publishes the accepted closeout package declared by `docs/testing/roadmap-workload-bundles.md` and is explicitly non-blocking to external certification. ### Post-Phase-4 External Certification Window (2027-02-01 to 2027-02-28) Goal: - Close partner-facing certification of the top-end claims only after the `2027-01-31` internal engineering qualification checkpoint has already passed. Implementation scope: - Use Samsung joint validation only as a credibility gate for final top-end claims that are not fully reproducible internally. - Require the full internal engineering qualification gate, including the formal reference-model checks and mandatory non-Samsung `50 TB` Scenario A/B evidence, before partner-window execution starts. - Keep partner scope focused on certification-only evidence, not unfinished engineering or open architecture work. Exit criteria: - Certification: Samsung external validation passes for the partner-scoped top-end claims after the `2027-01-31` internal engineering qualification checkpoint has already closed. ## 5. Critical Dependencies and Critical Path - D0a: Because the checked-in repository is still pre-runtime bootstrap, Phase-1 committed dates assume explicit parallel bootstrap of runtime skeletons, compatibility harnesses, and milestone-checkpoint evidence harnesses; if that bootstrap does not close early, downstream dates must be re-baselined rather than silently absorbing the slip. - D0: Phase 0 contract freeze and control-plane baseline are prerequisites for any customer-facing preview. - D1: Canonical write envelope + shared TSO ordering are prerequisites for cross-modality visibility/barrier correctness. - D2: Manifest CAS publish + catalog-head progression are prerequisites for strict snapshot reads (`read_ts`) and NRT merge correctness. - D3: Search-Fabric-truth catalog ownership (`COLLECTION_TRUTH_MODE_SEARCH_FABRIC`) plus external control-plane provisioning of federated namespace/collection identity and TiDB-side verification / first-generation schema fencing are prerequisites for the Phase-1 federated query/write path. - D4: TiDB Remote DML lowering, deterministic batch shaping, `Metadata Stream Writer`, manifest CAS publish plus `wait_for_visible`, and the broker readiness / visibility-wait path are prerequisites for the Phase-1 immediate federated read-after-write acceptance target. - D5: Query Gateway architecture freeze, `RelationalQueryService.ExecuteProjectedQueryOrFallback` / `ExecutePrimaryQuery`, `GetCollectionStatistics`, and gateway resolution caching are prerequisites for stable TiDB federated-read planning and scale-safe metadata resolution. - D5a: The Phase-1 Query Gateway freeze lane is a hard prerequisite to the `2026-05-31` architecture/enabling checkpoint, the federated-read delivery close, and the later Phase-2/Phase-3 query-serving checkpoints; later evidence packages may not consume an unfrozen Query Gateway owner contract. - D6: The already-frozen CDC Adapter contract (replay identity, checkpoint semantics, ownership boundary, and exactly-once hardening contract) is a prerequisite for the Phase-1.3 preview-scope CDC evidence line, the `2026-08-31` platform-readiness checkpoint, and the later delivery-critical external-truth synchronization lane. - D6a: The Phase-1 CDC Adapter freeze lane is a hard prerequisite to the `2026-05-31` architecture/enabling checkpoint, the Phase-1 preview-scope CDC evidence close, and the later Phase-3 production-grade external-truth synchronization lane; later evidence packages may not consume an unfrozen CDC owner contract. - D7: TiDB DDL/schema-sync readiness (typed `PutCollectionSchema` / `DropCollection` fencing, persisted DDL session-context capture, and convergence-before-resume behavior) is a prerequisite for both the `2026-08-31` platform-readiness checkpoint and the later delivery-critical CDC external-truth sync lane. - D8: Minimum viable CCS-backed write-capacity authority is a prerequisite for admitted Phase-1/Phase-2 write routes and for the `2026-07-31` preview ingest-hardening close. - D9: Query/background CCS quota-authority readiness (private quota allocation/refill, `quota_epoch` invalidation, and retryable-unavailability behavior) is a prerequisite for the `2026-08-31` platform-readiness checkpoint and the Phase-3 query-admission/background-governance rollout. - D9a: The accepted frozen `docs/governance/background-governance.md` revision is a prerequisite for the October background-governance gate; no milestone may close that gate against a still-mutable owner contract. - D10: The September `2026-09-30` scalability checkpoint depends on the August-completed smaller-scale ramp-up runs, CCS watermark instrumentation, gateway-resolution caching, and the Phase-1-created descriptor/prefix stress harnesses. - D10a: The accepted August precheck artifact set (ramp-stage summary, gateway-resolution telemetry export, CCS watermark export, and referenced harness/instrumentation revisions) is a hard prerequisite to the final `10^8` checkpoint-close run. - D10b: The `2026-09-15` external-GA baseline prerequisite checkpoint depends on the closed `2026-08-31` platform-readiness checkpoint plus the executed production-grade CDC path, RCU-foundation rollout, and executed formal-verification baseline work; October external-GA hardening may not reopen this baseline as unfinished bring-up. - D11: October GA-readiness validation depends on successful closure of the September `2026-09-30` `10^8` logical-table checkpoint; if the checkpoint is not closed, October validation cannot declare the roadmap scale gates complete. - D11a: October external-GA hardening also depends on the `2026-09-15` production-grade external-truth CDC lane already being closed; October may harden and validate that path, but it may not serve as the first production closure window for it. - D11b: The `2026-10-31` dual verdict depends on the `2026-10-15` evidence-freeze checkpoint because final October closeout assumes accepted candidate artifact families already exist and that the remaining window is reserved for reruns caused by invalidation or discovered defects rather than for first-time evidence generation. - D12: Metadata predicate outputs (PK-set/bitmap/Bloom contracts) plus the planner-selection rules closed in the Phase-1.3 semantic/hybrid retrieval line are prerequisites for pre-filtered ANN path selection in vector+metadata hybrid. - D13: The `2026-10-31` same-date dual verdict depends on both September checkpoints: the `2026-09-15` external-GA baseline prerequisite checkpoint and the `2026-09-30` scalability checkpoint. The external-GA minimum-bar verdict consumes the former directly, while the platform-qualification verdict consumes both. - D14: Phase 3 GA Readiness and production-readiness validation are prerequisites to Phase 4A scale-out qualification tests. - D15: Phase-4A catalog sharding plus the claim-matrix-bound semantic-storage build-out are prerequisites for credible 1B collections / 5 EB readiness. - D15a: The `2027-01-31` internal engineering qualification checkpoint depends on the `2026-12-15` Phase-4A foundation checkpoint freezing the claim matrix, simulation/scenario foundation, and certification-critical primitive-readiness package first; January closes final execution/measurement on top of that accepted foundation. - D16: MySQL FTS Profile 3 (full transaction semantics + immediate read-your-write) depends on mature visibility/barrier guarantees from the Phase-3 GA Readiness baseline. - D17: The `2027-02-28` external scale certification checkpoint depends on simulator-backed stateful-control prequalification (invariant pass + calibrated capacity model) to avoid partner-resource burn on basic correctness failures. - D18: Samsung external certification depends on completion of the `2027-01-31` internal engineering qualification checkpoint (claim matrix coverage, mandatory `50 TB` Scenario A/B non-Samsung internal scale evidence, failure/operations evidence, and extrapolation-guardrail pass). - D19: `docs/compatibility/tidb-enhancement.md` Profile 2 GA Readiness in September depends on successful Profile 1 private-preview validation at the `2026-08-31` TiDB private-preview checkpoint. - D20: The Phase-4A scale-out engineering package depends on the completed Phase-3 baseline produced by the September-October delivery work, the September scalability checkpoint, and the October same-date dual verdict closeout. - D20a: Only claim-matrix-labeled checkpoint-closing items from the Phase-4A same-window engineering program may feed the `2027-01-31` certification-critical checkpoint; same-window continuation items are non-blocking unless explicitly promoted into the accepted claim matrix. - D21: Phase-4B post-GA search-quality closure depends on a fresh checkpoint-closing benchmark bundle after any material rerank, analyzer, embedding, hybrid-planning, or Turbopuffer-delivered retrieval-route change covered by `docs/testing/search-quality-evaluation.md`. - D22: The Phase-4B TiCDC high-lag degradation lane depends on the canonical snapshot-sync lifecycle and MUST NOT introduce a second public ingest protocol or a TiDB-Lightning direct-upload path. - D23: The `2027-01-31` post-GA expansion checkpoint is explicitly not a prerequisite for `2027-02-28` external certification. - Critical path: `Phase 0 -> 2026-05-31 Phase-1 architecture/enabling checkpoint -> Phase 1 -> Phase 2 public preview -> 2026-08-31 platform-readiness checkpoint -> 2026-09-15 GA-baseline prerequisite checkpoint -> 2026-09-30 scalability checkpoint -> 2026-10-15 evidence-freeze checkpoint -> 2026-10-31 same-date dual verdict -> 2026-12-15 Phase-4A foundation checkpoint -> 2027-01-31 internal engineering qualification checkpoint -> External Certification`. ## 6. Go/No-Go Gates Section `6` contains these checkpoint classes: - Internal architecture/enabling checkpoints (`6.1A`) close prerequisite owner-freeze and seam work before a delivery milestone consumes it. - Delivery milestones (`6.1`, `6.2`, and `6.6`) close functional, reliability, and economics gates for committed engineering scope. - Readiness checkpoints (`6.3` and `6.4`) close same-date private-preview and platform prerequisites that feed later delivery milestones but are intentionally decoupled from customer-facing milestone closure. - External-GA baseline checkpoints (`6.5A`) close September production/admission prerequisites before October hardening begins. - Scalability checkpoints (`6.5`) close checkpoint-specific scale and evidence gates for a declared validation envelope without implicitly inheriting delivery-milestone economics closure. - Evidence-freeze checkpoints (`6.5B`) freeze candidate closeout artifact families early enough to preserve a real rerun buffer before a same-month release verdict. - Foundation checkpoints (`6.6A`) close the certification-critical Phase-4A foundations before the final January qualification checkpoint consumes them. - Qualification / expansion checkpoints (`6.7` and `6.8`) close same-date internal engineering qualification and post-GA expansion work with distinct dependency semantics. - Certification checkpoints (`6.9`) close checkpoint-specific certification and evidence gates only after their prerequisite qualification checkpoint has already passed. Every delivery milestone must pass all three dimensions: - Functional gate: declared capability scope complete with compatibility tests. - Reliability gate: replay/failure/rollback tests pass with no release-blocking defects. - Economics gate: latency, throughput, and cost stay within tier budgets under representative workload. ### 6.1A Checkpoint `2026-05-31`: Phase-1 Architecture and Enabling Foundation - Owner-freeze gate: the accepted frozen revisions of `docs/architecture/query-gateway.md` and `docs/architecture/cdc-adapter.md` are named for the delivery surfaces consumed later in Phase 1 and by downstream checkpoints. - TiDB enabling-seams gate: external federated identity provisioning, TiDB-side identity verification, first-generation schema fencing, and dedicated TiDB planner/executor/write seams are production-closed for the declared Phase-1 route subset. - Write-authority baseline gate: the minimum viable CCS-backed write-capacity authority is production-closed for the admitted Phase-1 engineering-validation environment. - Harness-foundation gate: the accepted scale-program harness foundation for the later `10^8` program is published and named in the accepted enabling-checkpoint record. - Enabling-checkpoint evidence gate: the checkpoint publishes one accepted enabling-checkpoint record naming the frozen owner revisions and accepted enabling-artifact identifiers. ### 6.1 Milestone `2026-06-30`: Phase-1 Integrated Delivery - Federated capability gate: TiDB native SQL `INSERT` (Remote DML) and federated `SELECT` both pass the declared route subset against the canonical Search Fabric services. - TiDB prerequisite gate: external federated identity provisioning, TiDB-side identity verification, first-generation schema fencing, and `GetCollectionStatistics` are all production-closed for the declared federated-table subset. - Enabling-checkpoint reuse gate: the accepted `2026-05-31` enabling-checkpoint record is referenced, and the milestone explicitly names whether it reuses or supersedes the accepted frozen owner revisions and enabling artifacts from that checkpoint. - TiDB integration gate: the dedicated TiDB-side integration layer, planner/executor seam, replay-stable query/write request stamping, and deterministic remote-DML shaping are all production-closed for the declared Phase-1 route subset. - Consistency gate: successful federated writes acknowledged through `VISIBILITY_POLICY_WAIT_FOR_VISIBLE` are immediately observable from the federated read path. - Visibility gate: broker readiness serving and visibility waiting are production-closed for the declared strict / bounded-staleness federated read subset. - Semantic/hybrid retrieval gate: `Semantic Search Reader`, hybrid query planning, and the metadata-predicate carrier contract plus planner-selection rules required for pre-filtered ANN path selection are production-closed for the declared Phase-1 retrieval subset that backs the milestone-closing search-quality evidence. - Interim-isolation gate: static connection limits, quota rails, and the minimum viable CCS-backed write-capacity authority are validated for the engineering-validation tenant set with no unresolved blocker for shared-infrastructure protection. - CDC preview-evidence gate: the `CDC Adapter` architecture is frozen, and the preview-scope CDC conformance harness, replay/checkpoint evidence package, and bounded dry-run are complete for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL`. - Economics gate: the milestone-closing Phase-1 workload bundle defined by `docs/testing/roadmap-workload-bundles.md` satisfies the Phase-1 envelope declared in Section `3.3`. - Search-quality gate: `Recall@10 > 90%` for semantic and hybrid cohorts, measured according to `docs/testing/search-quality-evaluation.md`, and the milestone publishes the required benchmark-bundle artifact set (`benchmark bundle manifest`, raw ranked outputs, metrics tables, miss slices, and environment/config summary). - Phase-1 report gate: the Phase-1 completion report is published with compatibility coverage, federated consistency evidence, search-quality baseline evidence, architecture-freeze status, and the open `10^8`-scalability workstream status. - Bootstrap-boundary gate: the accepted closeout record explicitly distinguishes Phase-1 bootstrap assets already closed from later checkpoint-owned execution work in the `10^8` program. - MySQL-compatibility gate (Phase 1 / Profile 1): Phase-1 conformance gate passes for declared boolean-search compatibility scope in canonical applicability mode (`collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL`). - Elasticsearch-compatibility gate (Phase 1 / Profile 1): Phase-1 conformance gate passes for declared core read/write subset in normative applicability scope. ### 6.2 Milestone `2026-07-31`: Phase-2 Preview Expansion - MySQL-compatibility gate (Phase 2 / Profile 2): public-preview conformance gate passes for declared full-query-syntax compatibility scope in canonical applicability mode. - Elasticsearch-compatibility gate (Phase 2 / Profile 2): public-preview conformance gate passes for declared expanded-query subset in normative applicability scope. - Public-preview ingest-hardening gate: admitted preview write routes are production-closed on the minimum viable CCS-backed write-capacity authority with declared preview-tier quota policy, rollback drills, and observability. - Public-preview economics gate: MySQL / Elasticsearch preview surfaces satisfy the Phase-2 public-preview workload bundle and envelope declared in Sections `3.2` and `3.3`. - Public-preview evidence gate: the milestone publishes the Phase-2 public-preview workload artifact set, the accepted evidence record, and any required profile-attribution mapping for the MySQL / Elasticsearch public-preview bundle. ### 6.3 Checkpoint `2026-08-31`: TiDB Private Preview - TiDB-enhancement gate (Profile 1 private preview): private-preview conformance gate passes for declared flexible-filtering-index subset. - TiDB private-preview economics gate: TiDB Enhancement Profile 1 satisfies the TiDB private-preview workload bundle and envelope declared in Sections `3.2` and `3.3`. - TiDB private-preview evidence gate: the checkpoint publishes the accepted private-preview checkpoint record naming the accepted workload bundle and any superseded reruns. ### 6.4 Checkpoint `2026-08-31`: Platform Readiness - Query-gateway owner-contract gate: the accepted frozen revision of `docs/architecture/query-gateway.md` is named for the preview/GA-critical surfaces; the checkpoint closes readiness on that already-frozen contract rather than re-promoting a second freeze event. - Background-governance owner-contract gate: the accepted frozen revision of `docs/governance/background-governance.md` is named for the October quota-tier admission, long-tail / whale routing, tiered quota enforcement, and predictive-scheduling surfaces. - RCU design-freeze gate: the Phase-3 admission design is frozen, including estimator inputs, token-bucket leasing model, adaptive-shedding policy, asynchronous reconciliation policy, mid-execution pre-emption policy, and rollout hooks. - Query/background CCS quota-authority readiness gate: private quota allocation/refill, `quota_epoch` invalidation, lease-expiry semantics, and retryable-unavailability behavior are production-closed for the admission surfaces consumed by Query Gateway and background-governance rollout. - TiDB DDL/schema-sync readiness gate: search-affecting DDL classification, typed `PutCollectionSchema` / `DropCollection` fencing, replay-stable DDL request identity, persisted DDL session-context capture, and convergence-before-resume behavior are production-closed for the admitted search-affecting DDL subset. - CDC preview-readiness gate: the accepted frozen revision of `docs/architecture/cdc-adapter.md` is named, and the preview-scope CDC conformance/evidence package, cutover rehearsal, rollback/runbook assets, exactly-once replay guardrails, and idempotent TiCDC ingest filters are all complete with no release-blocking defects. - Formal-verification-preparation gate: the reference models, scenario matrix, automation plumbing, and owner sign-off for the September model-checking / fault-testing campaigns are complete. - Platform-readiness closeout gate: the checkpoint publishes the accepted platform-readiness closeout package, including the frozen owner-document revisions and accepted sub-evidence identifiers. ### 6.5A Checkpoint `2026-09-15`: External-GA Baseline Prerequisite Checkpoint - Production-CDC baseline gate: the first delivery-critical `CDC Adapter` incremental synchronization path for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` is production-closed before October begins. - RCU-foundation gate: distributed token buckets, whale shielding, estimator refresh, compaction/GC admission budgets, and admission observability/rollout controls are complete for the already-frozen Phase-3 RCU design. - Executed formal-verification-baseline gate: the already-prepared stateless model-checking and property-based fault-testing campaigns have been executed and their accepted baseline evidence is named for October closeout reuse. - GA-baseline evidence gate: the checkpoint publishes one accepted prerequisite record naming the production-CDC, RCU-foundation, and executed-formal-verification-baseline evidence identifiers. ### 6.5 Checkpoint `2026-09-30`: Scalability Checkpoint - September scalability gate: the simulation environment sustains `10^8` (`100M`) logical tables with all of the following thresholds satisfied: - `GetCollectionMetadata` `P99 <= 50 ms` - CCS resident-memory / heap watermark stays below `80%` of the configured checkpoint budget throughout the run - steady-state `CollectionNameBinding` resolution-cache hit ratio `>= 99%` - post-warm unknown-name / negative-cache penetration to S3 `<= 1%` - Staged-ramp completion gate: the deferred smaller-scale prefix and descriptor validation runs are complete, the accepted August precheck artifact set is named, and no checkpoint metric listed above degrades by more than `10%` between adjacent ramp stages before the final `10^8` run. - Scalability-evidence gate: the September checkpoint publishes the dedicated scalability-checkpoint evidence package required by `docs/testing/roadmap-workload-bundles.md`, including ramp-stage summaries, final checkpoint metrics/artifacts, the accepted August precheck artifact-set identifier, and the declared environment/instrumentation summary. - Evidence-separation gate: the September checkpoint publishes durable evidence artifacts distinct from the later October single-collection volume validation. ### 6.5B Checkpoint `2026-10-15`: Phase-3 Evidence Freeze - Evidence-freeze package gate: the checkpoint publishes one accepted evidence-freeze package naming the accepted candidate Phase-3 multi-tenant workload bundle, accepted candidate benchmark bundle, accepted candidate October single-collection validation package, and any accepted candidate predictive-scheduling comparison-group artifacts required by the later `2026-10-31` closeout. - Rerun-buffer gate: after this checkpoint, only invalidation-triggered reruns or defect-driven reruns may supersede the accepted candidate October artifact families before the final verdict records are issued. - Scope-freeze gate: no net-new October scope may be admitted after this checkpoint unless the roadmap is explicitly re-baselined; the remaining window is reserved for qualification hardening, reruns, and verdict preparation. ### 6.6 Milestone `2026-10-31`: Phase-3 External GA Minimum Bar and Same-Date Platform Qualification - External-GA minimum-bar closure: - MySQL-compatibility hardening gate (Phase 3 / Profiles 1+2): GA Readiness hardening/scale-validation gate passes for delivered Profile 1/2 scope in canonical applicability mode. - Elasticsearch-compatibility hardening gate (Phase 3): GA Readiness hardening/scale-validation gate passes for delivered Profile 1/2 scope. - TiDB-enhancement gate (Phase 3 / Profile 2): GA Readiness acceptance gate passes for flexible-filtering-index scope. - Search-quality hardening gate: the Phase-3 gate defined by `docs/testing/search-quality-evaluation.md` passes on a fresh milestone-closing benchmark bundle, including semantic-only `Recall@10 > 90%`, hybrid `Recall@10 > 90%`, hard-negative hybrid `Recall@10 > 85%`, and no gate cohort regressing by more than `2` percentage points versus the most recent accepted milestone-closing bundle unless a refreshed bundle is published under the benchmark change-control rules. - Query-admission production gate: distributed token buckets, whale shielding, adaptive shedding, asynchronous estimated-vs-actual reconciliation, and mid-execution pre-emption are complete and validated under representative multi-tenant load. - October-hardening boundary gate: the first delivery-critical `CDC Adapter` incremental synchronization path for `collection_truth_mode=COLLECTION_TRUTH_MODE_EXTERNAL` is already production-closed before the October validation month begins; the October milestone closes only its hardening/rollback/runbook validation rather than the first production-path bring-up. - Background-governance minimum-bar gate: quota-tier admission, long-tail / whale pool routing, and tiered quota enforcement complete on the owner-defined Query Gateway, deployment-routing / pool-assignment, and background-compute surfaces in `docs/governance/background-governance.md`, and the accepted frozen owner revision used for this gate is named in the closeout record. - GA economics gate: the milestone-closing Phase-3 multi-tenant workload bundle defined by `docs/testing/roadmap-workload-bundles.md` satisfies the Phase-3 envelope declared in Section `3.3`. - Same-date platform-qualification closure: - Predictive-scheduling qualification gate: predictive scheduling completes on the owner-defined background-compute surfaces, and predictive controls cause no more than `10%` online-query `P99` regression versus the same milestone-closing comparison-group workload bundle with predictive controls disabled. - Formal-correctness qualification gate: stateless model checking proves required interleaving properties (linearizability + no invariant breaks for commit ordering / manifest CAS progression / catalog-head convergence); property-based fault-state testing validates crash consistency and idempotent recovery; soak/chaos reliability evidence for failover/replay/catalog-lag is complete. - Quantitative platform-qualification gate: validate single-collection envelope (up to `15B` rows, `20 TB` metadata volume, `50 TB` vector data) with hybrid-search `QPS >= 5000`, metadata-search `P99 <= 50 ms`, semantic-search `P95 <= 200 ms`, and hybrid-search `P95 <= 500 ms`. - Evidence publication closure: - External-GA evidence linkage gate: the accepted external-GA minimum-bar verdict explicitly cross-references the fresh benchmark bundle, identifies every retrieval-affecting route included or excluded from that benchmark, and names any reused September prerequisite/scalability package identifiers. - Platform-qualification evidence linkage gate: the accepted same-date platform-qualification verdict names the October single-collection validation package, any required predictive-scheduling comparison-group artifacts, and any reused September prerequisite/scalability package identifiers. - Release-disposition gate: the issued verdict pair MUST map to one of the normative release outcomes in Section `3.4`; no unstated launch posture is admissible. ### 6.6A Checkpoint `2026-12-15`: Phase-4A Foundation - Claim-matrix freeze gate: the accepted Phase-4A claim matrix names every certification-feeding claim, its acceptance test family, and the exact evidence artifact family expected at `2027-01-31`. - Simulation/scenario-foundation gate: the executable reference-model set, deterministic fault matrix, scenario matrix, and qualification-package schema are accepted and frozen for January use. - Primitive-readiness gate: certification-critical control-plane sharding primitives, claim-bearing storage-efficiency baseline, capacity-model structure, and qualification topology/environment definitions are accepted for the January execution window. - Foundation-package gate: the checkpoint publishes one accepted Phase-4A foundation package naming the frozen claim-matrix baseline, accepted simulation/scenario artifacts, and the primitive-readiness evidence identifiers that the January checkpoint consumes. ### 6.7 Checkpoint `2027-01-31`: Phase-4 Internal Engineering Qualification - Checkpoint-scope boundary gate: the accepted Phase-4A claim matrix explicitly labels which items are checkpoint-closing and which are same-window continuation work; only checkpoint-closing items feed external certification. - MySQL-compatibility gate (Phase 4A / Profile 3): development-delivery conformance gate passes for declared transaction-semantics compatibility scope (including immediate TiDB SQL read-your-write behavior) in canonical applicability mode. - TiDB-enhancement gate (Phase 4A / Profile 3 MySQL-blocking subset): development-delivery gate passes for the enabling work behind `docs/compatibility/mysql-fulltext.md` Profile 3 (table-level stopword/tokenizer config, CJK hardening, partitioned-table support), and cross-document handoff completion. - Phase-4A stateful simulation gate: pass deterministic state-machine simulation for key stateful components at projected cardinality with required invariants (`commit_ts` monotonicity, manifest CAS monotonic progression, `head <= latest_manifest` and bounded head-lag convergence, replay idempotency under retries/reorder, safe GC reachability). - Phase-4A engineering qualification gate (internal): the frozen claim matrix is executed without unauthorized scope growth; mandatory non-Samsung internal scale evidence passes both `50 TB` scenarios (`1,000,000` collections x `50 MB`, and `10,000` collections x `5 GB`) with trend linearity and bounded degradation; soak/chaos operations evidence passes; extrapolation guardrails pass with derating and confidence bounds. - Phase-4A economics gate: the accepted internal engineering qualification package defined by `docs/testing/roadmap-workload-bundles.md` satisfies the Phase-4 planning / scale-out envelope declared in Section `3.3`, and same-window continuation items are non-blocking unless explicitly promoted into the accepted claim matrix. - Same-window continuation note: delivered Elasticsearch Profile 1/2 hardening may continue in this window, but it is audit-only unless the accepted claim matrix explicitly promotes a regression-blocking subset into the checkpoint-closing set. ### 6.8 Checkpoint `2027-01-31`: Phase-4 Post-GA Expansion Closure - Turbopuffer-compatibility gate (Phase 4B / Profile 1): delivery conformance gate passes for the declared `docs/compatibility/turbopuffer.md` Profile-1 subset on gated production traffic, and any retrieval-affecting route it closes is represented in the fresh Phase-4B benchmark/workload evidence set. - High-lag snapshot-sync gate: the TiCDC high-lag degradation lane passes the canonical snapshot-sync lifecycle (`StartSnapshotSync` -> `UploadSnapshotChunks` -> `CommitSnapshotSync`) with phase-gated ownership checks, replay-safe idempotency, rollback validation, and no second public ingest protocol. - TiDB multilingual-tail gate: any TiDB-only multilingual extension admitted in Phase 4 closes here and is explicitly non-blocking to MySQL Profile 3. - Phase-4B rerank expansion gate: the two-stage reranking lane closes as post-GA expansion work, and any retrieval-quality delta it introduces is audited through the fresh benchmark/workload evidence required by the checkpoint. - Phase-4B search-quality continuation gate: the post-GA expansion work satisfies the continuation rules in `docs/testing/search-quality-evaluation.md`, including the fresh-benchmark requirement for retrieval-affecting changes and the no-material-regression rule for previously gate-bearing cohorts unless an explicit re-baseline is published. - Phase-4B evidence gate: the checkpoint publishes the accepted post-GA expansion closeout package declared by `docs/testing/roadmap-workload-bundles.md` and is explicitly non-blocking to external certification. ### 6.9 Checkpoint `2027-02-28`: External Scale Certification Checkpoint - External-certification entry gate: the `2027-01-31` internal engineering qualification checkpoint is already closed, and the accepted internal claim matrix / qualification-package evidence set is frozen before partner execution starts. - External-certification evidence gate: the checkpoint publishes the partner-scoped certification evidence package required by `docs/testing/roadmap-workload-bundles.md`, including the certified-claim manifest, environment summary, comparison against the accepted internal qualification evidence, and raw certification artifacts. - External scale certification gate (Samsung): partner validation passes for top-end claims not fully reproducible internally; this gate is entered only after the `2027-01-31` internal engineering qualification checkpoint has already passed. Release policy: - Phase-1 internal checkpoint (`2026-05-31`): freeze and enabling-seam closure before the final integrated-delivery milestone consumes those dependencies. - Integrated development delivery (Phase 1): gated engineering validation, explicit allowlist where tenant traffic is needed, and control-plane governance; this phase is not the RCU hardening window. - Public preview (Phase 2): expanded-preview SLO/error budgets + controlled tenant expansion + rollback drills. - Same-date August checkpoints (`2026-08-31`): one TiDB private-preview checkpoint plus one separate platform-readiness checkpoint; both are internal closures, but only the platform-readiness checkpoint feeds the Commitment-A/B October critical path. - September prerequisite checkpoints (`2026-09-15` and `2026-09-30`): one production/admission baseline checkpoint plus one scalability checkpoint before October hardening begins. - Mid-October evidence freeze (`2026-10-15`): candidate October artifact families are frozen so the remaining window is reserved for reruns and verdict preparation rather than first-time evidence generation. - Production readiness and GA Readiness (Phase 3 onward): production SLO/error budgets + on-call runbooks + rollback readiness; the `2026-10-31` closeout date publishes one external-GA minimum-bar verdict plus one same-date platform-qualification verdict, and launch disposition follows Section `3.4`. - Phase-4A foundation checkpoint (`2026-12-15`): claim matrix, simulation/scenario foundation, and certification-critical primitive readiness close before the January qualification checkpoint consumes them. - Internal engineering qualification checkpoint (`2027-01-31`): critical-path Phase-4 closure required before external certification. - Post-GA expansion checkpoint (`2027-01-31`): gated production allowlist + fresh benchmark/workload evidence for any retrieval-affecting route change before wider rollout; this checkpoint is non-critical to external certification. - Rollout rule: no bypass of Phase 0 control-plane gate for any customer-facing traffic.