Refresh Cellule and add table Cell placement and admission batching

.gitignore

@@ -4,3 +4,6 @@
 !.env.example
 *.log
 __pycache__/
+
+# Local benchmark reports, logs and fixtures.
+/benchmarks/

Cargo.toml

@@ -8,12 +8,12 @@ repository = "https://github.com/crabbuild/beyonddb"
 rust-version = "1.97"
 
 [workspace.dependencies]
-cellule-app = { git = "https://github.com/crabbuild/cellule.git", rev = "9e17746a633ca1046bd93866866074226091f81a" }
-cellule-host = { git = "https://github.com/crabbuild/cellule.git", rev = "9e17746a633ca1046bd93866866074226091f81a" }
-cellule-peer-http = { git = "https://github.com/crabbuild/cellule.git", rev = "9e17746a633ca1046bd93866866074226091f81a" }
-cellule-runtime = { git = "https://github.com/crabbuild/cellule.git", rev = "9e17746a633ca1046bd93866866074226091f81a" }
-cellule-store = { git = "https://github.com/crabbuild/cellule.git", rev = "9e17746a633ca1046bd93866866074226091f81a" }
-cellule-ltx = { git = "https://github.com/crabbuild/cellule.git", rev = "9e17746a633ca1046bd93866866074226091f81a" }
+cellule-app = { git = "https://github.com/crabbuild/cellule.git", rev = "1d0648b3b5ae0cca040c614b505b4d72bb769ab1" }
+cellule-host = { git = "https://github.com/crabbuild/cellule.git", rev = "1d0648b3b5ae0cca040c614b505b4d72bb769ab1" }
+cellule-peer-http = { git = "https://github.com/crabbuild/cellule.git", rev = "1d0648b3b5ae0cca040c614b505b4d72bb769ab1" }
+cellule-runtime = { git = "https://github.com/crabbuild/cellule.git", rev = "1d0648b3b5ae0cca040c614b505b4d72bb769ab1" }
+cellule-store = { git = "https://github.com/crabbuild/cellule.git", rev = "1d0648b3b5ae0cca040c614b505b4d72bb769ab1" }
+cellule-ltx = { git = "https://github.com/crabbuild/cellule.git", rev = "1d0648b3b5ae0cca040c614b505b4d72bb769ab1" }
 async-trait = "0.1"
 blake3 = "1.8"
 futures-util = "0.3"
@@ -61,6 +61,7 @@ extenddb-storage = { git = "https://github.com/crabbuild/extenddb.git", rev = "7
 futures-util.workspace = true
 fs4 = "0.13.1"
 getrandom = "0.3"
+object_store.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -74,12 +75,12 @@ uuid.workspace = true
 zeroize = "1"
 
 [dev-dependencies]
+prost = "=0.13.5"
 cellule-store = { workspace = true, features = ["test-support"] }
 aws-config.workspace = true
 aws-credential-types.workspace = true
 aws-sdk-dynamodb.workspace = true
 ed25519-dalek.workspace = true
 extenddb-engine = { git = "https://github.com/crabbuild/extenddb.git", rev = "7eaa89b437feed0af0f05883d3f1493f86c6fc6d" }
-object_store.workspace = true
 tempfile.workspace = true
 tokio = { workspace = true, features = ["macros", "rt-multi-thread", "net", "time"] }

README.md

@@ -55,6 +55,10 @@ partition-key ranges. A GSI is maintained asynchronously from a journal
 committed with the base item. Cross-Cell transactions use a durable
 coordinator decision and idempotent participant resolution.
 
+### Choose placement per table
+
+Set the `CreateTable` tag `beyonddb:cell-model` to `single`, `auto`, or `partitioned`. Keep one base data Cell for a table that fits its resource budgets, start at one and permit growth, or provision multiple ranges immediately. Omitting the tag preserves `initial_partitions`. GSIs use separate Cells; changing the tag later does not migrate the table. Live model conversion is not implemented. See [Cell model selection](docs/scaling.md#choose-a-tables-cell-model) and the [AWS CLI example](docs/user-guide.md#create-a-table-and-wait-for-it).
+
 ### When a write becomes durable
 
 ![Sequence of a signed PutItem: ExtendDB validates, BeyondDB routes, Cellule commits and publishes LTX, then the response returns](diagram/beyonddb-architecture/durable-write.svg)
@@ -64,11 +68,13 @@ stream intent commit in one Cell command. The successful response follows
 durable publication. [PNG version](diagram/beyonddb-architecture/durable-write@2x.png) ·
 [Detailed architecture and recovery design](docs/architecture.md)
 
-The serving binary currently waits for object-store publication on each
-durable write. Cellule's follower-log mode is not enabled in BeyondDB. An
-opt-in persistent follower store and authenticated peer transport exist, but
-the durability provider is not installed in serving and successor recovery
-is unfinished. See the [follower durability design](docs/follower-durability.md).
+The default serving path waits for object-store publication on each durable
+write. Experimental `follower_durability_enabled` installs Cellule's node-log
+provider and can acknowledge after every enrolled follower fsyncs the commit.
+A three-process signed SDK test verifies item mutations, same-partition
+transaction replay, and stream records after an owner kill with object uploads
+withheld. Broader fault and performance qualification remains open. See the
+[follower durability guide](docs/follower-durability.md).
 
 ## Current capability boundary
 

docs/api.md

@@ -28,6 +28,12 @@ The [implementation record](implementation-status.md#current-verified-slice)
 maps these paths to tests. The full upstream protocol suite remains an
 [acceptance gate](implementation-status.md#acceptance-proof-for-a-server-claim).
 
+### Creation-time Cell model extension
+
+`CreateTable.Tags` accepts `beyonddb:cell-model` with `single`, `auto`, or `partitioned`. `single` fixes the base table to one data Cell; `auto` starts at one and permits splitting; `partitioned` starts at the configured count, with a minimum of two. Omitting the tag retains existing behavior. The choice is durable table-generation metadata, not an AWS DynamoDB setting.
+
+Later tag operations change metadata only. They do not change placement, and `UpdateTable` does not convert models. GSIs stay separate; LSIs stay with their base items. Read [Cell model limits](scaling.md#choose-a-tables-cell-model) and the [CLI creation example](user-guide.md#create-a-table-and-wait-for-it).
+
 ## Indexes
 
 Local secondary indexes (LSIs) share a base Cell's atomic mutation. Global secondary indexes (GSIs) have separate owner Cells and receive base changes asynchronously.

docs/architecture.md

@@ -95,7 +95,7 @@ sequenceDiagram
       Driver->>B: PREPARE item images and locks
       B-->>Driver: Durable prepare receipt
     end
-    Driver->>Coord: Publish COMMIT or ABORT
+    Driver->>Coord: Record prepares + COMMIT, or publish ABORT
     Coord-->>Driver: Durable decision
     par Resolve owners
       Driver->>A: Apply or discard decision
@@ -108,7 +108,7 @@ sequenceDiagram
     Driver-->>Client: Return or replay result
 ```
 
-The original coordinator and participant identities survive routing changes. If a driver dies after publishing the decision, startup or serving recovery finishes participant resolution. A caller timeout leaves the outcome unknown until the durable decision is inspected. A client token distinguishes a matching replay from a different request. Transactional reads use shared key locks and captured images. See the [transaction protocol and failure cases](cross-cell-transactions.md).
+The original coordinator and participant identities survive routing changes. If a driver dies after publishing the decision, startup or serving recovery finishes participant resolution. A caller timeout leaves the outcome unknown until the durable decision is inspected. A client token distinguishes a matching replay from a different request. Cross-Cell transaction reads use shared key locks and captured images. Single-Cell reads use one atomic query with a compact internal response when it fits the query envelope. See the [transaction protocol and failure cases](cross-cell-transactions.md).
 
 ## Range split and GSI projection