Skip to content

Latest commit

 

History

History
1460 lines (1320 loc) · 117 KB

File metadata and controls

1460 lines (1320 loc) · 117 KB

LogsQL feature matrix

This living matrix maps VictoriaLogs LogsQL constructs onto timeless-libsql. The filename retains the common LOGSQL spelling, while the language name follows upstream. See Query feature maps for ownership and completion rules.

Baseline: a72634e, 2026-08-04. The exact upstream source and container pins are recorded in Query semantic oracles. The language snapshot is the current VictoriaLogs LogsQL reference. The previous Timeless compatibility oracle is TimelessLogs.LogsQL and its tests. That parser was intentionally DDNet-oriented rather than complete LogsQL, but its supported syntax must not disappear in the Rust path.

The current Rust parser supports the complete P0 Timeless/DDNet subset plus the shipped P1 filters, the P2 pattern matcher, and the ordered discovery/projection/statistics pipeline: wildcard selection; relative, bracketed, and comparison time bounds; all eight severities; service and arbitrary typed/nested field predicates; message filters; logical composition; deterministic time sort, limit, and offset; field names/values; typed projection and current-row filters; bounded VictoriaLogs-compatible first/last, top, and uniq selection; and the listed count, unique, numeric, and rate statistics. The native GET query API may have additional parameters, but they do not count as LogsQL support until the LogsQL parser and executor accept them.

Legend and foundations

Priorities are P0 (restore existing Timeless behavior), P1 (storage-native LogsQL core), P2 (composable query/response behavior), P3 (broader upstream compatibility), and DEFER (blocked by an explicit storage/product decision).

name public primitive
ROWS timeless_logs row query with time, level, indexed-term, order, limit, and offset planning
COUNT timeless_log_count
VALUES timeless_log_values
BUCKETS timeless_log_buckets
STATS timeless_stats
SQL ordinary SQLite expression/composition over bounded public results

API owns LogsQL grammar, pipelines, transformations, result shape, limits, and cancellation. EXT is used only when block/index awareness avoids decode or materialization. Typed nested metadata remains lossless even when a query must decode blocks to inspect a non-indexed field. Rows with an SQL foundation must link an executable statement from the SQL equivalents cookbook before becoming shipped.

Filters and query syntax

ID upstream construct Rust now Elixir foundation target priority notes
LQL-F01 wildcard/no-op * (SQL) shipped yes ROWS API P0 Must remain bounded by request limits even without a time filter.
LQL-F02 relative _time:5m (SQL) shipped yes ROWS API P0 One injected request clock defines upstream's [now-duration,now) window in the table's native unit; both microsecond edges, valid empty 0s, the pinned live oracle, and reopen pass.
LQL-F03 absolute/bracket _time:[start,end) (SQL) shipped yes ROWS API P0 RFC3339 and integer Unix-second/millisecond/microsecond/nanosecond bounds preserve [, (, ], and ) exactly in the table's native unit; empty intersections fail.
LQL-F04 _time:>=... and _time:<... (SQL) shipped yes ROWS API P0 >, >=, <, and <= intersect in the table's native unit; exclusive edges adjust by one unit and overflow/empty intersections fail.
LQL-F05 arbitrary exact field:value filters (SQL) shipped yes ROWS API P0 Legacy : is exact string equality; := accepts typed JSON primitives and dotted paths. Indexed string keys prune before bounded decode; missing/null/empty remain distinct.
LQL-F06 exact level:<severity> (SQL) shipped yes ROWS API P0 All eight stored severities are valid.
LQL-F07 exact service:<value> (SQL) shipped yes ROWS API P0 Honor semantic service aliases used by storage.
LQL-F08 quoted message phrase shipped yes ROWS API P0 Exact case-sensitive phrase bytes plus Unicode letter/digit/underscore word boundaries match the pinned VictoriaLogs oracle. The existing case-insensitive Timeless substring primitive remains separate.
LQL-F09 word filter shipped no ROWS API P1 Case-sensitive Unicode letter/digit/underscore boundaries pass the pinned oracle; bounded decode remains the honest plan.
LQL-F10 prefix filter shipped no ROWS API P1 Word and phrase prefixes share the pinned boundary semantics; no measured index contract is claimed.
LQL-F11 pattern-match filter shipped no ROWS API P2 Four case-insensitive function names and all seven VictoriaLogs placeholders pass 23 pinned cases, including the exact Unicode Letter/Decimal_Number boundary for <W>. Matching uses a textual projection of retained rich values over bounded public rows; missing and null are empty only for this predicate. No portable SQL equivalent is claimed because SQLite LIKE/GLOB cannot reproduce the placeholder and quoted-Unicode-word grammar.
LQL-F12 substring filter (SQL) shipped partial ROWS, SQL API P1 Case-sensitive literal UTF-8 substring matches the pinned oracle and remains distinct from the established case-insensitive engine predicate.
LQL-F13 regexp filter shipped no ROWS API P1 Bounded RE2-compatible Rust regex uses a 1 MiB compiled-size limit and observes cancellation and decoded-row work before returning matches.
LQL-F14 case-insensitive filter shipped no ROWS API P1 i(word), i("phrase"), and i(prefix*) use pinned Unicode case behavior over bounded public rows.
LQL-F15 exact filter (SQL) shipped partial ROWS, SQL API P1 Full-message exactness, unquoted =value, case-insensitive exact(value) function names, and exact typed metadata equality remain distinct from word matching.
LQL-F16 exact-prefix filter (SQL) shipped partial ROWS, SQL API P2 Case-sensitive start anchoring, operator/function forms, UTF-8, strict errors, rich textual projection, empty-prefix behavior, composition, limits, durability, and reopen pass 13 pinned cases. Ordinary SQL exactly covers message and retained-text prefixes; the API owns VictoriaLogs projection for all rich types. Exact-build evidence shows byte-identical storage work to other decode-first filters, so no extension primitive is justified.
LQL-F17 multi-exact filter (SQL) shipped no ROWS, SQL API P2 Static in(v1, ..., vN) provides case-sensitive exact textual membership over messages and rich fields. Seventeen pinned cases cover quoting, commas/pipes, typed projection, duplicates, an empty list, a trailing comma, literal versus standalone wildcard behavior, composition, and strict errors; query-backed membership is independently implemented by LQL-F38. Direct users can use ordinary parameterized IN, including the existing public posting index for a declared string-only key; generic rich membership remains bounded API composition because exact-build evidence proves no avoidable storage work.
LQL-F18 empty-value filter (SQL) shipped no ROWS, SQL API P1 field:("") provides compatible missing/null/empty behavior; legacy and typed exact forms preserve each retained state.
LQL-F19 any-value filter (SQL) shipped no ROWS, SQL API P1 Present non-null typed values include zero, false, arrays, and objects; only the empty string is excluded.
LQL-F20 field no-op filter (SQL) shipped no ROWS, SQL API P2 Any standalone unquoted wildcard in case-insensitive in, contains_any, or contains_all is a field-independent true predicate, including mixed lists, missing fields, service/level aliases, logical composition, and pipelines. Eleven pinned cases and the real extension pass; static non-wildcard values are independently shipped by LQL-F21/LQL-F22, and query-backed lists by LQL-F38. Ordinary SQL omits the field predicate, and exact-build evidence proves no new extension primitive is warranted.
LQL-F21 contains_all shipped no ROWS API P2 Sixteen successful and two error pinned cases cover case-sensitive all-phrase matching, Unicode word boundaries, numeric textual projection, static-list grammar, field scope, empty-list/empty-value identity, aliases, logical/pipeline composition, and strict errors. Real-extension regressions preserve rich typed/nested projection, work limits, cancellation, durability, and reopen; LQL-F38 composes the same predicate with query-backed values. Exact-build evidence records bounded decode-first cost and no avoidable storage work. Portable SQLite has no exact Unicode-category phrase-boundary predicate, so this row intentionally makes no SQL or extension claim.
LQL-F22 contains_any shipped no ROWS API P2 Seventeen successful and two error pinned cases cover case-sensitive any-phrase matching, Unicode word boundaries, numeric/boolean/rich textual projection, empty-list false versus empty-value true, aliases, static-list grammar, logical/pipeline composition, and strict errors. Real-extension regressions preserve work limits, cancellation, durability, and reopen; LQL-F38 composes the same predicate with query-backed values. Exact-build evidence shows byte-identical public reads and no avoidable storage work. Portable SQLite has no exact Unicode-category phrase-boundary predicate, so this row intentionally makes no SQL or extension claim.
LQL-F23 json_array_contains_any (SQL) shipped no ROWS, SQL API P2 Twenty successful and four error pinned cases cover exact top-level primitive membership, empty-list/value behavior, escaped strings, numeric spelling, ignored nested/scalar values, quoted-star literal versus unquoted-star error, grammar, and the intentional semantic-JSON distinction from VictoriaLogs' raw-lexeme Unicode-escape shortcut. Real-extension regressions preserve retained types, limits, cancellation, durability, and reopen. Executable public json_each SQL and exact-build evidence prove bounded decode-first work; no extension primitive is justified.
LQL-F24 numeric range/comparison filter shipped no ROWS API P1 Typed >, >=, <, <=, and all open/closed ranges preserve full integer/float ordering; numeric strings are never coerced.
LQL-F25 IPv4 range filter (SQL) shipped no ROWS, SQL API P2 Eleven successful and seven error pinned cases cover exact whole-string IPv4 parsing, inclusive single/CIDR/two-bound forms, host-bit normalization, trailing commas, /0, decimal leading zeroes, inverted ranges, arbitrary/message fields, logical/pipeline composition, case-insensitive function names, and strict errors. Real-extension regressions preserve retained types, work limits, cancellation, durability, and reopen. Executable public JSON1 SQL and exact-build narrow/wide evidence pass without an extension primitive.
LQL-F26 IPv6 range filter shipped no ROWS API P2 Twelve successful and seven error pinned cases cover exact whole-string parsing, inclusive address/CIDR/two-bound forms, host-bit normalization, /0, IPv4-mapped input and 128-bit prefixes, spelling normalization, inverted ranges, arbitrary/message fields, logical/pipeline composition, and strict errors. Failing-then-passing parser and real-extension regressions preserve retained types, work limits, cancellation, durability, and reopen. Exact-build evidence records bounded decode-first work without an extension primitive. Portable SQLite has no built-in IPv6 parser, so this row intentionally makes no SQL claim.
LQL-F27 string-range filter (SQL) shipped no ROWS, SQL API P2 Sixteen successful and seven error pinned cases cover lower-inclusive/upper-exclusive byte ordering, equal-prefix/inverted ranges, ASCII/UTF-8, typed projection, missing/null/empty, nested/message/service fields, aliases, composition, and strict errors. Real-extension regressions preserve rich objects, limits, cancellation, durability, and reopen. Executable SQL-LOG-019 and exact-build narrow/wide evidence pass without an extension primitive.
LQL-F28 length-range filter (SQL) shipped no ROWS, SQL API P2 Seventeen successful and ten error pinned cases plus failing-then-passing parser and real-extension regressions establish inclusive Unicode-codepoint bounds, rich textual projection, missing/null/empty length zero, aliases, composition, strict errors, limits, cancellation, durability, and reopen. Executable SQL-LOG-020 and exact-build narrow/wide evidence pass without an extension primitive or storage change.
LQL-F29 value_type(...) filter shipped no ROWS API P1 Exposes retained logical JSON types; VictoriaLogs physical block-encoding names fail explicitly rather than leaking private storage.
LQL-F30 eq_field, le_field, lt_field (SQL) shipped no ROWS, SQL API P2 Twelve successful and twelve error pinned cases plus failing-then-passing parser and real-extension regressions establish same-row exact textual equality and math-value-or-bytewise ordering. Missing/null/empty projection, retained rich values and exact large integers, quoted/message/service/nested/right-_time fields, aliases, logical/pipeline composition, strict errors, limits, cancellation, durability, and reopen pass. Executable SQL-LOG-021 and exact-build narrow/wide evidence pass; math parsing remains bounded API work without an extension primitive or storage change.
LQL-F31 logical AND, OR, NOT, parentheses (SQL) shipped no ROWS, SQL API P1 NOT > AND > OR; safe top-level indexed conjuncts prune before bounded decode, while no predicate below OR/NOT is pushed.
LQL-F32 searching multiple fields/prefix field sets (SQL) shipped no ROWS, SQL API P2 Sixteen successful and six error pinned cases plus failing-then-passing parser and real-extension regressions establish literal empty/quoted prefixes, canonical special fields, recursively dotted rich leaves, independent group operands, projected pipelines, strict wildcard-comparison errors, limits, cancellation, durability, and reopen. Executable SQL-LOG-022 and exact-build narrow/wide word and typed-value evidence pass without an extension primitive or storage change.
LQL-F33 day-range filter (SQL) shipped no ROWS, SQL API P2 Fifteen successful and eight error pinned cases plus failing-then-passing parser and real-extension regressions establish exact brackets, HH:MM/HHMM, signed compound offsets, 24:00/minute-60 normalization, midnight/full-day and inverted-range behavior, deterministic UTC default, current-row pipelines, limits, cancellation, durability, and reopen. Executable SQL-LOG-023 and exact-build narrow/wide evidence pass without an extension primitive or storage change.
LQL-F34 week-range filter (SQL) shipped no ROWS, SQL API P2 Fifteen successful and eight error pinned cases plus failing-then-passing parser and real-extension regressions establish short/full weekdays, exact bracket normalization, non-wrapping and full-week/empty edges, signed offsets, deterministic UTC default, current-row pipelines, limits, cancellation, durability, and reopen. Executable SQL-LOG-024 and exact-build narrow/wide evidence pass without an extension primitive or storage change.
LQL-F35 stream selector {...} deferred no none DEFER DEFER Four pinned cases prove that VictoriaLogs selects ingestion-declared, tenant-scoped stream identities—not ordinary row fields. The POST LogsQL route rejects selectors at their source position before storage across base, filter-pipe, shutdown, and reopen paths; quoted/commented braces and explicit rows({...}) inline data remain valid. The native-parameter GET route does not accept LogsQL text. Shipping requires a versioned stream-field/tenant/canonical-ID/index/migration contract spanning every public batch and readable codec; see QSF-007, QSF-261, and QSF-262.
LQL-F36 _stream_id filter deferred no none DEFER DEFER Six accepted and two error witnesses pin VictoriaLogs' reserved, tenant-scoped 48-hex block identity: exact/quoted/static/query-backed forms, case-insensitive unquoted spelling, whitespace, and strict malformed IDs. Timeless rejects top-level _stream_id: filters at their source position before storage across base, filter-pipe, shutdown, and reopen paths; bare/message values, nested foo._stream_id, projections, comments, and explicit rows({...}) data remain valid. Shipping requires the versioned stream identity and index contract shared with LQL-F35; see QSF-007 and QSF-263.
LQL-F37 sequence filter shipped no ROWS API P3 Fifteen successful and six error pinned cases plus failing-then-passing parser and real-extension regressions establish ordered non-overlapping case-sensitive phrase matching, duplicates, Unicode token boundaries, quoted/empty/trailing-comma grammar, field scope, rich textual projection, logical/current-row pipeline composition, limits, cancellation, optimize, durability, and reopen. The request-bounded phrase vector and monotonic row-local scan remain API-owned; portable SQLite has no exact Unicode-boundary equivalent and an extension primitive would not avoid public-row decode. Exact-build message p95 is 3.906/40.608 ms narrow/wide and rich-field p95 is 3.548/48.358 ms with byte-identical storage work to same-cardinality contains_all controls.
LQL-F38 subquery/in(...) filter (SQL) shipped no ROWS, SQL API P3 Fourteen successful and five error pinned cases plus parser and 8,192-entry real-extension regressions cover exact/uniq output, rich/missing/nested projection, empty identities, in/contains_any/contains_all, nesting, logical/current-row composition, strict one-field output, shared request time, eight nesting levels, 32 lists, request-local caching, cumulative work/state/result limits, cancellation, optimize, flush, and reopen. Query-backed exact membership measures 5.849/7.341/7.440 ms narrow and 32.622/33.501/34.096 ms wide p50/p95/p99 versus 3.220/4.251/4.312 and 31.197/35.548/41.786 ms static controls. The inherent second scan doubles narrow work and adds one pruned block to wide work; wide internal query time is 1.5% higher even though its endpoint p95/p99 are lower run variation. SQL-LOG-048 gives direct users the bounded two-scan retained-string foundation. Composition stays in Rust over public rows; no nested-query vtab, private-table access, extension primitive, or storage change is used.
LQL-F39 quoted identifiers/literals and escapes shipped partial none API P0 Double/single literals decode pinned Go escapes, backticks remain raw, quoted pipes do not split pipelines, and quoted field names are literal keys. Escapes producing non-UTF-8 bytes fail explicitly because the retained rich-log/JSON model is UTF-8.
LQL-F40 comments and multi-line queries shipped no none API P2 Parser-only. Fourteen successful and six error pinned cases plus failing-then-passing unit and real-extension regressions establish LF/CRLF comments, multiline composition, quoted hashes, one optional terminal semicolon, strict malformed tails, lexical line/column errors, limits, durability, and reopen. Exact-build evidence confirms byte-identical storage work without an extension primitive.
LQL-F41 equals_common_case / contains_common_case shipped no ROWS API P3 Fourteen successful and eight error pinned cases plus parser and 8,192-entry real-extension regressions establish Go-simple whole-uppercase/per-Lu lowercase expansion, exact versus Unicode-boundary contains behavior, Unicode/titlecase/normalization edges, empty/missing/rich projection, strict grammar, ten-uppercase and cumulative 8,192-value/4-MiB bounds, limits, cancellation, optimize, flush, shutdown, and reopen. Exact common-case measures 2.935/4.221/4.440 ms narrow and 30.465/31.608/31.980 ms wide p50/p95/p99 versus 3.161/3.352/3.417 and 29.714/33.087/39.691 ms static-list controls. Contains common-case measures 2.967/3.181/3.355 and 36.014/37.574/37.904 ms versus 2.934/3.555/5.178 and 35.931/37.140/37.603 ms controls. Every pair has byte-identical public work and output; endpoint differences are run/parser variation. Portable SQLite lacks both Go-simple Unicode expansion and exact phrase boundaries, and pushdown cannot avoid required public-row decode, so no SQL recipe or extension primitive is claimed.

Pipes

Pipes usually transform bounded query results and therefore belong in API or ordinary SQL. A pipe is not a reason to expose LogsQL syntax inside the extension.

ID pipe Rust now Elixir foundation target priority
LQL-P01 limit / head (SQL); pagination after scalar count applies to the aggregate result; pagination before count changes its input shipped yes ROWS API P0
LQL-P02 offset / skip (SQL) shipped yes ROWS API P0
LQL-P03 sort / order by explicit fields, including _time, asc/desc (SQL); ordinary and aggregate fields use bounded natural-order sorting; all-field sorting and inline sort limit/offset/rank/partition clauses are unsupported shipped yes ROWS, SQL API P0
LQL-P04 field_values (indexed SQL, typed SQL) shipped no VALUES API P1
LQL-P05 field_names (SQL) shipped no ROWS, VALUES API P1
LQL-P06 fields / keep (SQL) shipped no SQL API P1
LQL-P07 delete / drop (SQL) shipped no SQL API P2
LQL-P08 filter / where (SQL) shipped no SQL API P1
LQL-P09 stats incl. stats by (fields...) grouped aggregation (count SQL, bucket SQL); scalar counts use native count execution regardless of output alias, including supported following row transforms; eligible metadata-only grouped counts stream bounded counters from the public cursor, while metadata-only filtered counts avoid copying presentation columns; typed exact checks and storage work bounds remain enforced; preceding cardinality-changing transforms and request-local diagnostic reports retain the row pipeline shipped partial COUNT, SQL API P0
LQL-P10 block_stats (no exact SQL equivalent; disposition) deferred no none DEFER DEFER
LQL-P11 blocks_count (no exact SQL equivalent; disposition) deferred no none DEFER DEFER
LQL-P12 query_stats (SQL) shipped no STATS, SQL API P2
LQL-P13 first (SQL) shipped no ROWS, SQL API P2
LQL-P14 last (SQL) shipped no ROWS, SQL API P2
LQL-P15 top (SQL) shipped no SQL API P2
LQL-P16 uniq (SQL) shipped no VALUES, SQL API P2
LQL-P17 sample (SQL) shipped no SQL API P3
LQL-P18 facets (SQL) shipped no VALUES, COUNT, SQL API P2
LQL-P19 coalesce (SQL) shipped no SQL API P2
LQL-P20 copy (SQL) shipped no SQL API P2
LQL-P21 rename (SQL) shipped no SQL API P2
LQL-P22 format (SQL) shipped no SQL API P2
LQL-P23 math / eval (SQL) shipped no SQL API P2
LQL-P24 len (SQL) shipped no SQL API P2
LQL-P25 hash (evidence) shipped no none API P3
LQL-P26 collapse_nums (evidence) shipped no none API P3
LQL-P27 decolorize (SQL) shipped no SQL API P3
LQL-P28 drop_empty_fields (SQL) shipped no SQL API P2
LQL-P29 replace (SQL) shipped no SQL API P2
LQL-P30 replace_regexp shipped no none API P2
LQL-P31 split (SQL) shipped no SQL API P3
LQL-P32 extract (SQL) shipped no SQL API P2
LQL-P33 extract_regexp shipped no none API P2
LQL-P34 pack_json (SQL) shipped no SQL API P2
LQL-P35 pack_logfmt (SQL) shipped no SQL API P3
LQL-P36 unpack_json (SQL) shipped no SQL API P2
LQL-P37 unpack_logfmt (SQL foundation) shipped no SQL API P3
LQL-P38 unpack_syslog (SQL foundation) shipped no SQL API P3
LQL-P39 unpack_words (no exact SQL equivalent) shipped no none API P3
LQL-P40 json_array_concat (SQL foundation) shipped no SQL API P3
LQL-P41 json_array_len (SQL) shipped no SQL API P2
LQL-P42 unroll (SQL foundation) shipped no SQL API P3
LQL-P43 join (SQL foundation) shipped no SQL API P3
LQL-P44 union (SQL foundation) shipped no SQL API P3
LQL-P45 running_stats (SQL foundation) shipped no SQL API P3
LQL-P46 total_stats (SQL foundation) shipped no SQL API P3
LQL-P47 time_add (SQL foundation; evidence) shipped no SQL API P3
LQL-P48 generate_sequence (SQL; evidence) shipped no SQL API P3
LQL-P49 set_stream_fields (no exact SQL equivalent; evidence) shipped no none API P3
LQL-P50 stream_context (no exact SQL equivalent; disposition) deferred no none DEFER DEFER

LQL-P47 is a bounded Rust API transform over one public logs scan. time_add <duration> [at <exact-field>] uses the pinned VictoriaLogs compound duration and RFC3339Nano behavior, canonical UTC output, signed-64-bit nanosecond saturation, exact nested current-row mutation, later-pipe composition, and strict errors. Timeless defines zone-less timestamps as UTC to keep embedded behavior independent of the host timezone; the pinned oracle image is UTC, while upstream otherwise uses process-local time.

Invalid strings and native missing/null/number/boolean/array/object states are unchanged. Work, generated state, results, response bytes, deadline, and cancellation are bounded, and durable rows remain immutable through optimize and reopen. SQL-LOG-061 gives direct users an exact native-unit saturating shift plus an explicit sub-native nanosecond remainder. Arbitrary metadata RFC3339Nano parsing has no honest core-SQL equivalent. Because every row has already crossed the public boundary and no block can be pruned, an extension primitive or private-table access would not improve the retained storage model.

Exact release build db274f37b217862ef5ed35d2100675f7d1183b75 measures time_add at 3.243/3.519/3.640 ms narrow and 36.297/40.756/41.869 ms wide p50/p95/p99. Same-scan projection controls measure 2.884/3.197/3.303 and 32.900/35.390/36.245 ms. Candidate p95 is 10.1%/15.2% higher and request-attributed API means are 7.6%/8.3% higher. Every pair executes one public query and has identical block, decode, payload, match, return, and requested-work counters. QSF-244 accepts the bounded post-scan timestamp parse/format cost and records the 106,108 KiB whole-process logs HWM. The storage boundary and direct-user SQL foundation remain unchanged.

LQL-P48 is an input-independent Rust API generator with a complete core-SQL foundation. Pinned VictoriaLogs semantics include shared numeric spellings, positive fractional truncation, string-valued _msg, complete source/prefix replacement, last-generator-wins behavior, and later-pipe composition. Count, state, result, response, deadline, and cancellation limits remain explicit.

The normalized plan starts at the final generator and opens no public logs cursor. Exact release evidence measures 64 rows/886 bytes at 0.691/0.836/0.900 ms for an indexed-host source form and 0.640/0.780/0.839 ms for a full-fixture source form p50/p95/p99. Both execute 50 API requests while recording zero public query, candidate-block, decode, payload, match, and returned-row work. The 6.6% lower wide-form p95 is ordinary loopback variation between semantically identical scan-free requests, not a storage effect. SQL-LOG-062 gives direct users the bounded recursive CTE; there is no extension primitive because correct execution reads no storage.

LQL-P49 is a bounded Rust API result transform, not a persisted stream mutation and not a substitute for the deferred LQL-F35/LQL-F36 storage identity. set_stream_fields [if (<filter>)] <field-filter>, ... selects exact, trailing-prefix-wildcard, or all fields from each current pipeline row. For Timeless rich rows, wildcard selection recursively exposes object leaves under dotted names while arrays remain atomic compact JSON. Missing, null, empty, and exact object-parent values are omitted. Selected values use the existing textual projection; names are sorted bytewise and values use Go strconv.Quote-compatible escaping before the canonical {name="value",...} string is written to _stream. A matching row receives an empty _stream_id; an unmatched conditional row preserves both current columns. Durable metadata remains unchanged through optimize and reopen.

There is no honest portable SQL equivalent: core SQLite/libSQL has neither the dynamic current-row field-filter contract nor Go's Unicode-print and control-byte quoting. Fixed application-defined concatenation is useful but is not LogsQL parity. Every selected value has already crossed the bounded public logs row boundary, so a language opcode or private-table path in the extension would not prune blocks, avoid decode, or reduce row crossing. Grammar, condition evaluation, recursive selection, canonicalization, limits, cancellation, and response semantics remain in the Rust logs API.

Exact release build bf82f7625a15170b93d2a7ea8e8fd5ec94d6300c measures 64-row set_stream_fields responses at 3.040/4.564/5.399 ms narrow and 38.316/40.091/45.371 ms wide p50/p95/p99. Equal-read format controls measure 3.376/3.633/4.119 and 37.514/38.555/39.040 ms. Candidate p95 is 25.6%/4.0% higher, while request-attributed API means are 4.4% lower narrow and 1.4% higher wide. Every pair returns the same 64 rows and 1,856 bytes and performs byte-identical public block, decode, payload, match, and row work. QSF-264–QSF-266 accept the bounded post-scan transform and reject an extension opcode that cannot avoid storage work or row crossing.

LQL-P50 remains deferred behind the same versioned stored-stream contract as LQL-F35 and LQL-F36. Pinned VictoriaLogs groups the initial matches by tenant-scoped _stream_id, performs additional time-range searches against each exact stream, merges bounded rows before and after every match, orders contexts, deduplicates overlaps, and emits stream-aware delimiter rows. It is not adjacency in the original result and cannot be reconstructed from an ordinary metadata field without inventing identity and mixing streams.

Five successful and five strict-error cases pass inside the complete 1,429- case immutable oracle. Timeless rejects genuine top-level or nested stream_context pipes with a source-positioned HTTP 422 before any public storage read, while base-filter words, quoted text, comments, field names, and nested application metadata remain ordinary data. Shipping requires the complete LQL-F35 stream declaration/tenant/hash/index format plus bounded same-stream rereads, ordering, overlap/delimiter semantics, limits, cancellation, migration, durability, and reopen. There is no SQL recipe or performance benchmark for syntax the product deliberately does not execute, and no extension or storage contract changed.

LQL-P10 is deliberately deferred, not approximated. VictoriaLogs block_stats exposes one row per physical field column with its internal encoding type, dictionary item/byte counts, value bytes, bloom bytes, stream identity, and filesystem part path. Timeless rich-log blocks retain block-level timestamp/count/codec metadata, posting terms, and a compressed rich envelope; they do not retain compatible per-field dictionaries, blooms, stream IDs, or part paths. timeless_stats('logs') remains the public aggregate operational surface, but it is not a SQL equivalent for this pipe. Reconsider this row only after a versioned public per-field physical-accounting contract exists across every readable codec, with a stored stream identity, an honest SQLite block-location policy, bounded/cancellable enumeration, and direct-user utility. See QSF-147.

LQL-P11 is also deliberately deferred, for a different reason. VictoriaLogs increments one count for every non-empty internal blockResult reaching the pipe after all preceding filters and transforms. It returns a string-valued alias row, returns no row for an empty query, and changes when an earlier limit changes the processing batches. This is neither the persisted blocks total nor the cumulative query_candidate_blocks counter in timeless_stats('logs'). Timeless pipelines currently expose bounded rows but do not expose or retain request-scoped block lineage through filter, pagination, discovery, or aggregation transforms. Reconsider only after a public, request-owned execution-batch lineage/report contract defines persisted and buffered sources at every pipeline stage, remains correct under concurrency/transactions/optimize/reopen, and demonstrates direct SQLite or libSQL utility. Global stats deltas and private block IDs are explicitly not acceptable substitutes. See QSF-148.

LQL-P12 uses the request-owned execution-report prerequisite identified while evaluating LQL-P11, but it does not relabel persisted block totals or subtract process-wide counters. A fully consumed successful timeless_logs scan publishes one table-scoped report on that SQLite connection; timeless_log_query_stats consumes it exactly once. New, failed, and cancelled scans clear older reports. The Rust API replaces the storage-level matched count with the complete typed LogsQL post-filter cardinality, maps actual work into VictoriaLogs' fourteen string-valued fields, measures duration through the pipe position, and permits later pipelines. Timeless reads one encoded payload rather than separately addressable field-column files, so the complete payload is BytesReadValues/BytesReadTotal and unavailable physical components are zero. A preceding limit does not undo work already performed by the eager bounded API scan; VictoriaLogs' parallel early cancellation also makes its physical counts scheduling-dependent. See QSF-149 and QSF-150.

Session 13's typed pipe contract is intentionally more faithful than the flattened VictoriaLogs store. field_values uses deterministic type-tag order for missing, null, bool, exact numbers, strings, arrays, and objects; missing omits the value field. A positive limit selects a bounded deterministic subset and reports unknown hits as zero after overflow, while limit 0 means no operator-specific limit. field_names discovers actual top-level response fields in name order and counts presence including null/empty; it neither synthesizes _stream fields nor recursively flattens objects. fields/keep rebuilds exact dotted paths and supports top-level prefixes and *. filter/where applies the typed predicate AST to the current transformed row; storage-safe predicates remain in the initial selector.

LQL-P16 accepts one or more exact fields after optional by, in parenthesized or bare comma-separated form. Optional filter substring is a case-sensitive textual filter for the single-field form; hits and with hits add a collision-safe string count; and limit 0 means unbounded within the hard API limits. Missing, null, and empty values share one empty-text group whose selected field is omitted from stream JSON. Positive limit overflow resets every returned hit to string "0", matching the pinned VictoriaLogs contract. Upstream hash-map selection and order are unspecified; Timeless deliberately returns the first N bytewise structural keys in stable order. Work, unique groups, retained key state, results, response bytes, and cancellation are bounded over public rows. Executable SQL-LOG-030 provides the direct SQLite/libSQL single-field foundation; no extension primitive or private storage access is used.

LQL-P18 emits the most frequent nonempty textual values for every recursively flattened field in the current pipeline row. The default per-field result limit is ten, with default exclusion thresholds of 1,000 unique values and 128 UTF-8 bytes. keep_const_fields retains a field only otherwise omitted because one value appears in every selected row. Modifiers are case-insensitive, reorderable, and repeatable with the last numeric value winning. The pinned upstream parser accepts positive fractional numbers and truncates them; Timeless preserves that compatibility quirk explicitly while rejecting zero, negative, non-finite, missing, and malformed values.

Arrays remain one atomic JSON-text facet and objects become dotted leaves. Any overlong value or excessive textual cardinality excludes the entire field. Timeless orders field names bytewise, then values by hits descending and value bytewise; the value tie break is deliberately deterministic because the local upstream processor does not promise one. Input rows, field/value state, sort/output allocations, result rows, response bytes, and cancellation use existing request limits. Executable SQL-LOG-031 exposes the complete public JSON1/window-function foundation, including canonical special fields and native timestamp units. No storage primitive or private table is used. Exact-build evidence records 3.239/44.087 ms narrow/wide p95 versus 4.464/41.116 ms for byte-identical same-scan controls; QSF-163 accepts the mixed -27.4%/+7.2% variation above the unchanged public storage boundary.

LQL-P19 selects the first nonempty textual value from parenthesized exact, all-field, or prefix source filters, suppressing duplicate expanded names. Missing, null, empty strings, and exact object parents are empty in the flattened compatibility view; strings remain unquoted, numbers and booleans become text, arrays remain atomic JSON text, and rich object leaves are dotted sources. The destination defaults to _msg; optional default and as are textual and exact. Timeless expands wildcard leaves bytewise for deterministic current-row behavior and preserves an explicitly empty destination string in its rich response, while VictoriaLogs stream serialization omits empty-valued columns. A nested destination colliding with a retained scalar fails with an explicit HTTP 422 field_conflict instead of replacing rich data.

Input rows, temporary de-duplication/path state, result rows, response bytes, and cancellation use existing request limits. Executable SQL-LOG-032 provides the direct exact-field CASE/NULLIF/COALESCE foundation. The operation requires no extension primitive, private table, or storage-contract change. Exact-build evidence records 3.570/39.597 ms narrow/wide p95 versus 3.329/38.277 ms for byte-identical same-scan controls; QSF-165 accepts the +7.2%/+3.4% bounded row-transform cost above the public storage boundary.

LQL-P20 copies exact, all-field, or suffix-star prefix sources to exact, all-field, or suffix-star destinations. copy and cp are case-insensitive, as is optional, comma-separated pairs execute from left to right, and every later pair observes fields created by earlier pairs. Each wildcard source takes a snapshot at that pair, expands recursively flattened leaves in deterministic bytewise order, and keeps arrays atomic. Prefix-to-prefix copies substitute the source prefix; prefix-to-exact copies every match to one field, so the last deterministic match wins. An exact source with a wildcard destination preserves VictoriaLogs' unusual literal destination name, including the *.

Exact strings, numbers, booleans, arrays, null, and empty strings retain their JSON types and the source remains present. A missing exact source or exact rich-object parent becomes an explicit empty string because VictoriaLogs' query view contains flattened leaves rather than object parents. A wildcard-generated empty suffix is a literal empty field and is not the canonical _msg; exact quoted "" remains the established message alias. Timeless overwrites compatible scalar destinations but returns HTTP 422 field_conflict rather than replacing a retained object or descending through a scalar parent. Work, cloned temporary values, destination paths, results, response bytes, and cancellation use existing request limits. Executable SQL-LOG-033 provides the public exact-field JSON1 foundation; the operation requires no extension primitive, private table, or storage contract change. Exact-build evidence records 3.229/46.025 ms narrow/wide p95 versus 3.659/41.958 ms for byte-identical same-scan controls; QSF-167 accepts the mixed -11.8%/+9.7% bounded row-transform variation above the public storage boundary.

LQL-P21 moves exact, all-field, or suffix-star prefix sources to exact, all-field, or suffix-star destinations. rename and mv are case-insensitive, as is optional, comma-separated pairs execute from left to right, and later pairs observe the current row produced by earlier pairs. Each wildcard source snapshots recursively flattened leaves in deterministic bytewise order. All sources selected by one pair are removed before that pair's destinations are written. Prefix substitution, exact-to-wildcard literal destinations, unmatched-prefix no-ops, and prefix-to-exact deterministic last-write behavior match the pinned VictoriaLogs processor.

Exact strings, numbers, booleans, arrays, null, and empty strings retain their JSON types. Present exact leaves and wildcard leaves are removed from the current response row, with empty rich parents pruned; the durable stored row is never mutated. A missing exact source or exact rich-object parent writes an explicit empty destination and does not remove the retained object. Empty rich objects have no flattened wildcard leaves and remain present. A wildcard-generated empty suffix is a literal empty field distinct from canonical _msg, while an exact source with a wildcard destination retains the literal *.

Timeless overwrites compatible scalar destinations but returns HTTP 422 field_conflict rather than replacing a retained object or descending through a scalar parent. Work, moved temporary values, source/destination paths, results, response bytes, and cancellation use existing request limits. Executable SQL-LOG-034 provides the direct exact top-level JSON1 foundation and documents nested-parent pruning and conflict responsibilities. The operation requires no extension primitive, private table, or storage contract change. Exact-build evidence records 3.770/43.696 ms narrow/wide p95 versus 3.553/36.673 ms for byte-identical same-scan controls; QSF-169 accepts the +6.1%/+19.1% bounded move/prune/rebuild cost above the unchanged public storage boundary.

LQL-P22 interpolates quoted or unquoted patterns over the current rich row. The destination defaults to _msg; as accepts one exact field. Optional if (...) evaluates the existing filter language, including an empty match-all condition. Literal prefixes decode HTML entities. <field> uses the established textual projection; <_>, <*>, and <> are empty placeholders, and wildcard field references fail explicitly. The uc, lc, q, URL, hex, Base64, numeric-hex, time, duration, duration_seconds, and ipv4 options match the pinned VictoriaLogs processor, including raw fallbacks, simple Unicode case mapping, exact integer/scientific timestamp inference, and nanosecond RFC3339 output.

keep_original_fields retains a nonempty destination; skip_empty_results does so only when the formatted result is empty. Timeless retains explicit empty strings and rich source types even where VictoriaLogs stream JSON omits empty columns. A destination that would replace a retained object or descend through a scalar fails with HTTP 422 field_conflict. Pattern traversal, source-value projection, transform expansion, output, results, response bytes, and cancellation are bounded. Executable SQL-LOG-035 provides ordinary JSON1/printf interpolation for exact metadata paths. Language syntax, arbitrary patterns, codecs, conditional composition, destination mutation, limits, and HTTP envelopes remain in the Rust API; no extension primitive, private table, or storage-contract change is required. Exact-build evidence records 3.297/39.353 ms narrow/wide p95 versus 3.090/35.941 ms for byte-identical same-scan controls; QSF-171 accepts the +6.7%/+9.5% bounded formatting cost.

LQL-P23 evaluates one or more comma-separated floating-point expressions with case-insensitive math or eval. Entries execute from left to right, so a later expression can read an earlier result. as is optional; without an explicit destination, the canonical parenthesized expression text becomes the field name. Exact quoted and dotted retained fields are accepted, while wildcard destinations fail explicitly.

The precedence order is ^, *///%, +/-, &, xor, or, then default; every binary operator, including power, associates left. Unary plus/minus and parentheses are supported. Functions are abs, ceil, exp, floor, ln, max, min, now, rand, and one- or two-argument round. Function calls accept the pinned trailing comma. default replaces only NaN, while max and min skip NaN operands in VictoriaLogs order.

Fields and constants use the established VictoriaLogs math coercion chain: decimal/base-zero/scaled numbers, durations as nanoseconds, byte sizes, RFC3339 timestamps as Unix nanoseconds, and IPv4 addresses as unsigned integers. Missing, null, empty, arrays, objects, and invalid text become NaN. Results are string fields using fixed non-exponent rendering plus NaN, +Inf, and -Inf. Bitwise operations use the pinned unsigned conversion for negative, nonfinite, and out-of-range inputs rather than Rust's saturating float cast. now() is sampled once for the pipeline invocation; rand() is uniform on [0,1).

Timeless overwrites compatible scalar destinations but returns HTTP 422 field_conflict rather than replacing a retained object or descending through a scalar. AST nodes/nesting, evaluated work, temporary state, result rows, response bytes, and cancellation are bounded; durable rich source rows remain unchanged. Executable SQL-LOG-036 gives direct users an ordinary JSON1 arithmetic foundation for exact retained numeric fields and documents why SQLite CAST alone is not the complete coercion or language contract. Grammar, sequential composition, functions, coercions, destinations, limits, and HTTP envelopes remain Rust API work. The complete 690-case pinned oracle and QSF-172 record the language and retained-model boundary; no extension primitive, private table, or storage-contract change is required. Exact-build evidence records 3.357/39.127 ms narrow/wide p95 versus 3.292/37.655 ms for byte-identical same-scan controls; QSF-173 accepts the +2.0%/+3.9% bounded expression cost.

LQL-P24 measures one exact current-row field in UTF-8 bytes and writes a decimal string to one exact destination. Parentheses and as are optional; the default and empty quoted alias are _msg; case is ignored; and later pipeline stages observe the result. Strings count decoded bytes, booleans and numbers count their textual representation, and arrays count compact JSON. Missing, null, empty strings, and exact retained object parents count as zero under the pinned flattened-view policy, while dotted leaves remain addressable. Canonical _msg, _time, and level fields use their current rendered values.

Sources remain typed and immutable. A destination that would replace an object or descend through a scalar fails with HTTP 422 field_conflict. Traversal work, temporary state, result/response size, and cancellation are bounded. Executable SQL-LOG-037 uses public rows, JSON1, and a BLOB cast to distinguish UTF-8 bytes from SQLite's codepoint-counting length(TEXT). Grammar, canonical fields, sequential composition, limits, and HTTP envelopes remain Rust API work. The complete 711-case pinned oracle and QSF-174 record the language and rich-retention boundary; no extension primitive, private table, or storage-contract change is required. Exact-build evidence records 3.785/40.724 ms narrow/wide p95 versus 3.620/36.622 ms for byte-identical same-scan controls; QSF-175 accepts the +4.6%/+11.2% bounded byte-length cost.

LQL-P25 hashes one exact current-row field with seed-zero xxHash64, masks the result to 53 bits so every value is exactly representable as a binary64 integer, and writes its decimal string to one exact destination. Parentheses and as are optional; the default and empty quoted aliases are _msg; names are case-insensitive; and later pipes observe the written value. Strings use their decoded bytes, numbers and booleans their textual spelling, and arrays compact JSON. Missing, null, empty, and exact retained object parents use the empty byte string under the pinned flattened-view policy; dotted leaves and canonical current _msg, _time, and level fields remain addressable.

The Rust API streams arrays into the hasher after a bounded/cancellable traversal, caps cumulative work and temporary state, preserves native rich sources, and returns HTTP 422 field_conflict for unsafe destinations. Core SQLite/libSQL has no portable exact xxHash64 expression, so this row has an explicit no-SQL disposition rather than a misleading recipe. The complete 1,033-case pinned oracle and QSF-209 record the language and retained-model boundary. The required public scan and decode are unchanged. Exact-build evidence records 3.455/36.785 ms narrow/wide p95 versus 3.481/36.223 ms for same-public-work controls. QSF-210 accepts the -0.7%/+1.6% endpoint-tail variation and the larger decimal-hash response without adding an extension scalar.

LQL-P26 is a strict, API-owned current-row text transform. Pinned VictoriaLogs source defines optional if (...), optional exact at <field>, and terminal optional prettify grammar; decimal and eligible hexadecimal tokens collapse to <N>, while ordered prettification recognizes UUID, IPv4, time, date, and datetime token shapes. Timeless preserves native rich values when their textual projection is unchanged, writes a string only after an actual collapse, and never mutates durable source rows. Work, temporary state, result/response size, deadline, and cancellation are bounded.

Core SQLite/libSQL has no portable tokenizer with these exact boundaries and prettification semantics, so the foundation is none, not a misleading SQL recipe. The complete 1,055-case pinned oracle, direct evaluator regression, and real-extension durability regression close the semantic row. Exact-build evidence measures 3.135/34.525 ms narrow/wide p95 versus 3.143/36.735 ms for same-public-work controls. QSF-212 accepts the -0.3%/-6.0% endpoint-tail variation as whole-run/API variation after identical storage reads and keeps the transform above the unchanged public extension boundary.

LQL-P27 removes VictoriaLogs' exact Control Sequence Introducer byte form from one current-row field. The case-insensitive command defaults to _msg and accepts at most one exact quoted or dotted field. Wildcards, prefixes, parentheses, comma-separated fields, attached suffixes, and trailing tokens fail explicitly. It removes ESC [ followed by zero or more parameter bytes 0x30..0x3f, zero or more intermediate bytes 0x20..0x2f, and an optional final byte 0x30..0x7e. Incomplete CSI is removed, a byte outside those classes remains, and OSC/DCS sequences are unchanged.

Timeless preserves native missing, null, number, boolean, array, and object states when their textual projection contains no CSI; a real removal writes a string only to the request-owned current row. Sequential pipes see that string, while durable rich rows remain immutable. Work, temporary state, result/response size, deadline, cancellation, optimize, shutdown, and reopen are bounded by the shared contracts. Executable SQL-LOG-050 supplies direct SQLite/libSQL users an exact BLOB-state recursive-CTE foundation over public rows. The API still owns LogsQL grammar, rich no-op preservation, composition, limits, cancellation, and envelopes. The complete 1,069-case pinned oracle, direct evaluator regression, and real-extension durability regression pin the semantic boundary. Every row has already crossed the bounded public logs surface, so no extension primitive or private-table access is justified. Exact-build evidence measures 3.101/36.385 ms narrow/wide p95 versus 3.169/34.872 ms for identical-output, same-public-work format controls. QSF-214 accepts the -2.2%/+4.3% endpoint-tail variation and +1.4%/+3.7% request-attributed API mean as bounded current-row construction/scanning work after identical public reads. Storage formats and extension contracts remain unchanged.

LQL-P31 is a strict API-owned current-row literal split. Its case-insensitive grammar requires one quoted or compound-token separator, defaults the source and destination to _msg, accepts optional from and as keywords (including the upstream shorthand without either keyword), and requires exact quoted or dotted fields. Wildcards, prefixes, commas, parenthesized call syntax, attached suffixes, missing operands, and trailing tokens fail before storage work. The separator named from remains valid when quoted.

Splitting is literal and non-overlapping. Leading, trailing, and consecutive separators retain empty elements; a missing separator produces one element; an empty separator emits Unicode scalar values; and an empty source therefore produces [""] for a nonempty separator but [] for an empty separator. VictoriaLogs-compatible output is compact JSON-array text, including its exact \u003c and \u0027 spellings. Numbers, booleans, and arrays use the pinned textual projection; missing, null, and exact object parents project to empty text. The source remains typed and unchanged when the destination differs, and durable rows are never mutated.

The bounded Rust evaluator uses no BEAM, NIF, HTTP fallback, private table, or extension language syntax. It observes cumulative work/state/result/response, deadline, cancellation, destination-conflict, optimize, shutdown, and reopen contracts. The complete 1,091-case pinned oracle, direct evaluator regression, and real-extension durability regression pin the semantic boundary. Executable SQL-LOG-051 gives direct SQLite/libSQL users a public-row recursive-CTE/JSON1 foundation, including empty-piece and Unicode-scalar behavior. Every row has already crossed the bounded public logs surface, so the ordinary-SQL implementation does not justify an extension primitive or storage-contract change.

Exact-build QSF-216 measures split at 3.219/3.481/4.063 ms narrow and 37.529/38.655/40.113 ms wide p50/p95/p99. Identical-output composition controls measure 3.078/4.786/4.878 and 37.964/40.047/40.151 ms. Split p95 is 27.3%/3.5% lower, while request-attributed API means are 3.1% higher/1.4% lower. Each pair returns 64 rows and 1,984 bytes and performs byte-identical public work: one/four candidate blocks, 1,024/8,192 decoded entries, 128/8,192 returned public rows, and 235,778/1,914,055 payload bytes per query. The tail differences are retained as whole-run variation; the API means show bounded row-local splitting after an unchanged storage scan.

LQL-P28 removes every empty field from the current row. Empty means an explicit JSON null or a zero-byte string under the pinned VictoriaLogs textual field policy. Missing fields are already absent. Numeric zero, boolean false, nonempty strings, and arrays—including an empty array—remain present. Retained objects are traversed recursively; empty leaves and newly empty parent objects are pruned, while arrays remain atomic. A row with no fields after pruning is omitted. The case-insensitive command accepts no arguments, parentheses, aliases, or trailing syntax, and it observes fields created or selected by earlier pipeline stages.

Timeless preserves native JSON values instead of flattening durable metadata. The transformation mutates only request-owned response rows in place, with a 128-level nesting ceiling, a hard traversal-work bound, periodic cancellation, and the shared final result/response limits. Executable SQL-LOG-038 gives direct users an ordinary JSON1 recipe for removing one known empty metadata path; fixed schemas can repeat it in explicit CTE order. Dynamic current-row discovery, canonical fields, recursive parent/row pruning, limits, and HTTP envelopes remain Rust API work. The complete 722-case pinned oracle and QSF-176 record the flattened-versus-rich boundary. No extension primitive, private table, durable mutation, or storage-contract change is required. Exact-build evidence records 4.542/38.151 ms narrow/wide p95 versus 6.994/35.779 ms for byte-identical same-scan controls; QSF-177 accepts the -35.1%/+6.6% bounded in-place traversal variation.

LQL-P29 performs case-sensitive literal replacement over one exact current- row field, with optional if, at, and first-N/zero-unbounded limit modifiers. Timeless preserves native retained values when no literal matches and materializes a query-row string only when a replacement occurs. Public SQL-LOG-039 covers ordinary all-occurrence exact-field replacement through SQLite JSON1 and core replace(); conditional, limited, sequential, typed, bounded, and envelope semantics remain Rust API work. QSF-178 and QSF-179 record complete 740-case oracle parity and exact-build evidence.

LQL-P30 performs case-sensitive RE2-family replacement over one exact current-row field. It supports optional if, at, and zero-unbounded or first-N limit; dot-newline behavior and inline flags; numbered, named, and full-match capture expansion; literal dollar escaping; UTF-8 empty-pattern boundaries; and sequential current-row composition. Native values remain native on a no-match, while an actual replacement becomes a query-row string without mutating durable rich metadata. Pattern compilation, capture work, projected values, output, result/response size, and cancellation are bounded.

Core SQLite and the public extension have no portable RE2-compatible regexp- replacement scalar with capture-template expansion, so this row honestly has no SQL foundation or recipe. Direct users must compose it in their host or load a separate regexp extension. QSF-180 records the language/storage boundary and the complete 765-case pinned oracle. No extension primitive, private table, or storage-contract change is required. Exact-build evidence records 3.442/40.628 ms narrow/wide p95 versus 3.391/35.822 ms for byte- identical same-scan controls; QSF-181 accepts the +1.5%/+13.4% bounded regexp/capture-expansion cost above the unchanged public storage boundary.

LQL-P32 parses literal-delimiter patterns in the Rust logs API and applies them only to request-owned rows returned by the public logs table. It supports named and anonymous placeholders, HTML-decoded delimiters, nonempty first-prefix search and empty-prefix anchoring, default _msg or exact from sources, automatic Go double/single/raw quoted-string decoding, plain:, conditions, default empty writes, keep_original_fields, skip_empty_results, nested destinations, and sequential composition. Timeless retains explicit empty strings and preserved native rich values and rejects scalar replacement of a retained object. Work, capture state, paths, results, response bytes, and cancellation are bounded; durable rows remain immutable across optimize and reopen.

Public SQL-LOG-040 uses JSON1 and core instr()/substr() for two fixed unquoted captures. General LogsQL pattern grammar, quoted decoding, current-row mutation and preservation, limits, cancellation, and envelopes remain Rust API work. The complete 802-case pinned VictoriaLogs oracle and real-extension regressions cover the language boundary. No extension primitive, private table, durable mutation, or storage-contract change is required. Exact-build evidence records 3.269/39.052 ms narrow/wide p95 versus 3.201/33.944 ms for byte- identical same-scan controls; QSF-183 accepts the +2.1%/+15.0% bounded literal extraction/field-write cost above the unchanged public storage boundary.

LQL-P33 compiles one RE2-family pattern in the Rust logs API and applies it only to request-owned rows returned by the public logs table. The first match supplies every named capture; anonymous groups participate in matching but do not create fields. The command supports default _msg or one exact from source, optional if, case-insensitive syntax, dot-newline matching by default with inline flag overrides, (?P<name>...) and (?<name>...) groups, default empty writes, keep_original_fields, skip_empty_results, and sequential current-row composition. Strings, numbers, booleans, and arrays use the retained textual projection; preserved rich values stay native. Missing matches and unmatched optional groups become explicit empty strings in Timeless output. Writes that would replace a retained object fail with an actionable field-conflict envelope. Pattern compilation, captures, projected bytes, paths, work, response state, deadlines, and cancellation are bounded; durable rows remain immutable across optimize and reopen.

Core SQLite and the public extension expose no portable RE2-compatible named-capture extraction scalar. This row therefore has foundation none and no SQL recipe: direct SQLite/libSQL users must compose the regex in their host or deliberately load a separate general regexp extension. The language operation remains API composition over public rows. It does not justify LogsQL syntax, private-table access, or a language-specific primitive in the storage extension.

Exact-build evidence records 3.154/35.517 ms narrow/wide p95 versus 3.922/33.808 ms for byte-identical same-scan controls. The -19.6%/+5.1% p95 and -1.6%/+6.1% internal API variation follows exactly the same one/four blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 public rows. QSF-185 accepts the bounded first-match capture/write cost above the unchanged public storage boundary.

LQL-P34 packs an exact, prefix, or all-field snapshot of each request-owned row into one deterministic compact JSON object. The Rust logs API accepts the case-insensitive pack_json command, optional fields (...), default _msg, and explicit as or bare destinations. Selection is evaluated before the destination write, so packing _msg into _msg retains the source value in the generated object and later pipeline stages observe the packed string. Missing exact fields produce {}; prefix selection reconstructs nesting; overlapping selectors form an idempotent union. Work, selected paths, temporary JSON bytes, nesting, results, response bytes, deadlines, and cancellation are bounded, and request-local writes never mutate durable rows.

This is an intentional rich-row compatibility profile rather than byte-for- byte VictoriaLogs flattening. Timeless preserves JSON numbers, booleans, arrays, objects, explicit nulls, and empty strings; it emits one valid object with stable key order. VictoriaLogs v1.52.0 flattens values to strings, omits empty values, follows current column order, and can emit duplicate keys for overlapping selectors. The complete 850-case pinned oracle records both the upstream behavior and this selected difference.

Public SQL-LOG-041 uses only logs plus SQLite JSON1 to distinguish missing paths and preserve native JSON values while constructing a bounded object. LogsQL selector grammar, recursive prefix/all selection, destination mutation, limits, cancellation, and HTTP envelopes remain Rust API composition over public rows. No extension primitive, private table, durable mutation, or storage- contract change is required.

Exact-build evidence records 3.146/37.921 ms narrow/wide p95 versus 3.098/35.717 ms for same-scan controls. The +1.5%/+6.2% p95 and -1.3%/+7.4% internal API variation follows exactly the same one/four blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 public rows. Packed responses are 2,688 bytes versus 1,600 for the plain-field controls because every selected value is wrapped in a JSON object string. QSF-187 accepts the bounded rich selection/serialization cost above the unchanged public storage boundary.

LQL-P35 snapshots exact, prefix, empty-list, or all-current-field selections and writes deterministic logfmt text to _msg or one explicit exact destination. Grammar is case-insensitive; destinations may follow as or appear bare; terminal as keeps _msg; selectors may be quoted; and malformed lists, wildcards in destinations, attached suffixes, and trailing tokens fail before storage work. Selection precedes mutation, so an overwritten destination contributes its old value.

Timeless emits raw name=value pairs in bytewise field-name order. Exact missing, null, empty, and object-parent values emit empty text. Recursive prefix/all traversal flattens objects to dotted leaves, arrays remain atomic compact JSON, and values containing runes through U+0020, quotes, or backslashes use VictoriaLogs-compatible JSON-string quoting with exact \u003c and \u0027 spellings. Overlapping selectors form an idempotent union. This deliberately differs from VictoriaLogs v1.52.0 current-column ordering and repeated fields for overlaps; the complete 1,111-case pinned oracle records both the upstream behavior and the retained-model decision.

The bounded Rust evaluator owns language parsing, recursive current-row selection, destination mutation/conflicts, work/state/result/response limits, deadline cancellation, and HTTP envelopes. Durable source rows remain unchanged through optimize, shutdown, and reopen. Executable SQL-LOG-052 gives direct SQLite/libSQL users the fixed exact-path core-SQL/JSON1 foundation. Since all selected rows already cross the public logs surface, no extension primitive, private table, codec, format, or storage-contract change is justified.

Exact-build QSF-218 measures pack_logfmt at 3.459/3.805/4.335 ms narrow and 37.975/39.144/42.387 ms wide p50/p95/p99. Identical-output format controls measure 3.506/3.769/3.924 and 34.373/38.212/38.572 ms. The +1.0%/+2.4% p95 and -0.2%/+8.2% request-attributed API mean occurs after identical public work: one/four candidate blocks, 1,024/8,192 decoded entries, 128/8,192 returned public rows, and 235,778/1,914,055 payload bytes per query. The wide API mean is retained honestly as bounded current-row traversal, selection, quoting, and response construction; it does not justify storage pushdown.

LQL-P36 parses one exact current-row field as a JSON object and writes the selected values back into that request-owned row. The Rust logs API accepts case-insensitive unpack_json, optional if (...), default _msg, optional bare or from source fields, exact/prefix/all fields (...), preserve_keys (...), result_prefix, keep_original_fields, and skip_empty_results. The source is snapshotted before writes, so unpacking a JSON member over the source itself is deterministic and later pipeline stages see the replacement. Omitted or empty fields (...) selects all fields; missing exact selections become empty strings, while unmatched prefixes add nothing.

Timeless accepts a string containing a whitespace-padded JSON object or an already retained native object. It preserves native strings, numbers, booleans, arrays, objects, explicit nulls, empty strings, and empty objects; reconstructs nesting while retaining unrelated existing siblings; and keeps literal dotted JSON keys distinct from nested paths. preserve_keys makes a selected object atomic without converting it to text. The pinned upstream bare NaN token becomes the string "NaN". A malformed source beginning with { still supplies empty values for requested exact fields, matching the upstream boundary; other malformed/nonobject sources are no-ops. Default writes replace scalar values, keep_original_fields retains nonempty destinations, and skip_empty_results suppresses null or empty-string writes. Scalar writes cannot replace retained objects or cross a scalar parent.

VictoriaLogs v1.52.0 flattens nested leaves into textual columns, compact- serializes arrays, textualizes numbers and booleans, and maps null to empty text. Timeless deliberately retains its richer nested JSON model. The complete 875-case pinned oracle records the upstream grammar, selection, preservation, malformed-input, and textualization behavior; real-extension regressions pin the selected rich-value policy.

Public SQL-LOG-042 uses only logs plus SQLite JSON1 to validate one object source, select a fixed set of exact paths, distinguish missing/null/empty states, preserve native JSON subtypes, and reconstruct nesting. Dynamic LogsQL grammar, conditions, recursive prefix/all selection, current-row mutation, preservation modes, limits, cancellation, and HTTP envelopes remain bounded Rust API composition over public rows. No extension primitive, private table, durable mutation, or storage-contract change is required.

Exact-build evidence records 3.151/40.062 ms narrow/wide p95 versus 3.763/38.694 ms for equal-output pack-plus-copy controls. The -16.3%/+3.5% p95 and -0.5%/+3.3% internal API variation follows exactly the same one/four blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 public rows. All four responses are 2,112 bytes. The wide unpack_json p99 is retained honestly at 65.292 ms. QSF-189 accepts the bounded rich parse/select/write cost above the unchanged public storage boundary.

LQL-P37 parses one exact current-row field as logfmt and writes decoded string values back into that request-owned row. The Rust logs API accepts case-insensitive unpack_logfmt, optional if (...), default _msg, optional bare or from source fields, exact/prefix/all fields (...), arbitrary result_prefix, and one terminal keep_original_fields or skip_empty_results modifier. The source is snapshotted before writes; omitted or empty fields (...) selects all parsed names; unmatched prefixes add nothing; and every missing exact selection becomes an empty string.

Unquoted values end at ASCII space. Double- and single-quoted values use the pinned Go escape forms, including control, octal, \x, \u, and \U escapes; backtick values are raw and discard carriage returns. A malformed or unterminated quoted prefix falls back to unquoted parsing, lone names become empty values, and repeated names are last-wins. All decoded values are strings. Timeless reconstructs dotted names and prefixes into retained nested metadata while preserving unrelated siblings; names with empty path segments remain literal keys. This is the explicit richer-model policy over VictoriaLogs' flattened textual columns.

Default writes replace scalar destinations, keep_original_fields retains existing nonempty values, and skip_empty_results suppresses empty decoded values. Writes cannot replace retained objects or descend through scalar parents. Parsing, names, decoded bytes, paths, temporary state, work, results, response bytes, deadlines, and cancellation are bounded. Request-local mutation never changes durable source rows through optimize, shutdown, or reopen. The complete 1,134-case pinned oracle establishes grammar, quote and escape decoding, malformed fallback, selection, snapshots, duplicates, conditions, prefixes, preservation, and error behavior.

Public SQL-LOG-053 uses only bounded logs rows and a recursive CTE for a fixed set of keys in well-formed unquoted logfmt. Complete quoting/escaping, dynamic selection, current-row mutation, rich nesting, limits, cancellation, and HTTP envelopes remain Rust API composition over the same public rows. No extension primitive, private table, durable mutation, or storage-contract change is required.

Exact-build QSF-220 measures unpack_logfmt at 3.355/3.619/4.494 ms narrow and 41.166/42.437/43.357 ms wide p50/p95/p99. Identical-output pack-plus-copy controls measure 3.328/3.573/4.213 and 38.087/41.659/44.310 ms. The +1.3%/+1.9% p95 and +1.2%/+5.9% request-attributed API mean occur after identical public work: one/four candidate blocks, 1,024/8,192 decoded entries, 128/8,192 returned public rows, and 235,778/1,914,055 payload bytes per query. The row-local parse, escape decode, selection, and nesting cost is bounded and does not justify storage pushdown.

LQL-P38 parses one exact current-row field as syslog and writes decoded string fields back into that request-owned row. The Rust logs API accepts case-insensitive unpack_syslog, an optional leading if (...), default _msg, one optional bare or from exact source, an optional signed-duration offset, an optional result_prefix, and terminal keep_original_fields. Clause order is strict and unsupported syntax fails before storage execution. The source is snapshotted, missing sources are no-ops, and only leading ASCII space, tab, carriage return, and newline are trimmed; trailing message bytes remain exact.

The bounded parser covers RFC3164 and RFC5424, optional PRI, all 24 facility keywords, all eight severity levels, partial invalid-input behavior, RFC5424 structured-data identifiers and quoted parameters, CEF base and extension fields, and CEE JSON objects. RFC5424 timestamps remain lexical. RFC3164 RFC3339/ISO timestamps normalize to UTC independently of offset; classic timestamps use the request year and host timezone or explicit fixed offset, move to the previous year only when more than one day in the future, and reproduce Go's leap-day normalization. CEE numbers and booleans become text, arrays become compact JSON text, nested objects flatten to dotted names, and null members are omitted.

Timeless reconstructs dotted decoded names and result prefixes as retained nested metadata while preserving unrelated siblings. This is the explicit richer-model policy over VictoriaLogs' flattened textual columns. Default writes replace scalar destinations; keep_original_fields retains existing nonempty destinations. Writes cannot replace retained objects or descend through scalar parents. Parsing, decoded fields and bytes, nesting, paths, temporary state, work, results, response bytes, deadlines, and cancellation are bounded. Query-backed conditions resolve under the same cumulative limits. Request-local mutation never changes durable public rows through optimize, shutdown, or reopen.

The complete 1,155-case pinned oracle establishes grammar, header and structured-data parsing, conditions, prefixes, preservation, CEF/CEE, partial invalid-input behavior, and strict errors. Direct source-parity tests also pin RFC3164 leap-day normalization that depends on the evaluation year. Public SQL-LOG-054 uses only bounded logs rows and core SQLite to decode the fixed RFC5424 header when structured data is -. RFC3164, structured RFC5424, CEF/CEE, timezone/year rules, current-row mutation, limits, cancellation, and HTTP envelopes remain Rust API composition over the same public rows. No extension primitive, private table, durable mutation, or storage-contract change is required.

Exact-build QSF-224 measures deterministic 64-row RFC5424 parsing after full public materialization at 3.391/3.581/3.802 ms narrow and 33.887/38.081/38.210 ms wide p50/p95/p99. Identical-output format-plus-copy controls measure 2.978/3.439/3.584 and 34.075/38.026/38.209 ms. The +4.1%/+0.1% p95 and +9.5%/-0.8% request-attributed API mean occur after identical public work: one/four candidate blocks, 1,024/8,192 decoded entries, 128/8,192 returned public rows, and 235,778/1,914,055 payload bytes per query. Each response is 64 rows and 1,984 bytes. QSF-223 separately records that decoding all 8,192 formatted rows before a terminal limit correctly exceeds the unchanged 100,000-work-item default; the measured representative shape limits before expansion without hiding the complete public scan. Bounded row-local parsing does not justify storage pushdown.

LQL-P39 snapshots one exact current-row field, extracts words in source order, encodes them as compact JSON-array text, and writes that text to one exact destination in the request-owned row. unpack_words defaults both source and destination to _msg; accepts bare or from sources, bare or as destinations, quoted/dotted exact fields, and a terminal drop_duplicates; and treats keywords case-insensitively. With no explicit destination, the source is replaced only after tokenization. Missing, null, object-parent, empty, and punctuation-only sources produce []. Malformed, wildcard, prefix, comma-separated, attached-suffix, and trailing syntax fails before storage execution.

A word is one maximal sequence of Unicode Letter, Unicode Decimal_Number, or underscore characters. Letter_Number, Other_Number, combining marks, and punctuation are separators. Case and normalization are preserved exactly; drop_duplicates retains the first occurrence of each byte-identical word. Timeless string sources remain exact, booleans and numbers use compact text, and retained arrays use compact JSON text before tokenization. Retained objects have no VictoriaLogs parent-column equivalent and therefore project as empty rather than discarding nested fidelity. Dotted destinations reconstruct retained nested metadata and preserve unrelated siblings; replacing an object or descending through a scalar returns HTTP 422.

The complete 1,175-case pinned oracle establishes grammar, source/destination defaults and aliases, Unicode categories, duplicate order, missing/empty/rich projection, and strict errors. Parser, input scan, tokens, duplicate state, JSON output, paths, work, results, response bytes, deadline, and cancellation are bounded. Request-local writes do not mutate durable rows through optimize, shutdown, or reopen. The same audit corrected ordinary LogsQL word boundaries that had used Rust's broader is_alphanumeric() and now share the exact Letter/Decimal_Number/underscore rule.

This row intentionally has no SQL foundation. Core SQLite/libSQL cannot portably classify Unicode Letter versus Decimal_Number while excluding Letter_Number, Other_Number, and marks; recursive ASCII SQL would be a weaker language. Every source already crosses the same bounded public logs scan, so a new extension scalar would not avoid block reads, decode, payload transfer, or required response-row materialization. Complete semantics remain bounded Rust API composition with no language opcode, private-table access, durable mutation, storage-format change, or batching/index/compression change. Exact-build QSF-227 measures ordered word extraction on 64 returned rows at 3.225/3.740/4.877 ms narrow and 36.912/38.564/39.308 ms wide p50/p95/p99. Equal-storage-work copies measure 3.250/3.493/3.534 and 34.241/35.662/36.075 ms. The +7.0%/+8.1% p95 includes exact Unicode category testing, first-seen deduplication, compact JSON-array encoding, and 640 extra response bytes after byte-identical public work: one/four candidate blocks, 1,024/8,192 decoded entries, 128/8,192 returned public rows, and 235,778/1,914,055 payload bytes per query. Request-attributed API means are 2.498/34.612 ms versus 2.479/33.106 ms, or +0.8%/+4.5%. The bounded post-scan cost is accepted and does not justify storage pushdown.

LQL-P40 snapshots one exact current-row array source and joins its top-level elements with an optional delimiter. json_array_concat defaults source and destination to _msg; accepts optional from/as, their bare shorthand, quoted and dotted exact fields, and case-insensitive keywords; and replaces the source only after producing the complete result. Wildcards, prefixes, attached suffixes, missing operands, and trailing tokens fail explicitly.

Retained native arrays are traversed without flattening the source. A string source must contain a valid JSON array with optional surrounding whitespace. Top-level strings are decoded and joined without quotes; nulls, booleans, numbers, objects, and nested arrays use compact JSON text. The bounded Rust scanner preserves VictoriaLogs' raw numeric spelling, object order, nested escape spelling, and bare NaN, which a serde_json::Value or SQLite JSON1 round trip would silently normalize. Empty arrays, missing/null fields, malformed or scalar JSON text, and retained nonarrays produce empty text. Timeless returns that explicit empty value to preserve its richer missing/null/empty distinction; VictoriaLogs assigns the same empty value internally but omits it from its streaming JSON response.

Dotted destinations reconstruct retained nesting and preserve siblings; replacing an object or descending through a scalar returns HTTP 422. Parser, JSON traversal, decoded strings, raw spans, result bytes, paths, rows, response bytes, deadline, and cancellation are bounded. Request-local writes never mutate durable rows through optimize, shutdown, or reopen. The complete 1,199-case pinned oracle establishes the upstream grammar and raw-token behavior; real-extension tests add native rich-array fidelity.

Public SQL-LOG-055 uses bounded public logs rows and SQLite JSON1 to concatenate one fixed canonical array path. It cannot honestly preserve lexical number spelling or bare NaN, so complete behavior remains Rust API composition. Every value already crossed the public row boundary; no extension opcode, private table, durable mutation, or storage-contract change is justified.

Exact-build QSF-229 measures the native-array transform at 3.202/3.872/4.930 ms narrow and 34.373/35.216/35.316 ms wide p50/p95/p99. Equal-output format controls measure 3.332/3.418/3.614 and 38.555/40.200/40.598 ms. The +13.3%/-12.4% p95 and -1.1%/-8.4% request-attributed API mean occur after identical public blocks, decode, payload, materialized rows, sorting, limiting, projection, cardinality, and 1,536 response bytes. The narrow opposing endpoint/API result is retained as whole-run variation. Bounded traversal and writes do not justify storage pushdown.

LQL-P41 counts the top-level elements of one exact current-row field. The Rust logs API accepts case-insensitive json_array_len, parenthesized or bare exact source fields, optional as, bare or quoted exact destinations, and the default _msg destination. Source and destination may be dotted paths. The source is snapshotted before the destination write, so replacing it is deterministic and later pipeline stages observe the textual decimal result. Wildcard and prefix sources or destinations, multiple sources, missing parentheses, and trailing tokens fail explicitly.

A retained native array is counted without flattening or reparsing it. A string containing a whitespace-padded JSON array is parsed and counted; the pinned VictoriaLogs bare NaN token counts as one element. Nested arrays and objects each count as one top-level element. Empty arrays, missing paths, explicit nulls, malformed text, JSON scalar text, and native scalar or object values return "0". The transform preserves the rich source value, protects retained object destinations with an actionable 422 conflict, and bounds row, parse-tree, path, result, response, deadline, and cancellation work. Durable rows remain unchanged across optimize, shutdown, and reopen.

Public SQL-LOG-043 uses only logs plus SQLite JSON1 to count one fixed exact native-array or JSON-array-text path and return decimal TEXT. LogsQL grammar, current-row mutation, bare-NaN compatibility, limits, cancellation, and HTTP envelopes remain bounded Rust API composition over public rows. No extension primitive, private table, durable mutation, or storage-contract change is required. The complete 897-case pinned oracle records upstream grammar and scalar/malformed behavior; Timeless additionally pins native rich-array fidelity through the real extension.

Exact-build native-array evidence records 3.558/41.563 ms narrow/wide p95 versus 3.454/40.607 ms for equal-output constant-format controls. The +3.0%/+2.4% p95 and +2.4%/-0.0% internal API variation follows exactly the same one/four candidate blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, 128/8,192 public rows, and 1,344-byte responses. QSF-191 accepts the bounded O(1) native-array count and current-row write above the unchanged public storage boundary.

Statistics functions

The first optimization target is COUNT, which already avoids row decode. Other functions should begin as bounded API/SQL composition over typed fields; only measured repeated scans should create new extension vectors.

ID function Rust now foundation target priority
LQL-S01 count() (SQL) shipped COUNT API P0
LQL-S02 count(field) / count_empty (SQL) shipped ROWS API P1
LQL-S03 count_uniq / count_uniq_hash (SQL foundation) shipped VALUES, SQL API P1
LQL-S04 uniq_values / values (SQL) shipped VALUES, SQL API P1
LQL-S05 sum / avg (SQL) shipped ROWS, SQL API P1
LQL-S06 min / max / median (SQL) shipped ROWS, SQL API P1
LQL-S07 quantile / stddev (SQL foundation) shipped ROWS, SQL API P2
LQL-S08 rate / rate_sum (SQL) shipped COUNT, BUCKETS, SQL API P1
LQL-S09 sum_len (SQL) shipped ROWS, SQL API P2
LQL-S10 any / field_min / field_max (SQL foundation) shipped ROWS, SQL API P2
LQL-S11 row_any / row_min / row_max (SQL foundation) shipped ROWS, SQL API P2
LQL-S12 json_values (SQL foundation) shipped ROWS, SQL API P3
LQL-S13 histogram (SQL foundation) shipped ROWS, SQL API P3
LQL-S14 running count/last/min/max/sum via running_stats (SQL foundation) shipped ROWS, SQL API P3
LQL-S15 total count/first/last/min/max/sum via total_stats (SQL foundation) shipped ROWS, SQL API P3

LQL-S14 is the function-catalog view of the already-shipped LQL-P45 running_stats pipe, not a second LogsQL syntax surface. The pinned upstream reference exposes count, last, max, min, and sum only inside running_stats; the same source parser also accepts first, which the P45 implementation and tests retain. P45's parser, evaluator, oracle corpus, real-extension regression, SQL-LOG-059, exact-build benchmark, storage finding, and bounded-memory verdict therefore constitute S14's evidence. No duplicate running_count-style functions or extension primitive exist. The current complete 1,388-case live VictoriaLogs corpus, targeted real-extension regression, and all 130 executable SQL recipes/168 statements were re-run when the catalog row was reconciled.

LQL-S15 is likewise the function-catalog view of the already-shipped LQL-P46 total_stats pipe. The pinned reference exposes count, first, last, max, min, and sum only inside total_stats, whose parser reuses the shared running-state grammar in explicit total mode. P46's complete-group evaluator, oracle corpus, real-extension regression, SQL-LOG-060, exact- build benchmark, storage finding, and bounded-memory verdict therefore constitute S15's evidence. No duplicate total_count-style functions or extension primitive exist. The current complete 1,388-case live VictoriaLogs corpus, targeted real-extension regression, and all 130 executable SQL recipes/168 statements passed at reconciliation.

count(field) requires at least one present non-empty selected value; count_empty counts rows whose selected values are all missing, null, or an empty string. Exact unique cardinality uses complete typed tuples; the bounded hash variant uses stable FNV-1a cardinality and does not claim VictoriaLogs hash-bit identity. uniq_values returns deterministic typed non-empty values; values uses {items,missing} to remain lossless. Numeric functions ignore numeric strings. Integer-only sums stay exact when representable, extrema preserve the selected JSON number, and mixed/fractional sums, averages, medians, and rates use finite binary64. rate and rate_sum divide by the explicit final query interval in seconds; without a finite two-sided interval they return the undivided count or sum, matching the upstream operator contract.

sum_len(fields...) sums UTF-8 bytes across exact, prefix, or all-current- field selections. Missing and null values contribute zero; strings contribute raw UTF-8 bytes; and numbers, booleans, arrays, and objects use compact JSON text. Every selected traversal is work-bounded, the checked unsigned total fails explicitly on overflow, and cancellation leaves the public reader reusable. Timeless intentionally returns a native JSON integer rather than VictoriaLogs' decimal string. SQL-LOG-045 is the executable single-exact- metadata-path foundation; dynamic field selection, canonical fields, language grammar, limits, cancellation, and HTTP envelopes remain Rust API work.

Exact-build evidence records 3.223/3.460/3.940 ms narrow and 34.152/35.691/36.932 ms wide p50/p95/p99 versus 3.109/3.719/4.321 and 35.066/37.760/40.220 ms for same-run numeric-sum controls. The 7.0%/5.5% lower p95 follows exactly the same one/four candidate blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 public rows. QSF-195 accepts the bounded constant-state Rust reduction above the unchanged public storage boundary.

any(field) selects the first nonempty value in deterministic current- pipeline order and preserves its native JSON type. Missing, null, and empty strings do not qualify; zero, false, arrays, and objects do. VictoriaLogs only promises an arbitrary nonempty value and its selected value changed with physical encoding order during oracle audit, so deterministic selection is an explicit Timeless strengthening rather than a false upstream ordering claim. field_min(source,result) and field_max(source,result) compare nonempty source values with the VictoriaLogs signed/unsigned/timestamp/math/natural text comparator, preserve the first current-row tie, and return the companion result with its retained native type. A missing companion becomes the stable empty string; explicit null, empty strings, arrays, and objects remain distinct. Candidate traversals and retained state are work/byte bounded and deadline-cancellable. SQL-LOG-046 gives direct users deterministic exact- path any and finite-native-number companion extrema through public logs; the complete comparator, canonical fields, rich policy, limits, cancellation, grammar, and envelopes remain Rust API composition.

Exact-build any evidence records 3.077/3.293/3.597 ms narrow and 32.767/33.764/36.128 ms wide p50/p95/p99 versus 3.085/4.476/8.065 and 34.858/37.518/38.095 ms for equal-output numeric-minimum controls. Companion extrema record 3.182/3.306/3.849 and 34.004/36.738/42.084 ms versus 3.356/3.704/4.390 and 37.000/38.270/38.988 ms for equal-output native extrema controls. Their p95 values are respectively 26.4%/10.0% and 10.7%/4.0% lower. Every pair performs byte-identical public work: one/four candidate blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 materialized rows. QSF-197 accepts the bounded deterministic/rich Rust reductions above the unchanged public storage boundary and retains the 42.084 ms wide companion-extrema p99 honestly.

row_any(fields...) selects the first current row where any exact, flattened- prefix, or all-current field is nonempty, then returns every selected existing field from that same row as one native nested JSON object. Missing fields are omitted; selected null, empty strings, false, zero, arrays, and objects remain typed. row_min(source[, fields...]) and row_max require one exact nonempty comparison field, use the complete VictoriaLogs signed/unsigned/timestamp/ math/natural text comparator, keep the first strict tie, and default the result selection to all current fields. Empty selection returns {}. Function names are case-insensitive; result aliases may use as name or the upstream implicit name form. Candidate traversal, flattened-prefix descent, comparison keys, and complete selected objects are work/byte bounded and deadline-cancellable. SQL-LOG-047 gives direct users deterministic fixed- path rich selection and finite-native-number row extrema through public logs; dynamic selectors, canonical fields, complete comparison, limits, cancellation, grammar, and envelopes remain Rust API composition.

Exact-build row_any evidence records 2.880/3.097/4.720 ms narrow and 35.036/37.829/39.595 ms wide p50/p95/p99 versus 3.201/3.660/4.240 and 36.597/37.888/39.081 ms for same-scan scalar any controls. Its p95 is 15.4% lower/0.2% lower. Rich row extrema record 2.948/3.219/3.427 and 37.970/39.790/40.474 ms versus 3.022/3.429/3.737 and 34.149/36.227/37.943 ms for scalar companion-extrema controls, or 6.1% lower/ 9.8% higher p95. The rich responses are 36 versus 12 bytes and 101 versus 26 bytes; every pair nevertheless performs byte-identical public storage work: one/four candidate blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 materialized rows. QSF-199 accepts the bounded rich-object cost and retains the wide tail and whole- workload HWM honestly above the unchanged public storage boundary.

json_values(fields...) is implemented as both a statistics expression and standalone shorthand. Exact, quoted, dotted, prefix, empty/all, and repeated selectors produce one JSON-array string containing one selected object per current row. Missing paths are omitted; a row with no selected field becomes {}; explicit null, empty strings, false, zero, arrays, empty objects, and nested objects retain their native type and shape. Empty input still produces the string []. This is an explicit retained-model strengthening over VictoriaLogs' textual flattened columns.

Optional sort/order, optional by, parenthesized exact fields, and per- field asc/desc use the complete VictoriaLogs natural comparator. Timeless strengthens unspecified equal-key order to deterministic source order. A positive limit uses a bounded top-k; zero or omission remains subject to the hard result cap and fails rather than truncating. Sort-key projection, nested selection, retained heap plus index conversion, multiple expressions, encoded state, work/result/response limits, deadlines, and cancellation are bounded. The parser rejects invalid separators, wildcard sort keys, clause order, limit spelling, attached suffixes, and trailing tokens before storage work. An omitted alias uses VictoriaLogs' normalized function spelling, including normalized sort by, omitted asc, decimal positive limits, and no zero limit suffix.

Pinned VictoriaLogs v1.52.0 source and all 1,374 oracle cases establish the grammar, JSON-string envelope, missing-field objects, natural sort, top-k, and error behavior. Real-extension and direct evaluator regressions additionally pin rich fidelity, deterministic ties, cumulative bounds, immutable source rows, optimize, shutdown, and reopen. Public SQL-LOG-063 gives direct users fixed-path typed JSON1 composition with deterministic native-number sorting. Dynamic selectors, complete natural sorting, top-k, grammar, limits, cancellation, and envelopes remain Rust API composition after the required public scan; no extension primitive or private table is warranted.

Exact release build 898006684a82b5fd6cc0f7ff477c75e5c1778367 measures typed natural top-k at 3.275/3.557/3.967 ms narrow and 35.728/37.237/37.801 ms wide p50/p95/p99. Equal-scan bounded values controls measure 3.199/3.364/3.429 and 33.646/34.563/37.043 ms. Candidate p95 is 5.7%/7.7% higher; request-attributed API means are 2.546/34.506 ms versus 2.437/32.417 ms, or 4.5%/6.4% higher. Candidate responses are 3,663 bytes versus 451 because they contain 64 typed nested objects rather than the control's bounded unique-value envelope.

Every equal-width pair performs identical public storage work: one/four candidate blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 public rows. QSF-248 accepts the bounded API-owned selection/sort/encoding cost, unchanged four-block storage, zero queue and in-flight work, and 106,908 KiB complete-workload logs HWM. LQL-S12 is closed.

histogram(field) is implemented as a strict one-exact-field statistics expression and standalone shorthand over bounded public rows. Native JSON numbers and VictoriaLogs-compatible decimal, general-number, compound- duration, and byte-size strings feed the VictoriaMetrics logarithmic layout: 486 middle buckets at 18 buckets per decimal decade from 1e-9 through 1e18, plus fixed lower and upper buckets. Negative and NaN values are ignored; IPv4, RFC3339 timestamps, missing, null, booleans, arrays, and objects are not numeric histogram input.

Only nonempty buckets are returned. Each object contains a vmrange string and native unsigned hits, and the complete result is one JSON-array string in VictoriaLogs natural-label order. Intervals are lower-exclusive and upper- inclusive, with exact 1e-9 entering the first middle bucket; exact later boundaries enter the preceding bucket. Empty input emits the string []. Timeless additionally reads native rich nested paths without flattening or mutating them.

All 1,388 pinned VictoriaLogs cases establish grammar, aliases, input parsing, bucket edges, hit aggregation, ordering, empty results, and strict failures. Parser, evaluator, and real-extension regressions pin fixed 488-counter memory, cumulative multi-expression work, response-state limits, cancellation, immutable rich sources, optimize, flush, shutdown, and reopen. Public SQL-LOG-064 gives direct users an ordinary fixed-path native-number histogram over the public logs table. Textual duration/byte parsing, natural result order, LogsQL grammar, limits, cancellation, and envelopes remain Rust API composition after the unavoidable row crossing; no extension primitive or private storage access is warranted.

Exact release build 63081644c87fa67fe1c9874ea375195146262433 measures histogram aggregation at 3.317/4.329/5.812 ms narrow and 37.928/39.536/42.954 ms wide p50/p95/p99. Equal-scan bounded values controls measure 3.341/3.517/3.611 and 37.326/38.826/44.811 ms. Candidate p95 is 23.1%/1.8% higher; request-attributed API means are 3.008/37.328 ms versus 2.813/36.612 ms, or 6.9%/2.0% higher. Candidate responses are 268/278 bytes versus 164-byte controls.

Every equal-width pair performs identical public storage work: one/four candidate blocks, 1,024/8,192 decoded entries, 235,778/1,914,055 payload bytes, and 128/8,192 public rows. QSF-250 accepts the fixed bounded histogram/label-sort/encoding cost, unchanged four-block storage, zero queue and in-flight work, and 102,964 KiB complete-workload logs HWM. LQL-S13 is closed.

Query options and HTTP behavior

ID option/behavior Rust now target priority notes
LQL-Q01 deterministic asc/desc, limit, and offset (SQL) shipped API P0 Time sort uses (ts, stable engine order) in either direction; equal timestamps, aliases, zero limits, optimize, and reopen are pinned.
LQL-Q02 field projection in response (SQL) shipped API P1 Ordered fields/keep stages choose response fields; _time/_msg are retained only when selected, dotted metadata reconstructs its nested shape, and missing paths remain absent.
LQL-Q03 concurrency/parallel-reader options (no SQL equivalent; disposition) deferred DEFER DEFER VictoriaLogs controls CPU workers and I/O readers inside each query. Timeless executes one public SQLite cursor per query; its server reader pool and auth admission cap independent requests and are not equivalent.
LQL-Q04 time_offset (SQL; evidence) shipped API P2 Exact positive/negative/sub-native source bounds, nested inheritance/replacement, leading-filter optimizer order, nanosecond results, strict errors, limits, cancellation, optimize, and reopen are pinned by session_nineteen_time_offset_shifts_storage_results_pipes_and_nested_queries.
LQL-Q05 global_filter (SQL; evidence) shipped API P3 Query-wide compiled-predicate composition, nested inheritance/replacement, query-backed filter initialization, declaration-time time_offset scope, strict filter-only grammar, limits, cancellation, optimize, and reopen are pinned by session_nineteen_global_filter_applies_to_every_public_query_scope.
LQL-Q06 partial-response option (no SQL equivalent; disposition) deferred DEFER DEFER false is honored as the existing fail-closed behavior. VictoriaLogs can honor true only when another independent vlstorage owner succeeds; Timeless has one authoritative libSQL owner, so true fails explicitly before storage rather than becoming a no-op or hiding the only failure.
LQL-Q07 cancellation, deadline, row/response/sample limits shipped API P0 Hard defaults cap result rows, decoded/examined entries, response bytes, and wall time. Capability-advertised max_work_entries guards row/count/value reads before decode; dropped requests cancel SQLite/Rust work and readers remain reusable.
LQL-Q08 stable VictoriaLogs-compatible errors shipped API P0 Timeless intentionally improves the upstream 400 text envelope: malformed syntax is stable JSON HTTP 400 and unsupported capability is stable JSON HTTP 422, with neither reaching storage. See QSF-063.

LQL-Q03 is explicitly deferred rather than silently ignored. Six accepted and six parser-error cases pass the complete 1,441-case immutable VictoriaLogs oracle. Upstream concurrency limits CPU-bound workers within each query; parallel_readers independently selects I/O readers, inherits concurrency when omitted, and caps at 2,000. The options propagate to each storage node.

Timeless instead executes each public logs statement sequentially on one SQLite cursor and one reader thread. TIMELESS_LOGS_READER_CONNECTIONS controls how many independent requests can run on separate connections, while auth max_concurrent_requests limits per-subject admission. Neither setting can honestly satisfy intra-query worker counts. Top-level and nested options therefore return a source-positioned HTTP 422 before any public storage read. Shipping requires a bounded public partitioned-scan/fan-out contract with deterministic merge, exact work accounting, cancellation, reader reuse, and proof that multiple cursors do not duplicate block reads or weaken ordering. There is no SQL recipe or benchmark for deliberately rejected resource syntax, and no extension or storage contract changed.

LQL-Q04 shifts logical storage bounds backward and returned _time values forward without mutating retained rows. Eleven successful and eight error witnesses pass the complete 1,460-case immutable VictoriaLogs oracle. Nested queries inherit the outer option unless they explicitly replace it; retained millisecond/microsecond bounds use exact ceil/floor handling for sub-native remainders; and consecutive leading filter pipes preserve the upstream source-time optimizer order. Real-extension regressions pin rich fidelity, limits, cancellation, optimize, shutdown, and reopen. Public SQL-LOG-065 implements the same integer source-bound translation through the documented logs table. Exact-build evidence shows identical candidate/control public storage work and an 11.9%/13.2% narrow/wide p95 API-layer cost, so no extension primitive or private storage access is warranted.

LQL-Q05 compiles a leading global_filter=(...) option once and conjoins it with every public query scope: the base query, query-backed membership, query-backed pipeline conditions, join sources, and union sources. Thirteen successful and nine error witnesses pass the complete 1,482-case immutable VictoriaLogs oracle. The global predicate is composed before the local predicate; nested queries inherit it unless they declare a replacement; and all duplicate declarations are parsed even though the last value wins. A global-filter value is filter-only syntax, may contain query-backed filters, and cannot contain a result pipeline.

Scope is represented by compiled predicates rather than query-string substitution. This preserves quoting and source offsets, gives nested query-backed plans the correct initialization context, and lets every public scan retain its own work bound. A sibling time_offset does not rewrite a global value declared in the same option list; a global value can declare its own offset, and a nested declaration inherits the surrounding offset at its declaration point. Real-extension regressions pin strict pre-storage errors, cumulative limits, rich fidelity, cancellation, flush, optimize, shutdown, and reopen. SQL-LOG-066 gives direct users the ordinary-SQL equivalent: repeat the same predicate as a conjunct in every independently bounded public logs scan. No language-specific extension primitive or private storage path is warranted. Exact release build 72a392a0ed28f7c61c3c816a2c300c8caa588400 measures 3.322/6.102/7.881 ms narrow and 35.171/38.893/39.238 ms wide p50/p95/p99. Equal-public-work controls measure 3.493/5.040/7.254 and 38.350/40.365/41.518 ms. The narrow p95 is 21.1% higher despite a lower p50 and only 4.1% higher request-attributed API mean; the wide p95/API mean are 3.6%/6.8% lower. Every pair has identical blocks, decoded entries, payload bytes, matched rows, returned public rows, 64-row/2,560-byte responses, and unchanged four-block storage. QSF-273–QSF-276 close the row without a new extension primitive.

LQL-Q06 is explicitly deferred because the retained deployment has no partial-result topology. Nine successful grammar witnesses and seven errors pass the complete 1,498-case immutable VictoriaLogs oracle. Pinned source shows that allow_partial_response=true is meaningful only when multiple independent vlstorage owners are queried: an unavailable owner may be ignored if another succeeds, while configuration errors and complete outage still fail. The single-owner Timeless API cannot honestly implement that contract, and accepting the option as a no-op would falsely promise degraded availability.

Every upstream Go boolean spelling is validated and every duplicate declaration is parsed before the last value wins. false executes the normal complete fail-closed query at top level or in nested scopes. true returns stable HTTP 422 before storage. The separately accepted VictoriaLogs HTTP form parameter follows the same rule, and an explicit query option overrides its valid value; malformed booleans return HTTP 400. Nested membership, join, and union parsing preserves the unsupported classification rather than demoting it to malformed. Real-extension regressions prove rich complete results for false and zero public query, native-count, payload, or decode work for rejected true before and after optimize and reopen. There is no SQL recipe, performance benchmark, or extension primitive for the deferred true cluster-failure policy. Reconsideration requires multiple fenced public storage owners, unavailable-owner error classification, deterministic merge/order, cumulative limits and cancellation, plus explicit response-completeness metadata.

Higher-order library boundary

These features intentionally stay above timeless-libsql:

concern owner
live-tail subscriptions and fan-out timeless_logs / UI integration (LIB)
saved searches, dashboard variables, display formatting, and user history TimelessUI/Canvas/dashboard libraries (LIB)
alert rules, notification routing, and incident workflows higher-order log/control-plane libraries (LIB)
tenant/token issuance, role policy, and cluster administration Phoenix control plane (LIB); Rust enforces claims and limits
ingestion routing and framework logger bridges signal integration libraries (LIB); the Rust server owns durable admission

Parity gates

P0 first restores every useful prior Timeless grammar feature without copying the old parser's silent-ignore behavior. Invalid fields, levels, timestamps, numbers, or pipes must fail explicitly.

Each shipped filter or pipe is tested against the real extension with all eight severities, microsecond timestamps, typed and nested metadata, missing fields, empty values, pagination, both sort directions, reopen, cancellation, and response limits. Where VictoriaLogs provides the semantic oracle, a fixed differential fixture compares selected rows, order where guaranteed, fields, types, aggregate values, and errors.

Measurements record candidate blocks, decoded blocks/entries, term-index hits, result rows, p50/p95/p99, response bytes, and RSS HWM. An EXT addition requires evidence that a correct bounded API/SQL implementation pays an avoidable storage/decode cost.

Direct SQLite/libSQL equivalents for current filtering, ordering, pagination, substring, count, field discovery, metadata, and bucket operations live in the SQL equivalents cookbook.

Exact message predicates also carry their nonempty literal through the existing message_contains pruning superset. The final exact, case-sensitive predicate remains in the API. Public logs stats expose query_clp_pruned_blocks and query_clp_skipped_rows alongside decoded/returned entry counters.