v2026.5.15 - :cluster Actor Tombstones to STL

Release date: 2026-05-15 Profiles affected: :cluster, :core Status: Runtime and stdlib integration closure

Actor supervision now has a durable failure-audit path. Abnormal terminal actor exits still land in the bounded hot tombstone index, and can also be mirrored to a caller-installed sink. The stdlib adapter std.cluster.tombstones turns those records into canonical STL events stored by std.stl.lsm_store over std.db.lsm.GrainStoreBytes.

What Shipped

Supervisor supports setTombstoneSink, clearTombstoneSink, and append/failure counters.
runtime/cluster_bridge.zig exports sink installation, sink counters, tombstone count, stable stop-reason codes, and scalar record accessors.
std.cluster.local exposes the Janus C-ABI facade for sink callbacks.
std.cluster.tombstones provides ActorTombstone, event encoding, and append_lsm.
The AOT smoke test-cluster-tombstone-stl-jan proves a runtime actor crash can append an STL event from inside the sink callback, then rescan and flush the LSM-backed store.

Verification

./scripts/zb
./scripts/zb test-cluster-tombstone-stl-jan
./scripts/zb test-stl-lsm-store-v2
./scripts/zb test-supervision
./scripts/zb test-cluster-bridge
./scripts/zb test-std-cluster

Current Limits

Tombstone persistence is sink-driven; the supervisor does not own an implicit durable store.
The record pointer is valid only during the callback.
Actor state replay is not implemented. This closes tombstone audit persistence, not live state reconstruction.
Distribution, remote placement, and grain replay remain later :cluster work.