CortexDB 0.12.4 — many applications and tenants on one server

0.12.4 is 0.12.3 plus what lets several applications, and many small tenants, share one CortexDB server or cluster. Upgrading from 0.12.3 is a drop-in replacement: the shard's apply format is unchanged, nothing new is stored in a new column family, and every addition below is off or unchanged unless a request or a setting asks for it.

New

• extra_scopes (capability extra_scopes_v1) on /v1/recall, /v1/recall/stream, /v1/answer and /v1/compose: up to 8 more scopes read in the same ranked pass as scope, for example an application's own scope plus a shared source:slack and source:jira. Each listed scope is authorized as a direct recall of it and read exactly (no ancestors or descendants); its events, facts, beliefs, episodes and concepts join the pack, and context_block lines from it carry its last segment as a tag ([source:slack]). Every extra scope must lie in the tenant subtree of scope (below). Design: docs/EXTRA_SCOPES_DESIGN.md.
• Memory kinds (capability memory_kinds_v1): GET /v1/events?intent=a,b lists only the events whose context.intent is one of the named kinds, and the recall field newest_of_kinds (at most 16) serves each listed kind as its newest event in the scope, first in the pack.
• Early answer for a whole-scope erasure (capability erasure_early_answer_v1): POST /v1/erasures with "respond": "accepted" answers 202 running as soon as the erasure is authorized and holds its lease. From that answer on, this node no longer serves the scope's events recorded before it, and the erasure finishes in the background under the same erasure_id, whose status, receipt and proof answer as for any job. The hiding lasts as long as the job and is held in memory: if the process dies mid-job, send the request again with the same idempotency_key.
• Per-tenant rate limits: CORTEX_SUBTREE_RATE_LIMITS=read=RATE[:BURST],write=RATE[:BURST] gives each tenant subtree its own budget per second (writes counted per item). Over it a request answers 429 SUBTREE_RATE_LIMITED with Retry-After. Off when unset.
• Usage per tenant: GET /v1/usage?scope= now reports storage (the events and bytes held under the scope) and, for a tenant or a scope above tenants, activity (reads, writes, bytes written, erasures). GET /v1/admin/usage/subtrees (operator) pages every tenant's counters. The counters are per node and survive a restart.
• CORTEX_TENANT_DEPTH (default 1, the scope's root) says how many leading scope segments name a tenant. Set it to 2 when tenants live under bucket roots (org:b7/org:acme): rate limits, usage and the extra_scopes rule then work per org:b7/org:acme.
• The presets allow the scope types employee, chat and role.

Faster

• A large scope's vector search scans its vector shards in parallel (CORTEX_PARALLEL_PARTITION_SCAN_MIN, default 4,096 vectors): per query, 9.3 ms became 1.35 ms at 32,000 vectors and 38 ms became 7.7 ms at 131,000. Results are unchanged.
• Each change to the scope registry is appended to a journal instead of rewriting the whole registry file, and forget tombstones are looked up by scope instead of scanned. A downgrade to 0.12.3 should follow a graceful stop (it folds the journal into the registry file).

Docs

• The API reference's rate-limit section described a per-caller limit and an X-RateLimit-Remaining header that never existed; it now describes what the server does.