Changelog

All notable changes to Improv are documented here. Format: Keep a Changelog; this project follows Semantic Versioning.

Unreleased

0.11.0 - 2026-10-25

The release that makes Improv safe to share and fast at scale. In Postgres, every model now reads and writes as its owner, under row-level security on its catalog; one replication slot serves a whole database. Mentat 1.18.0 makes saving a large model linear (a 1M-row import takes about 105 s; it did not finish in 15 minutes before), and a one-cell save writes one cell (8 s → 4–8 ms at 1M cells). The desktop GUI and the TUI build models from scratch, rename and delete, undo, and offer a reload when another program saves; the GUI moves to egui 0.37 and passes keyboard-only and AccessKit checks. SUM and AVERAGE are exactly rounded. Formulas have named arguments, exponent literals and a depth limit that keeps every saved model loadable. Releases are signed, with checksums and SBOMs. The release qualification, against 0.10.0 on the same benchmark, is in docs/reviews/2026-10-25-v0.11.0-qualification.md.

Added

  • Incremental saves (B12). improv_store::Store::save_changes(model, &ChangeSet) writes only what an edit changed: the cells it names (each read by an index seek and upserted, or removed), and, if ChangeSet::structure is set, the categories, items, measures, views, LAMBDAs and meta, without a pass over every stored cell. It runs under the same high-water conflict check as save_model, so a concurrent writer is still refused, never overwritten. ChangeSet::between(old, new) derives the set in memory. The same API is in both backends (ModelStore / PgModelStore::save_changes and save_cells). Store::take_save_token / adopt_save_token move a save token without copying its Postgres snapshot. On a 1M-cell Mentat store a one-cell save takes 4–8 ms (it took 8.1 s), and on a 1M-cell Postgres model 2–11 ms (1.9 s).

  • Tutorials, tested in CI (guide, new “Tutorials” section). “A household budget on the desktop” builds a model with the CLI and opens it in improv-gui. The page is the test: docs/tutorials/mdtest.py runs its sh blocks in order and checks each text block against the output (crates/cli/tests/tutorials.rs, part of cargo test). “A live sales model in Postgres” binds an orders table, defines four formulas, switches to logical sync and watches inserts and deletes arrive; crates/pg_improv/tests/tutorial-sales.sh runs its sql blocks through psql on a scratch cluster configured from the page, in ci/pg_improv.sh on every Postgres major. “Analyzing a Parquet file in DuckDB” writes a Parquet file from DuckDB and models it with improv(source, model); crates/duckdb_improv/test/tutorial.sh runs it under both DuckDB CLIs in ci/duckdb_improv.sh.

  • A generated pg_improv SQL reference (docs/src/pg-reference.md): every function in schema improv with its signature, every improv.* GUC with its type, default, range and context, and the columns of improv.status and improv.models, read from a live extension by crates/pg_improv/tests/pg-reference.py. ci/pg_improv.sh runs it on every major and fails when the page is stale, or when a function, GUC or column has no description (UPDATE_DOCS=1 rewrites the page).
  • Generated CLI and HTTP references (docs/src/cli-reference.md, docs/src/http-reference.md): every command, argument, flag, default and environment variable of improv, improv-gui, improv-tui and improv-server from their clap definitions, and every operation of docs/openapi.json with its scope, parameters, body, responses and schemas. cargo test -p improv_cli fails when either is stale, as for the man pages.
  • Build a model from scratch in the TUI. improv-tui new.db opens a new (or empty) model instead of refusing it, and new keys build it: c adds a category and its items (Time: 2025, 2026, again to add more items), n a number input measure over the categories you list (Quantity: Time, Product), and w saves without quitting. = opens a define> line that takes what improv define takes: Revenue = Price * Quantity adds a derived measure (or gives an existing one a new formula), and Margin = LAMBDA(p, q, p - q) defines a named LAMBDA. Its errors are located and completed like a formula edit’s. ? now lists the keys above the function search. Every change undoes.
  • TUI undo and redo. u undoes the last change to the model (a cell, a formula, an import) and Ctrl+R redoes it, up to 50 steps, as the GUI’s Edit ▸ Undo does: the history keeps whole-model snapshots. Saved views are layout and stay. A failed import is no longer half-applied: it leaves the model as it was.
  • Build a model from scratch in the GUI. File ▸ New (Ctrl+N) starts an empty model at a new store file, a postgres:// URL, or in memory, and File ▸ Open… (Ctrl+O) opens one, both from a small panel; neither was built before. Worksheet ▸ Add Category, Add Item and Add Input Measure open the model browser at a new “New category” / “New item” / “New input measure” line, which each of its lists now ends with. A category’s tile also takes a new item: its right-click menu ends in a New item line. Each add autosaves and is one undo step; a name already used by a category, measure or LAMBDA is refused. A new input measure is a number over every category.
  • improv-server --static DIR and IMPROV_CORS_ORIGINS. For a web front end on the API: --static serves a directory’s files at / beside the API (an index.html for /, .wasm typed, nothing outside the directory); IMPROV_CORS_ORIGINS lists the browser origins allowed to call it cross-origin (off by default; * is refused). The HTTP Server page documents both, and polling /v1/measures as the way to see other writers until a change feed exists.
  • Accessibility checks (H2). Tests dump the GUI’s AccessKit tree and require a name on every Tab stop (573, with every window open); drive the grid and the menus with key events only; compute the theme’s WCAG contrast ratios; and check that the TUI shows nothing by color alone. Fixed on the way: menu rows, window title bars and close boxes, grid cells, tiles, view and function rows and 15 text fields had no accessible name (a cell now reads “2025, WidgetA: 100”); scroller arrows and resize bars were empty Tab stops; Enter on a grid cell opened its editor and committed it at once, so a cell could not be edited from the keyboard; and the TUI’s cursor and range were shown by color only (now reversed and underlined too), which NO_COLOR hid.
  • The TUI keeps your edits when a save fails (H6). q saves first; when that fails, from a full disk or because another program saved the model, the TUI stays open with the reason, and a second q quits without saving. A full disk now says so and that the edits are still there, and a conflict says to press R. Tests kill a TUI mid-save (kill -9) and reopen without loss or corruption, fill a 1 MB tmpfs under a save, and run two writers on one store.
  • The GUI and TUI notice other writers (H9). The GUI checks the store’s high-water every two seconds; when another program has saved, a Changed panel offers Reload (Revert to Saved) or Not Now, which hides it until the next outside save. The TUI checks on each key press and says once per outside save that R reloads. Nothing is overwritten meanwhile: a save from the stale window is refused as a conflict, as before.
  • The GUI says it is importing. A CSV import and its save block the window (8 s at 1M cells); the status line now reads “importing and saving…” with a wait cursor before the work starts, instead of the window freezing with no sign.
  • Rename and delete in the GUI. Click a category, item or measure in the model browser to pick it. Worksheet ▸ Rename turns its row into a line with the name selected (double-clicking an item or a measure does the same), and Enter renames it. Formulas follow the new name, and the clash rules are the ones adding uses. Worksheet ▸ Delete… asks in a panel what goes with it (an input measure’s or an item’s cells, a category’s items), then deletes. A measure a formula reads, or a category a measure ranges over or names, is refused with a message naming them, as improv.drop_measure refuses. Saved views lose a deleted measure’s worksheets and a deleted item’s filters and pages. Each autosaves and is one undo step.

  • Named LAMBDAs from the GUI’s formula list. Name = LAMBDA(p, …, body) on the last line defines a named LAMBDA, parsed by parse_definition and stored as improv define stores it; an existing name is redefined under its id, so its callers recompute. A redefinition that breaks a caller is refused. Each is autosaved and one undo step, and the model browser lists them.

  • improv.status shows each logical model’s memory, and improv.max_model_memory caps it. Two new columns, fold_bytes (the fold state of the model’s aggregated bindings) and engine_bytes (its live engine and input cells), estimate the heap the model holds in the sync worker, as of its last apply. They come from the sizes of what the worker holds and match the live heap within about 10 %. The new GUC improv.max_model_memory (MB, reloadable, 0 = no cap, the default) refuses a model whose live state would exceed it: the worker logs why, sets the model’s last_error, drops its live state and retries it with backoff, instead of growing until the backend is OOM-killed. New in improv_engine: Engine::estimated_bytes; in improv_pg_model::live: Mapper::fold_bytes and inputs_bytes. The 0.10.0 → 0.11.0 update adds the columns.

  • TEXTSPLIT takes Excel’s match_mode and pad_with: TEXTSPLIT(Code, "x", "", FALSE, 1 INTO Part) splits on x or X (match_mode 0 is exact, the default; any other value is #VALUE!). pad_with is accepted; it pads the short rows of a 2-D split, and a row delimiter is still #VALUE! (now a documented difference from Excel, with the reason), so it changes nothing yet. Both were argument count errors before. Goldens from Excel’s documentation; LibreOffice 25.2 and Gnumeric have no TEXTSPLIT.
  • "" inside a text literal is one ", as in Excel: "say ""hi""" is the text say "hi". It was a parse error, so no formula changes meaning. The GUI formula bar prints such text the same way, so a formula with a " in a literal shows as DSL instead of controlled English.
  • Named arguments in formulas: PMT(0.05, 12, Loan, type => 1), XLOOKUP(Id, Key OVER Row, Name, search_mode => -1), FIXPOINT(0, LAMBDA(r, r / 2 + 1), max_iter => 50). After the positional arguments, name => value sets a parameter by its Function Reference name (case-insensitive), each once and not one already given by position. A skipped optional parameter takes its documented default (the reference now writes it: [fv=0], [if_not_found=NA()], [lower_tail=TRUE]); one without a default cannot be skipped. Functions with a repeating parameter (SUM, LINEST, IFS) take arguments by position only. A misspelt name suggests the right one. The formula is stored and shown as the positional call, so saved models are unchanged. The GUI and TUI editors offer name => for the call’s remaining parameters, and signature help follows a named argument. New in improv_core_model::functions: FnDef::param_index, param_name, param_default, closest_param, and complete_named; call_at maps a named argument to its parameter.

  • improv.commit_capture = 'rows': commit mode recomputes only what a transaction touched. Commit mode recomputed the written tables' dependents in full at every COMMIT (2.1 s at 2.5M rows). Set the GUC to rows before improv.set_sync_mode(model, 'commit') and entering the mode installs statement triggers that capture the touched coordinates, so COMMIT recomputes only those: a 1,000-row INSERT commits in 145 ms, ten one-row INSERT statements in 112 ms. The triggers cost about 30% on a 1M-row INSERT. A write the capture did not see, a TRUNCATE, partitioned bound tables and aggregating formulas fall back to the full recompute. The default, relations, is unchanged: no triggers on your tables.

  • pg_improv: the resource limits left in D7. If max_worker_processes leaves no room for the sync worker, improv.status says the worker is not running and names the setting. wal_keep_size turns out not to limit the slot. On disk full while writing results, logical mode reports the error in last_error, leaves nothing half-written, and keeps the worker and the other models going. The new tests/limits.sh checks all three, and ci/pg_improv.sh runs it.

  • pg_improv: the full privilege matrix, in the README’s Privileges and summarized in the guide’s Postgres page. It covers superuser, improv_admin, owner, SET member, improv_user, writer and PUBLIC against every API action and read, and tests/privileges.sh checks each cell.
  • pg_improv: improv.models, a view listing every model with its owner, sync mode and result schema, plus may_change, which says whether the caller may act as its owner. It follows the catalog’s read policy.
  • pg_improv: the improv_user and improv_admin roles. CREATE EXTENSION (and the update to 0.11.0) makes them when missing. improv_user is what a non-superuser needs to build models: USAGE on schema improv, EXECUTE on the API, and the catalog DML that row-level security confines to its own models. Result schemas are now made by the extension, owned by the model’s owner, so a builder needs no CREATE on the database. improv_admin grants and revokes improv_user. It does not act on other roles' models, because that would mean acting as their owners; only a superuser does. DROP EXTENSION keeps both roles. drop_model and drop_measure drop result tables as the model’s owner, so a member of the owner with SET but not INHERIT may drop them too.
  • Release sums, signatures and SBOMs. Every GitHub Release carries SHA256SUMS over all its files, SHA256SUMS.sigstore.json (a cosign keyless signature from the release workflow’s GitHub OIDC identity, logged in Rekor), and a CycloneDX SBOM per binary, target and extension. ci/release-attest.sh makes them, and runs locally without the signing. Verifying a release is in the guide’s Running page and in CONTRIBUTING.md.
  • improv-server: token scopes, a token file, limits, an audit log, /v1 and OpenAPI. Each token has a name and a read or write scope; the read routes take either, POST /cells and /eval with "persist": true need write. IMPROV_API_TOKEN_FILE reads name:scope:secret lines, so secrets need not sit in the environment; the existing variables still work (IMPROV_API_TOKEN is a write token). IMPROV_MAX_BODY_BYTES sets the body limit (default 1 MiB), and IMPROV_RATE_LIMIT a per-token (or per-address) limit, 600 a minute by default, answering 429 with Retry-After. Every write, allowed or refused, is logged as a JSON line (who, route, model, status) to stderr or IMPROV_AUDIT_LOG. Routes are served under /v1, the old paths kept as aliases; /v1/openapi.json serves docs/openapi.json, which a test keeps in step with the router. The guide’s server page gains Audit log and Deployment (TLS through Caddy or nginx) sections.
  • What 1.x promises: Compatibility, a new Reference page. For each surface (formulas, the pg_improv functions, GUCs, result tables and improv.status, model files, the CLI’s arguments and exit codes, the /v1 HTTP API, the DuckDB functions and version floor) it says what is stable, what a 1.x minor may add, and how a deprecation works. The pg_improv catalog tables are internal, and the Rust crates are not a stable API in 1.x (J2 first).
  • pg_improv’s upgrade test covers every release on every major. tests/upgrade.sh checks that each released version (0.8.0, 0.8.1, 0.9.0, 0.10.0) has a chain of update scripts to this one and that ALTER EXTENSION pg_improv UPDATE finds a path from each. Then, on the Postgres major it runs on (CI: 15, 16, 17 and 18; 0.8.x shipped for 17 only), it updates a database from each release, with one model in each sync mode that release had (logical, trigger, manual, and commit from 0.10.0), and checks every model’s results, the 0.11.0 owner and row-level security, the worker, define, pg_dump and commit mode. Each release’s build is cached (PGI_OLD_CACHE, default ~/.cache/pgi-old/<version>/<major>, and an actions/cache in CI), so the whole matrix takes under a minute per major once warm. The test now runs Postgres from a private copy of the install, so it never writes the system’s extension directories.

  • A weekly scale regression gate (.github/workflows/scale-gate.yml, also run by hand). It runs the v0.10.0 benchmark’s probes at sizes that fit a GitHub runner: the engine’s wide, measures and pagerank probes, stress.rs at 100k cells, improv import-csv of 100k cells into Mentat, and pg_improv’s tests/scale.sh. It fails when a probe is more than 25% slower than docs/reviews/bench/baseline.json. Each time is taken relative to a reference workload (reference.rs, no Improv code) measured in the same run, so a slow or fast runner does not move the result. docs/reviews/bench/scale-gate.py runs and checks the probes, and writes a new baseline.

  • Concepts, operations and troubleshooting guides. The guide gains Concepts (the ideas before the syntax), When to Use Improv (each wrong fit, what to use instead, and the measured limits), and an Operations part: Monitoring (improv.status column by column, the improv_db slot, the worker’s log lines, alert rules, the HTTP server), Capacity Planning (sizing formulas and a worked 2.5M-row example), Backup and Restore and Operations runbooks (each procedure tested on PG 18), and Troubleshooting (every formula error message, CLI errors, “why is this slow”). docs/ops/ ships a postgres_exporter queries file and a Grafana dashboard. The guide’s contents are regrouped into Guides, Operations, Reference and Design.

  • Exponent literals in formulas: 1e-10, 2.5E+3, 6.02e23. Before, 2e3 was a parse error and FIXPOINT’s tolerance had to be written 0.0000000001. An exponent without digits (1e, 1e+) is a located error; one that overflows a 64-bit float (1e999) is the error number out of range (not infinity, and not Excel’s #NUM!), and one that underflows reads as 0. Names are unaffected, since a name never starts with a digit: e, E and e1 are still measures. The GUI formula bar prints such numbers back in exponent form (below 1e-6 and from 1e21), so they stay editable, the controlled English reads and writes them (price minus 1e-10, and now 2.5, which split at the point before), DuckDB’s improv_calc and pg_improv’s plimprov accept them, and improv_core_model::parser::number_literal is the shared printer.
  • Differences from Excel, a section of the formula guide (formulas.md): every place the language departs from Excel on purpose (== for equality, NOT and ^ precedence, no coercion, case-sensitive ==, dates as timestamps on LibreOffice’s serial numbering, missing cells, #N/A for Excel’s #CALC!, lists INTO a category, variadic FREQUENCY bins, TEXTSPLIT, no volatile functions), with what Excel does and why. Five that look accidental are planned as follow-ups (road-to-1.0 plan, E5).
  • The formula language’s stability policy for 1.x (Language stability): a 1.x release may add functions, optional trailing arguments, and syntax that is a parse error today. It will not change the result, result type or categories of a valid formula (except a documented bug fix, listed under Fixed), a function’s name or argument order, precedence, or the stored function ids. A deprecated form keeps working, warns in the editors, and is removed only in 2.0.

  • A man page for every command and surface, generated from the parsers. improv(1), one page per command in the git style (improv-import-csv(1), improv-set(1), … 23 in all), improv-gui(1), improv-tui(1) and improv-server(1) are built from the clap definitions and the hand-written sections in crates/cli/man/; improv-functions(7) from the function registry, the same source as the guide’s Function Reference. New hand-written pages: improv-formulas(7) (the language), pg_improv(7) (the SQL API and settings) and improv-files(5) (the model file, the CSV import format, the DuckDB model text). cargo test -p improv_cli fails when docs/man is stale or groff -man -ww warns; UPDATE_DOCS=1 cargo test -p improv_cli regenerates it. The release archive installs them as man/man{1,5,7}.

  • Shell completions for improv, improv-gui, improv-tui and improv-server, in bash, zsh and fish, generated from the same parsers into docs/completions/ (checked for drift the same way) and shipped in the release archive’s completions/.

  • pg_improv records each model’s owner. improv.model.owner (regrole) is the role that called create_model. The update from 0.10.0 fills it from the owner of each model’s result schema, which create_model made as the caller; a model without one gets the bootstrap superuser and a NOTICE.
  • crates/pg_improv/tests/privileges.sh (in ci/pg_improv.sh): a bound table with a row-level security policy that shows the owner half its rows gives results over that half in trigger, commit, logical and manual + recalc modes, whoever writes the table.

Changed

  • The GUI runs on egui and eframe 0.37 (was 0.29), the newest release (H4). The NeXTSTEP look is kept; text renders a little differently, the formula enable boxes draw filled, and the empty formula line’s hint is gray. Ctrl+Q again goes through Quit’s check for an unsaved in-memory model (egui 0.37 would close the window by itself). cargo deny allows egui’s Ubuntu font licence and no longer needs three advisory ignores.
  • FIXPOINT holds 34% less memory per edge, and a warm re-solve is 31% faster (B8, in part). At 10M edges (PageRank, 100k nodes) the live engine went from 845 to 556 bytes per edge, peak RSS from 13.3 to 10.1 GB, and the re-solve after one edge’s weight changes from 9.7 to 6.6 s. The FIXPOINT host evaluator keeps a reduction’s rows in flat vectors (it held two vectors per row), and a measure’s cell order stays put across an edit, so the row layouts still fit. A sum over a large category whose groups are sparse (SUM(W OVER Dst) of an edge list, a few cells per node) reduces in one level: its blocks held a row or two each and cost two arrangements. With exact sums the result is the same bits either way. The 500 bytes per edge and 2× re-solve targets are not met yet; what is left is in the road-to-1.0 plan, B8.
  • A category growing past 1,024 items no longer rebuilds (B4(b)). Over more than 1,024 items the simple reductions reduce in blocks, and the live engine (Engine::serves, so also pg_improv’s logical worker) treated the crossing as a change of plan and rebuilt the model. With exact sums, the blocked SUM, AVERAGE, MIN, MAX, the counts and AND/OR/XOR give the flat results bit for bit, so new items keep arriving as data. PRODUCT and SUMSQ, whose blocked rounding differs, still rebuild once at the crossing. MIN and MAX now order -0 below 0 (they took either, by position).
  • SUM and AVERAGE are exactly rounded. They add every value with no rounding (a fixed-point superaccumulator) and round the total once to the nearest double, in every evaluation path: the flat reduce, the two-level reduce of a category of more than 1,024 items, the live engine and the FIXPOINT host step. A flat and a blocked sum of the same values are now bit-identical whatever the grouping; before, Neumaier compensation was the exact sum’s nearest double except under extreme cancellation. No golden moved (the 10,000-value goldens were already exact). PRODUCT and SUMSQ are unchanged. The cost (none measurable on the 1M-item SUM probe) is in the guide’s Formula Language page.

  • Saves write what changed (B12). improv set and stream save only their cells; add-*, define, register-ext, scenario and save-view save structure without re-reading the cells. On the 1M-cell store improv set takes 5.3 s, all of it the load (it took 13.4 s; the save is now milliseconds). The GUI’s autosave after a cell edit, an undo, a formula or a new category writes only what the edit changed: a cell edit on the 1M-cell store takes 64 ms in total, of which the save is 16 ms (it took 8.0 s on the UI thread). A failed autosave’s changes are kept and written by the next save. The TUI’s saves (w, saving a view, the quit autosave) write the difference from the last save. Opening a Mentat store no longer re-transacts an installed schema: 0.21 s and 490 MB less per open of a 1M-cell store, which every GUI and TUI save paid. Imports and refreshes still do the full save.

  • Mentat 1.18.0 (was 1.16.0). Saving a large model is linear again: identity upserts and lookup-refs no longer scan the whole datom view per value. import-csv of 1M rows takes about 105 s; under 1.16.0 it did not finish in 15 min. At 200k rows it went from 99.5 s to 16.1 s, and a re-save from 185 s to 21 s. Reads are unchanged, and stores written by 1.16.0 open as they are (docs/reviews/2026-10-23-mentat-1.18-upgrade.md).

  • DuckDB improv() over 2.5M distinct coordinates: 11 s and 2.34 GB is now 4.6 s and 1.47 GB (DuckDB v1.5.6; v2.0: 4.7 s, 1.49 GB). The results are no longer turned into a row of owned strings per cell at bind time: they stay in the engine’s form, and each output chunk writes its 2,048 rows from them. The cells are sorted with a key per comparison, not one allocated per cell. The loaded inputs move into the model instead of being copied, so they are never held twice. New in improv_duckdb_model: cells and Cells (a range at a time); run still returns every row.

  • The engine holds 63% less memory per cell, and evaluates 3× faster (B7). A measure that joins measures of different categories (Revenue = Price * Quantity) is no longer collapsed by a reduce afterwards, nor is a single-result reduction, which saved two copies of every cell; the broadcast joins once, not twice; and coordinate keys stay inline. At 5M cells: the live engine 732 → 269 bytes per cell, evaluate’s peak RSS 3.38 → 2.35 GB, evaluate 13.5 → 4.5 s, Engine::new 14.2 → 6.0 s. Results are unchanged. The heap profile and the out-of-core decision (deferred past 1.0) are in docs/reviews/2026-10-23-engine-heap-profile.md.
  • improv-server: an unknown token gets 401, not 403. 403 now means the token is valid but its scope is too narrow. A 401 carries WWW-Authenticate: Bearer and a JSON error body.

  • pg_improv trigger mode is 3x faster per statement, and 20x with an index. A trigger-mode statement read each bound table once per binding, serially: pgrx ran the scoped load read-write, which kept Postgres from using parallel workers. It now finds the touched rows in one read-only (parallel) scan per table, reads them back by ctid for every binding, and reads only the touched coordinates' result rows. Integer, text, bool, numeric and uuid dimension columns compare as themselves, so an index on the bound dimension columns serves the scan. At 2.5M rows (PG 18): a one-row INSERT takes 105 ms (was 310), ten in one transaction 900 ms (was 2.9 s), a 1,000-row INSERT 159 ms (was 370); with an index on the dimension columns, 15 ms, 50 ms and 79 ms. The guide’s Postgres page says when to add the index.

  • The logical worker folds text min/max under the column’s collation. Before, every change to a text min or max binding reloaded the model. The fold now orders texts by the value column’s collation: bytes for C and POSIX, Postgres’s own compare (varstr_cmp) for any other deterministic one. A column with a nondeterministic collation, where only Postgres can tell which texts are equal, reloads on a change to its min, max or count_distinct (the rebuild reason is nondeterministic collation). Before, count_distinct compared bytes there and could count Apple and apple twice under a case-insensitive collation.

  • Float sums in the logical worker are exact and order-free. A float4/float8 column’s sum and avg keep the floats' exact sum (a fixed-point accumulator) and round once, so the result no longer depends on the order the changes arrived in. A fresh sum adds floats in scan order and can still differ in the last bits; the guide’s Postgres page documents this. An avg of a numeric column keeps its scale after deletes.

  • pg_improv: what_if is for those who may act as the model’s owner, and computes as the owner. It read as its caller, so a caller who saw other rows than the owner got deltas that came from what they could see, not from their edits. Once items became owner-only it would have returned nothing. Other roles now get permission denied for improv model "m": what_if needs to act as its owner, alice (see Privileges). It then reads the bound and result tables as the owner, as recalc does. To give a role what_if, the owner either grants membership (GRANT alice TO analyst WITH INHERIT FALSE, SET TRUE on PG 16+, GRANT alice TO analyst on 15), which also lets the role change the owner’s models, or creates a SECURITY DEFINER wrapper for one model and grants EXECUTE on it, which gives what_if on that model and nothing else. Either way the role sees results computed from what the owner can read. The pg_improv README’s Privileges section has the wrapper’s text.

  • improv parses its arguments with clap. Every invocation that worked still works, with the same output (a test, crates/cli/tests/compat.rs, pins them). What changed: --help and improv help <command> are clap’s, with a page per command; -V/--version print improv <version> as before. A usage error (unknown command, missing or malformed argument) now exits 2, not 1, and prints the usage line after the message; the message itself is unchanged (missing argument <db>, <measure-id> must be a number, got 'x', …). Errors from the model itself still exit 1. --at=Time=Q1 and -- before an argument now work as clap allows. An argument a command does not take is an error (exit 2): the hand parser ignored it, so improv eval m.db 102 --scenrio high evaluated without the scenario and improv init m.db extra succeeded.

  • improv-gui, improv-tui and improv-server parse their arguments with clap, and gain --help and --version. Their arguments are unchanged (improv-server [model] [addr], IMPROV_ADDR when addr is not given). An extra argument is a usage error (exit 2): improv-server panicked on one, and improv-tui with no model now exits 2 (it exited 1).
  • Adding items to a wide category is linear, not quadratic. Model::add_item and ItemInterner::register (CSV/SQL import, every pg_improv load, DuckDB improv()) scanned the category’s item list once per item. 300k items took 12.5 s through add_item and now take 40 ms (1M items: 140 s, now 0.15 s); DuckDB improv() over one 300k-item category went from 38 s to 1.6 s.
  • Defining many measures is linear, not quadratic. Model::measure_by_name and category_by_name scanned every measure (category) per lookup; they now go through a name → id index the model builds on first use (never saved). Parsing 20k chained definitions took 558 ms and now takes 25 ms.
  • One edit under SUM/AVERAGE/MIN/MAX/COUNT … over a large category is incremental. Over more than 1,024 items those reductions (and PRODUCT, SUMSQ, AND, OR, XOR, COUNTA) reduce in two levels, by blocks of 1,024 item ids, so an edit re-reduces one block: SUM(X OVER W) over 1M items takes 0.4 ms per edit (0.6 s before). Fractional SUM/AVERAGE/PRODUCT/SUMSQ over such a category are a fixed two-level summation and may differ from a single pass in the last bits; at up to 1,024 items results are unchanged.
  • Edits cost less per tracked measure. A measure that maps one input or map measure (M = X + 1, -X, X * 2) no longer gets a collapse operator and arrangement of its own, and the live engine has one output probe instead of one per measure: at 20,000 such measures an edit takes 0.13 s (0.73 s before), and the engine uses 1.4 GB (3.4 GB before).
  • improv_engine::CoordKey is a SmallVec<[(u32, u32); 3]> (was a Vec<(u32, u32)>): a key of up to three categories needs no heap allocation. evaluate of a 1M-cell grid takes 2.2 s (4.3 s), 5M cells 12.7 s (27.7 s), with 10–15 % less memory; a single-cell edit 56 µs (73 µs). API: build keys with CoordKey::from_slice, .into() from a Vec, or improv_engine::smallvec::smallvec![…], and look them up by slice (map.get(&[(c, i)][..])).
  • A live engine keeps two fewer copies of its input cells. Engine no longer shadows every input cell (nothing read the copy), and the worker frees the seed once it has applied it: a PageRank FIXPOINT over 10M edges peaks at 15.0 GB (16.8 GB before), about 1.0 kB per edge in the engine (1.2 kB).
  • count_distinct bindings load about 4x faster. pg_improv, storage_pg and the DuckDB improv() function read them as count(v) over SELECT DISTINCT dims, v (two hash aggregates) instead of count(DISTINCT v), which sorted every fact row by its text keys. On 2.5M rows the load query drops from 4.5 s to 1.1 s. Results are unchanged, NULLs included. recalc and a commit-mode transaction on the benchmark model drop from 5.6 s to 2.1–2.4 s.
  • pg_improv 0.11.0: one replication slot per database, not per model. Logical-mode models share the slot and publication improv_db (the union of their bound tables, kept by the new improv.sync_publication()). The sync worker decodes the WAL once per poll and routes each change by table to the models bound there; each model records its own position with its result writes, so a crash re-applies nothing twice, and a failing model rebuilds from its tables on its retry (backing off from 0.5 s to 60 s) instead of holding the slot back. One standby snapshot is logged per poll, not one per model. At 1,000 small models a one-row change used to wait 5–70 s and a write touching every model 97 s. ALTER EXTENSION pg_improv UPDATE drops the old improv_<model> publications, and the worker drops their slots and catches each model up with one rebuild. improv.status reports slot = 'improv_db'.
  • improv.what_if loads only the edited coordinates when every edit has the same categories and the chain they feed is element-wise (as in trigger mode): 0.27 s instead of 5.3 s for a one-cell edit on 2.5M rows. Other edits still load the whole model.

Fixed

  • FORECAST.ETS no longer panics on a target past 2⁶⁴ steps. A target far beyond the series (1E300 on a series of dates milliseconds apart) saturated the step count, and the next step overflowed; it now saturates too. Found by the reduction contract property test.

  • Evaluating a deep formula no longer overflows on Windows. evaluate ran on the caller’s thread, 1 MiB on Windows, where a formula at the depth limit (40) overflowed; the live engine’s worker had the platform default too. Both now run on an 8 MiB engine thread.

  • A formula nested too deeply no longer makes a model unopenable. A long operator chain (about 63 + terms) or deep nesting was accepted and saved, then every list/show failed with “recursion limit exceeded”. A formula’s tree may now be at most 40 levels deep (MAX_FORMULA_DEPTH) and 100,000 nodes once LET and LAMBDAs are expanded (MAX_FORMULA_NODES); past either, the parser says “formula nests too deeply (N levels; the limit is 40)” or “formula is too large”, at the operator where a chain passes it or the expression’s start. Every entry point checks: the CLI, the GUI and TUI editors, controlled English, improv.define, LANGUAGE improv, the DuckDB model text, and named-LAMBDA expansion. A LET chain that doubles per binding fails at once instead of taking seconds.

  • Formulas saved before the limit keep working. One stored as text (the Postgres catalog, LANGUAGE improv) loads up to 256 levels, so a 45-term sum defined in 0.10 still computes. Past that, the error names the measure, and drop_measure or define(…, replace => true) of it still work. One stored as JSON and too deep to read back loads as #REF! with a description saying why, instead of making the model unopenable.
  • The guide’s examples, checked against the product (the pre-1.0 docs review, docs/reviews/2026-10-23-docs-review.md). Getting Started’s quick start now shows the line add-derived prints, and runs as a test. In The Formula Language, the immediately-called LAMBDA example is in parentheses (as written it parsed as a named LAMBDA and failed), and the page says the -- notes are not formula syntax. Improv in DuckDB gives the parse error’s real position. Running Improv’s quality gate leaves out both extension crates, so its cargo fmt line works.
  • crates/pg_improv/tests/finance.sh passes again, and CI runs it. It waited for four replication slots, one per model, but since 0.11.0 a database’s models share the one slot improv_db, so the guide’s family-finance example failed its logical-sync check. It now waits for that slot, and ci/pg_improv.sh runs it on every major.

  • improv-server sees other writers (H9). It cached the model and served that copy until one of its own writes was refused with 409, so a CLI set stayed invisible to GET /measures/:id/values. Each request now checks the store’s high-water mark first (Mentat’s newest transaction, a Postgres model’s improv.model_version: one query on a kept connection) and reloads when it moved. A write that races another writer’s save still gets 409.

  • A wide GUI grid draws only its visible columns. Rows were virtualized, but every row laid out every column, off screen or not: at 1,000 × 1,000 cells a frame took 125 ms (8 fps), idle or scrolling. Cells past the window’s edges are now skipped, and a row stops at the first column past the right edge. The same grid draws in 7.4 ms (135 fps) idle, 7.5 ms scrolling down and 9 ms scrolling right (release build, headless, tessellation included).

  • A GUI cell edit no longer clones the model. Every grid edit took a whole-model copy for its undo step (170 ms at 1M cells), and undoing it rebuilt the engine (2 s). An edit’s undo step is now the cell’s previous value, put back through the live engine: at 1M cells an edit takes 66 ms instead of 209, and its undo 52 ms instead of 2 s. Structural changes still record the whole model.
  • A failed GUI undo or redo can be retried. When the save behind an undo failed, the undo stack got the current model back instead of the undo point, so the retry, once the store was writable again, changed nothing and the step was lost. Redo had the same fault.
  • The GUI says why a save failed. A save conflict now reads “another program changed this model since it was opened, so the change was not saved and nothing was overwritten. Choose File ▸ Revert to Saved…”, and a full disk (SQLite’s “database or disk is full”, or the “disk I/O error” it reports when the disk fills as it grows a side file) says the disk is full. Before, the backend’s text was shown as is. New tests kill -9 a process mid-save and reopen the store (every acknowledged save there, nothing of the killed one, integrity_check ok), fill a real disk during saves (a tmpfs in a user namespace), and run two writers against one store.
  • A Mentat store forgets what the model dropped. save_model diffed only cells, so a category, item, measure or view the model no longer had stayed in the file and came back on the next load. An undone add in the GUI (a new derived measure, say) reappeared after a reopen. The save now retracts them in the same transaction, as the Postgres backend already deleted them. Likewise the last named LAMBDA, scenario or external function a model drops: the save skipped an empty meta blob, so the old one stayed.
  • pg_ctl stop -m fast no longer hangs on the pg_improv sync worker. The worker saw SIGTERM only between polls, so a fast shutdown waited for the poll in progress. A large apply (a 300k-row batch) ran past pg_ctl’s timeout, and the stop failed with “server does not shut down”. SIGTERM is now Postgres’s own die handler, so the worker stops at its next interrupt check, in under a second, with FATAL: terminating background worker "pg_improv sync" due to administrator command. It restarts from the slot position, so no change is lost.
  • R.QTUKEY no longer stalls on small probabilities with nranges > 1. It inverted R.PTUKEY, a double integral, by up to 65 bisections: R.QTUKEY(1E-10, 2, 2, 19) took 8 s in a debug build, and the property suite timed out on R.QTUKEY(1E-300, 2, 2, 19). It now runs a regula falsi on log p against log q, about a dozen integrals and at most 32 steps (R’s qtukey uses a secant). Results agree with the bisection to 1e-12 where R.PTUKEY is smooth, and the goldens are unchanged.
  • LINEST and LOGEST drop collinear x’s, as Excel documents (“removes any redundant X columns”), instead of #NUM!. An x that is a linear combination of the x’s before it (or, with const, a constant x) gets m = 0 and se = 0, the others fit without it, and df gains one per dropped x. LINEST(Y, X, D OVER T, TRUE, TRUE INTO K) with D = 2·X was #NUM!; it is now Y’s fit on X alone, with a 0 for D. Goldens from Gnumeric 1.12.57, which drops them the same way (dataset C in array_reduce_goldens.tsv); LibreOffice 25.2 returns an ill-conditioned fit or #VALUE!. One x was already dropped this way.
  • UNIQUE ignores case, as Excel’s does (and LibreOffice’s and Gnumeric’s): "Fig" and "fig" are one value, kept in its first spelling, and with exactly_once they count as a repeat. Before, text differing only in case stayed apart: UNIQUE of pear, Apple, fig, apple, kiwi, Fig was all six, now pear, Apple, fig, kiwi. Numbers, booleans and dates are unchanged. Goldens in array_reduce_goldens.tsv.
  • Number to text uses Excel’s General form. A number joined to text ("x" & n, CONCAT, TEXT(n, "General")), shown in the grid, or returned by DuckDB’s improv_calc_text switches to an exponent below 1E-4 and from 1E+15, with 15 significant digits, as Excel (and C’s %.15G) does. Before: "x" & 1e21 was x1000000000000000000000, now x1E+21; "x" & 1e-10 was x0.0000000001, now x1E-10; "x" & 1.5e-7 was x0.00000015, now x1.5E-07. Numbers from 1E-4 to under 1E+15 are unchanged. Goldens: numtext_goldens.tsv (scripts/goldens/numtext.py), checked against LibreOffice and Gnumeric, which differ from Excel and each other at the switch points (LibreOffice writes 1E+021 and switches at 1E-15 and 1E+16; Gnumeric keeps 17 digits).
  • pg_improv: a failed logical apply rolls back. The sync worker committed a model’s transaction even when its apply failed, keeping the result rows written before the error. Now the transaction aborts, so a failed apply (disk full, a constraint on a result table) writes nothing, and the abort releases everything the error left held.

  • SUM and AVERAGE are compensated sums: the exact sum’s nearest double. They now add with Neumaier compensation in every evaluation path, flat and two-level. Before, a sum of fractions could miss by tens of ulps in one pass and, over more than 1,024 items, a few ulps in the two-level reduce (which differed from 0.10.0’s one pass). Now SUM(0.1, 0.2, 0.3) is 0.6 (was 0.6000000000000001), and over 10,000 fractional values SUM is bit-exact against mpmath where the old two-level sum missed by an ulp and a left fold by 14 to 18. A sum that was already exact (integers) is unchanged, and no existing golden moved. PRODUCT and SUMSQ are unchanged. The decision and its cost (none measurable on the 1M-item edit) are in the guide’s Formula Language page.

  • -0 == 0 is TRUE. == and != compared numbers by bit pattern, so ROUND(-0.4, 0) == 0 and 0 * -1 == 0 were FALSE while <= said TRUE. Numbers now compare numerically (NaN stays unequal to itself); other values compare exactly, as before.

  • The coordinate-codec fuzz target builds again. CoordKey became a SmallVec (no Arbitrary), so it fuzzes the pairs as a Vec. Its lockfile, last refreshed at 0.5.0, is current, and CI now checks that the fuzz targets build.

  • The function reference’s date intro said serial date 1 is 1900-01-01, which is Excel’s numbering. Improv numbers as LibreOffice does (1 is 1899-12-31, 61 is 1900-03-01); the text now says so.
  • improv define and add-derived refuse a formula cycle. They saved formulas that depend on each other in a loop (A1 = B1 + 1 with B1 = A1 * 2), and every later eval of them failed. Now the command fails and saves nothing. The engine names the loop in its error, everywhere: formula cycle: A1 → B1 → A1 (was unsupported plan node in v1 dataflow builder: cyclic measure dependency at MeasureId(300)).
  • improv refresh-all reports measures in id order. It walked a hash map, so the order of its lines changed from run to run.
  • pg_improv: the idle sync worker no longer floods the server log. Every poll decoded the slot, and Postgres logs two LOG lines per decode (“starting logical decoding for slot improv_db”, “logical decoding found consistent point”), about 310 MB a day at the default poll_ms. A poll now decodes only when WAL was written since its last decode, and it decodes with log_min_messages = fatal.
  • pg_improv: pg_reload_conf() reaches the sync worker. improv.poll_ms and improv.max_changes changed only when the worker restarted. pgrx’s latch wait never reread the configuration; the worker now does that on SIGHUP.
  • pg_improv: pg_upgrade carries logical-mode models (PG 17 → 18). The sync worker exits in binary-upgrade mode, where it had held the slot that pg_upgrade --check reads (“replication slot improv_db is active”). An idle worker no longer writes WAL: two commit records a poll, which kept the slot from ever catching up, so pg_upgrade refused it. The README’s “pg_upgrade” section gives the procedure, including from PG 15 and 16 (drop the slot first, and the worker rebuilds), and tests/pg_upgrade.sh tests it.
  • pg_improv: failover. On PG 17+ the sync worker makes improv_db a failover slot. With sync_replication_slots on a standby, the models continue on the synced slot after a promotion. Without it (or on PG 15 and 16) the worker makes a new slot and rebuilds each model. improv.status works on a hot standby: lag_bytes was an error there, because it called pg_current_wal_lsn(), which recovery forbids. The README’s “Standbys and failover” gives the settings, and tests/failover.sh tests a primary, a streaming standby and a promotion, in both modes.
  • pg_improv: logical mode follows partitioned tables. The publication sent each partition’s changes under the partition’s own oid, which no model binds, so a model on a partitioned table followed no writes. improv_db is now publish_via_partition_root (set on an existing one too). Each partition gets the replica identity it needs, and attaching, detaching, dropping or truncating a partition rebuilds the model.
  • pg_improv: DROP EXTENSION pg_improv CASCADE no longer leaves the slot retaining WAL forever. The worker saw no extension and did nothing, so the improv_db slot pinned WAL until someone dropped it by hand. It now drops the database’s improv_db slot and publication when the extension is gone, and logs this once. The README’s “Removing pg_improv” gives the clean order and what a bare drop leaves: the result schemas (user data) and REPLICA IDENTITY FULL.
  • pg_improv: logical mode outside improv.database is refused. The sync worker serves one database. In any other, set_sync_mode(m, 'logical') succeeded and improv.status reported no error, with lag_bytes read from the served database’s slot of the same name, while results never followed writes. It is now an ERROR, with a HINT naming improv.database, and so is bind_measure on a logical model. improv.status matches the slot by database, and a logical model outside it reports “no sync worker serves this database” in last_error.
  • pg_improv: improv.max_slot_lag (default 4 GB, 0 = off). When the sync slot’s restart point is further behind, the worker drops the slot and rebuilds each model rather than retain more WAL. Logged once, and in last_error until the rebuild.
  • pg_improv: a failed slot creation no longer blocks every slot in the cluster. With max_replication_slots all in use, the worker’s caught ERROR left ReplicationSlotAllocationLock held, since a caught error skips the abort that releases LWLocks. Every later slot creation or drop in the cluster, pg_drop_replication_slot included, then hung. The worker now releases them, reports the reason in last_error, and makes its slot once one is free.
  • pg_improv: an invalidated slot no longer stops logical sync silently. When max_slot_wal_keep_size invalidated the improv_db slot, every poll logged “can no longer access replication slot”, improv.status showed no error, and results stopped following writes. The worker now drops the slot, makes a new one, and rebuilds every model, and it logs this once. last_error reports the lost slot until each model’s rebuild succeeds. Any other failure to read the slot also shows in last_error.
  • A plain restore of a database with a commit-mode pg_improv model failed. pg_restore without --single-transaction, and psql -f of a plain dump, commit each table’s data on its own and add primary keys last, so the commit hook’s recompute upserted into a result table with no key yet and aborted the restore (“there is no unique or exclusion constraint matching the ON CONFLICT specification”). A commit-mode recompute is now skipped, with a NOTICE, while a result table lacks its primary key; the dump carries the results, and the next write or recalc recomputes. tests/txn.sh restores a model of each sync mode both ways.
  • The PGXN publish job found no cargo. The pgxn/pgxn-tools image sets CARGO_HOME=/usr/share/cargo, so rustup’s env file is not under ~/.cargo; v0.10.0’s upload failed there and was re-run by hand.

Security

  • tokio 1.54.1 (was 1.53.1): RUSTSEC-2026-0386, AsyncFd’s safe constructors break I/O safety. Improv never constructs an AsyncFd; the bump clears cargo deny. pg_improv’s lock has tokio only through its test harness, bumped too.

  • Dependencies: ctutils 0.4.5 and clipboard-win 5.4.3. ctutils 0.4.2 (pulled in through postgres-protocol’s hmac/sha2/md-5, so the server and the Postgres stores) could branch on secret values (RUSTSEC-2026-0385); clipboard-win 5.4.1 (the GUI’s clipboard, on Windows) was yanked. cargo deny check fails on both.

  • The GUI’s Postgres store refuses a model its role may not act as. Under pg_improv 0.11’s row security such a role sees none of the model’s items or cells, so improv-gui postgres://…?model= (and the CLI) opened it empty. Opening now fails: “permission denied for improv model …: only its owner, …, or a role that may act as it may open it”.

  • pg_improv models act as their owner (C1). The logical sync worker connected as the bootstrap superuser and read every bound table that way, bypassing row-level security and table privileges, then wrote aggregates of rows the model’s owner may not see into result tables with ordinary grants. Every read of a model’s bound tables and every write of its results now runs as improv.model.owner (SetUserIdAndSecContext(owner, SECURITY_RESTRICTED_OPERATION), with search_path pinned), in the worker, in trigger and commit mode (which ran as the writing role), in define and in recalc (which ran as the caller). A worker apply whose owner lost SELECT fails with a last_error naming the columns. what_if reads as the owner too (see Changed). Only a role that may act as a model’s owner (a superuser, or a member with SET, the rule of ALTER TABLE … OWNER TO) may change the model or its owner: row-level security on every improv.* table, and a trigger on the owner. Before, anyone who could write the catalog could point a model at a superuser, or bind a table into another role’s model and redefine a result it shared, and so publish a table they could not read. A model’s input cells (improv.cell, improv.meta) are now readable by those roles only. A restore of the catalog runs as a superuser, as before, or as a role that may act as every model’s owner (pg_dump --enable-row-security --inserts).

  • A model’s items are readable only by those who may act as its owner. improv.item holds the distinct values of every bound category column: the bound tables' keys. Its read policy was USING (true), so any role with USAGE on schema improv could list the keys of a table it could not read. It now has the same owner-only policy as improv.cell and improv.meta, in a fresh install and in ALTER EXTENSION pg_improv UPDATE alike.

  • Writers no longer need privileges on schema improv. With the library preloaded, any write by a role without USAGE on improv failed (“permission denied for schema improv”: the commit hook looked up the catalog as the writer), as did any write to a trigger-mode model’s table by a role without the catalog privileges. Those lookups now run as the bootstrap superuser.

  • rustls-webpki 0.103.16 and webpki-roots 1.0.10 (were 0.103.15 and 1.0.9): RUSTSEC-2026-0382 and RUSTSEC-2026-0381, certificate paths through the distrusted emSign intermediates. Only libduckdb-sys’s build script uses them (to fetch DuckDB’s sources); no Improv binary links them.

0.10.0 - 2026-10-20

The formula language gets a function registry of 681 built-in functions with Excel’s and Gnumeric’s names (0.9.0 had a few scalars): math, text, dates, statistics, finance, lookups, arrays, LET and LAMBDA (named LAMBDAs too), engineering, options, distributions, matrix analysis, and FIXPOINT for iterative models such as PageRank. Every function has parameter names, help, autocomplete with ghost arguments in the GUI and TUI, and located error messages.

pg_improv 0.10.0 keeps large models live. Aggregated bindings (sum, count, min, max, avg and the new count_distinct) and new items apply incrementally in logical mode: on 2.5 million rows, a 1,000-row batch is visible in about 0.1 s with no rebuild. There is a new commit sync mode; you can redefine and drop measures from SQL; dimensionless results are supported; and named LAMBDAs are kept in improv.lambda.

New here: a DuckDB extension, improv, which loads into DuckDB 1.5.6 and 2.0; Mentat 1.16.0 from crates.io; Verus-proven integer kernels; and every release is published to PGXN.

Phases P1–P7 of the built-in functions plan: 674 functions (plus aliases) with Excel’s names, typed errors, the IF family, positional forms and recurrences, lookups, list results, LET and LAMBDA, and locale-aware entry.

Added

  • Category parameters in named LAMBDAs. A parameter the body uses where a category goes (OVER c, POSITION(c), RELABEL’s categories) takes a category at the call, so LOGNORM = LAMBDA(x, c, LN1P(x) / LN1P(MAX(x OVER c))) is called as LOGNORM(Authored, Person). A reduced parameter takes a measure, which keeps the body’s OVER when the call expands.
  • Named LAMBDAs in pg_improv. improv.define(model, 'LOGNORM = LAMBDA(…)') stores a named LAMBDA in the new catalog table improv.lambda (dumped with the model); the model’s formulas call it by name. Redefining one (replace => true) recomputes every measure that calls it, in the caller’s transaction, writing only the rows whose value changed; it is an error naming the measure when it would break one or change its type or dimensions. improv.drop_measure drops one, and refuses while a measure or another lambda calls it. The GUI’s Postgres store reads and writes the same table (it creates it on an older catalog). A model it saved with its lambdas in improv.meta still loads, and its next save moves them into the table.
  • Redefine and drop measures from SQL. improv.define(model, definition, replace => true) redefines a derived measure. Re-running the same definition changes nothing: no model_version bump, no result row written. A new formula recomputes the measure and its dependents in the caller’s transaction, in every sync mode, and writes only the rows whose value changed. improv.drop_measure(model, measure) drops a measure: a derived measure’s result table, or an input’s binding and cells. A replacement that changes the value type a dependent reads, and a drop of a referenced measure, are errors that name the dependent.
  • Dimensionless results in pg_improv. A derived measure with no categories, such as MaxVol = MAX(Vol OVER Person), gets a one-row result table with just a value column. recalc, every sync mode, what_if (its coord is {}) and status handle it; define no longer refuses it.
  • Role-playing categories: RELABEL(x, From, To) and SWAP(x, A, B). RELABEL(R[Dst, Iter], Dst, Src) ranges over Src × Iter with the same values; W > 0 AND SWAP(W, Src, Dst) > 0 is the reciprocal test (W read with its two roles exchanged), with no @ITEM or XLOOKUP. Items match by name; one with no namesake is dropped. See The Formula Language → Roles.
  • COALESCE(a, …, default) and FILL(x, default): a value for a missing cell. COALESCE has a cell wherever an argument over all the result’s categories has one, and takes the first argument with a cell there; FILL has a cell at every item combination of x’s categories. With Authored set for 2 of 4 people, COALESCE(Authored, Vol * 0) and FILL(Authored, 0) both give 4 cells, where IFNA and IF(ISNUMBER(…)) give 2. Both are an outer union in the dataflow (the arguments' cells, tagged by position, reduced to the first per coordinate), so input edits stay incremental; IF’s laziness is unchanged. See The Formula Language → Missing cells.
  • FIXPOINT(init, LAMBDA(r, body), [max_iter=100], [tolerance=1e-10]). A measure that is the fixed point of a step: r = init, then r = body®, until Σ|Δ| ≤ tolerance or max_iter rounds pass. Past max_iter it is the last iterate, never a hang (max_iter ≤ 10,000), so the language stays total. The engine solves it round by round, warm-starting from the previous result after an edit. A round evaluates the step’s plan in memory, with the cells of the measures it reads fixed for the solve (they still update incrementally on the dataflow); a step the host evaluator does not cover (PREV, recurrences) is a dataflow round. The two give the same cells bit for bit. The customer’s PageRank (damping 0.85, dangling mass spread uniformly) on 1,500 nodes and 100,000 edges matches a plain power iteration to 3e-15 in L1, in 14 rounds and 0.44 s (release), and to the same after one edge weight changes (0.07 s). On 10,000 nodes and 1,000,000 edges it takes 6.9 s, 1.2 s after an edit. See Fixed points in the formula guide.
  • Measures reduced together may range over different categories. They need to share only the OVER categories. The rest broadcast, and the result keeps them: SUMPRODUCT(r, M OVER Src) with r over Src and M over Src × Dst gives one value per Dst, and XLOOKUP(k, Key OVER Dst, X) takes an X with more categories than Key. These were “the measures reduced together must range over the same categories”.
  • RANK.DENSE(x OVER T, [order]) and COUNTUNIQUE(x OVER T). RANK.DENSE equals SQL’s dense_rank() OVER (ORDER BY x DESC), ties included (order 1 ranks ascending); COUNTUNIQUE (Google Sheets' name) equals count(DISTINCT x). The goldens are checked against PostgreSQL’s dense_rank() and count(DISTINCT …); LibreOffice and Gnumeric have neither function.
  • pg_improv: aggregated bindings are incremental in logical mode. A measure bound with agg (sum, avg, min, max, count, count_distinct) keeps per-coordinate fold state in the sync worker, so an INSERT, UPDATE (also one that moves a row to another coordinate) or DELETE updates its cell without a rebuild; deleting one of two rows that share a count_distinct key keeps the count. A TRUNCATE removes the relation’s cells without a rebuild too. Relations an aggregated binding reads get REPLICA IDENTITY FULL. A text min/max binding still rebuilds on change.
  • pg_improv: new items without a rebuild in logical mode. A row with a dimension value the model has no item for no longer rebuilds the model: the worker mints the item through improv.mint_items in its own transaction (same ids and order as a load) and feeds the row to the live engine. It still rebuilds when a formula reads that category’s item list (POSITION, PREV/NEXT, windows, INTO, FILL, RANK, …; the README lists them). improv_engine::session::Engine::serves tells whether a grown model still compiles to the engine’s graph.
  • pg_improv: improv.status counts the worker’s applies and rebuilds. Two new columns: incremental_applies (batches applied to the live engine) and rebuilds (full loads). The 0.9.0 → 0.10.0 update script adds them to improv.sync_state and recreates improv.status.
  • pg_improv: trigger mode loads only the touched groups. When the recompute is element-wise, each binding is read under a WHERE on the statement’s touched dimension values, so an aggregated binding loads only those coordinates' GROUP BY groups, not the whole fact table. Commit mode still recomputes the written relations' dependents in full (the README says why).
  • pg_improv: distinct counting. improv.bind_measure(model, measure, rel, key_col, agg => 'count_distinct') counts each coordinate’s distinct key_col values, as count(DISTINCT key_col) does (the result is a number). The improv.binding.agg CHECK accepts it; the 0.9.0 → 0.10.0 update script widens it. DuckDB’s input X = col count_distinct too.
  • A DuckDB extension, improv. improv_calc(formula, inputs) evaluates any Improv formula on named inputs from a JSON object (improv_calc('ROUND(PMT(rate/12, n, -pv), 2)', json_object(...))), NULL for an error value; improv_calc_text returns any type and renders errors (#DIV/0!). improv_functions() lists the 674 built-in functions with signatures (query := searches them). improv(source, model) reads a table or query, builds a model from a short spec (category Time = year, input Quantity = qty sum, Revenue = Price * Quantity) and returns one row per computed cell. Errors name the spec line. It uses DuckDB’s stable C API, so one binary loads into DuckDB v1.5.6 and v2.0. The DuckDB-free logic is a new crate, improv_duckdb_model. See Improv in DuckDB.
  • Formally verified engine kernels. A new crate, improv_verified, holds integer kernels with Verus specifications and machine-checked proofs, and the engine calls them: GCD / LCM (the result is the greatest common divisor, and LCM’s 2⁵³ overflow check is exact), base conversion (DEC2BIN, HEX2DEC, …, BASE: decoding an encoding gives back the value, every digit is in range), the 48-bit BIT* operations, the derived-measure build order (each measure after its dependencies; an error exactly when there is a dependency cycle), TAKE / DROP’s index range, and the coordinate-key projection and union behind every dimensional join (a sorted merge, which makes a 1M-cell Price × Qty evaluate about 18% faster). scripts/verify.sh and a CI job check the proofs. See Architecture & Design → Formal verification.
  • GUI formula autocomplete. In both formula editors a name being typed drops a list of matching functions (with their signatures and descriptions), measures and categories; Up/Down select, Tab or Enter accepts (a function as NAME(, caret after the (), Esc closes, and with the list closed Enter commits. The rest of the selected name, or inside a call the parameters still to give, trail the caret in gray, and a tooltip shows the signature with the current argument in bold.
  • GUI function help. Help ▸ Functions… (or F1, also while editing a formula) opens a window searching the built-in functions by name, alias and description, the matches grouped by category with their signatures, and the selected one’s category, aliases, description and argument types. Insert (or a double-click, or Enter) puts NAME( into the formula being edited, at the caret.
  • GUI located formula errors. Both formula editors (the selected row and the Name = formula line, which before reported only to the status bar) underline where a formula fails and show, under it, the message and a hint: the nearest measure or category names for an unknown one, what is missing or extra in a call, the ( left open, the OVER form an aggregation needs. A type or dimension error underlines the first function or measure its message names.
  • TUI function help and formula editing. ? (or F1, also while editing) opens a search over the built-in functions: the matches with their signatures, and the selected one’s category, aliases and description. Enter inserts NAME( into the edit. e/Enter on a derived measure edits its formula (symbolic or controlled English), with a caret. Tab completes function, measure and category names (again to cycle the matches); inside a call the status line shows its signature with the current argument marked, and the parameters still to type trail the caret, dimmed. A parse error keeps the edit open with the bad token underlined, a ^~~~ marker under it, the message, and a hint: “did you mean …?” for a misspelled name, the signature for a wrong argument count, the ( left open.

  • pg_improv commit sync mode (pg_improv 0.10.0; improv.set_sync_mode(model, 'commit')). Results commit or roll back with the writer’s transaction, as in trigger mode, but nothing is installed on your tables, and the model recomputes once per transaction, just before COMMIT (or PREPARE), not once per statement: 100 one-row updates in one transaction on a 10k-cell model commit in 82 ms against 6.6 s in trigger mode. A read before COMMIT sees the old results (improv.recalc(model) in the transaction reads your writes), and a recompute that fails aborts the COMMIT with an error naming the model. Needs pg_improv in shared_preload_libraries (or session_preload_libraries); set_sync_mode refuses it otherwise. As with trigger mode, the role that enables it needs the TRIGGER privilege on the bound tables, and every writer must be able to write the result tables. ALTER EXTENSION pg_improv UPDATE from 0.9.0 adds it.

  • Distributions (phase P7, 72): Gnumeric’s BERNOULLI, CAUCHY, EXPPOWDIST, GEOMDIST, LANDAU, LAPLACE, LOGISTIC, PARETO, RAYLEIGH, RAYLEIGHTAIL, SNORM.DIST.RANGE, OWENT, CUM_BIV_NORM_DIST; and the R-style R.D*/R.P*/R.Q* for BETA, BINOM, CAUCHY, CHISQ, EXP, F, GAMMA, GEOM, GUMBEL, HYPER, LNORM, NBINOM, NORM, POIS, RAYLEIGH, SNORM (skew-normal), ST (skew-t), T and WEIBULL, plus R.PTUKEY/R.QTUKEY, with R’s lower_tail and log_p flags. 456 goldens (Gnumeric 1.12.57; mpmath where Gnumeric is wrong: its bivariate normal is ½ too high for some sign combinations, R.DSNORM is wrong off location 0, R.PST ignores log_p).

  • Analysis reductions (phase P7, 30): matrices as a measure over two categories (MDETERM(A OVER R, C), LOGMDETERM, MINVERSE, MPSEUDOINVERSE, CHOLESKY, EIGEN, LEVERAGE; results row by row, INTO R2, C2 for a block); time series (HPFILTER, INTERPOLATION, FOURIER, PERIODOGRAM); SSMEDIAN, CRONBACH, LOGREG, LOGFIT; the normality tests ADTEST, CVMTEST, LKSTEST, SFTEST and their .STAT statistics; FORECAST.ETS (.ADD), .MULT, .STAT, .STAT.MULT, .SEASONALITY, a port of LibreOffice’s Holt–Winters, and .CONFINT/.PI.MULT for seasonality 0. 289 goldens (Gnumeric 1.12, LibreOffice), most to 1e-12.

  • Operands that share a category join over it: A[R, K] * B[K, C] spans R × K × C, so a matrix product is AB = A * B then SUM(AB OVER K) (in place of MMULT). Measures with no category in common are still refused.

  • Math extras (phase P7, 46): LAMBERTW, AGM, GD, ILOG, REDUCEPI, FIB; number theory (ISPRIME, ITHPRIME, PFACTOR, NT_D, NT_SIGMA, NT_PHI, NT_MU, NT_OMEGA, NT_PI, NT_RADICAL, PARTITIONS); FLT.MAX, FLT.MIN, FLT.RADIX, FLT.NEXTAFTER; the movable feasts (EASTERSUNDAY, ASCENSIONTHURSDAY, ASHWEDNESDAY, GOODFRIDAY, PENTECOSTSUNDAY); DATE2JULIAN, HDATE_JULIAN and the Hebrew calendar (HDATE, HDATE_HEB, HDATE_DAY, HDATE_MONTH, HDATE_YEAR, DATE2HDATE, DATE2HDATE_HEB); Erlang-B (PROBBLOCK, OFFTRAF, DIMCIRC, OFFCAP); text (ASC, JIS/DBCS, BAHTTEXT, ROT13, ENCODEURL, ROMAN, ARABIC). Bounded so each call finishes in about 2 ms. 303 goldens.

  • Engineering functions (phase P7, 72, a new Engineering category): base conversion (BIN2DEC … OCT2HEX, BASE/NUMTOBASE, DECIMAL/BASETONUM, HEXREP); 48-bit BITAND/BITOR/BITXOR/ BITLSHIFT/BITRSHIFT, DELTA, GESTEP; 45 complex-number functions over "a+bi" text, with Gnumeric’s inverse trigonometric and hyperbolic ones, IMFACT, IMGAMMA, IMIGAMMA; BESSELI/J/K/Y; CONVERT with Excel’s unit table and SI/binary prefixes. 530 goldens (LibreOffice, Gnumeric, Excel’s docs).

  • Option pricing (phase P7, 32 functions): Gnumeric’s OPT_BS and its Greeks (_DELTA, _GAMMA, _RHO, _THETA, _VEGA, _CARRYCOST), Garman–Kohlhagen, French, Merton jump diffusion, Miltersen–Schwartz, Barone-Adesi–Whaley, Bjerksund–Stensland, Roll–Geske–Whaley, a binomial tree, executive, forward-start, time-switch, simple and complex chooser, compound, writer-extendible, two-asset correlation, exchange (European and American), Kirk’s spread, fixed- and floating-strike lookbacks; and LibreOffice’s OPT_BARRIER, OPT_TOUCH, OPT_PROB_HIT, OPT_PROB_INMONEY. 200 goldens from Gnumeric 1.12.57 and LibreOffice; where Gnumeric’s bivariate normal is wrong, mpmath.

  • More list and LAMBDA forms. INTO R, C lays a list over several categories row by row (Excel’s 2-D spill); LINEST/LOGEST take any number of x’s (LINEST(y, x1, x2 OVER T, TRUE, TRUE INTO Row, Col) gives Excel’s 5 × (k + 1) block, checked against LibreOffice); SORTBY takes several by/order pairs; SELECTS(values, tests OVER T, condition); SELECTLIST (SELECT with a lookup over its own category); MAKEARRAY(R, C, LAMBDA(r, c, body)); SEQUENCE(T, [start], [step]); BYROW/BYCOL(x OVER C, LAMBDA(row, SUM(row))). An expression that reads no measure (positions, literals) now broadcasts with anything, so POSITION(R) * 10 + POSITION(C) spans R × C.

  • Named LAMBDAs. improv define model.db 1 "Margin = LAMBDA(p, c, p - c)", then Margin(Price, Cost) in any formula. Calls are stored as calls and expanded when compiled, so redefining a LAMBDA changes every use; a body reads only its parameters and earlier LAMBDAs (never itself). Saved in the Mentat (:meta/lambdas, installed over older stores on open) and Postgres (improv.meta) stores; the GUI and CNL print calls by name.

  • LET, LAMBDA, MAP, SCAN and REDUCE. LET names values for its body; a LAMBDA is called on the spot or passed to MAP (cell by cell), SCAN (a running fold along a category, SCAN(0, x OVER Time, LAMBDA(acc, v, acc + v))) or REDUCE (its last value). Folds compile to recurrences and update incrementally; a LAMBDA cannot recurse, so every formula still terminates.

  • List results (array functions) land along a category named with INTO: Top = SORT(Sales OVER Product, -1 INTO Rank) puts the largest value at Rank’s first item: SORT, UNIQUE, FILTER, SORTBY, TAKE, DROP, MODE.MULT, LINEST and LOGEST (one x; with stats, Excel’s 5×2 block row by row), TEXTSPLIT (each cell its own list, no OVER needed) and FREQUENCY (bins as separate numbers, FREQUENCY(x OVER T, 10, 20 INTO Bin)). Excel’s empty-array #CALC! is #N/A.

  • Lookups (phase P6), reductions whose key is a parameter (a key over another category gives one lookup per key cell): XLOOKUP, XMATCH, MATCH, LOOKUP, INDEX (VALUEAT), Quantrix’s SELECT, SELECTBETWEEN, SELECTGREATERTHAN, SELECTLESSTHAN; the database functions as aggregations with WHERE (DSUM, DAVERAGE, DCOUNT, DCOUNTA, DMAX, DMIN, DPRODUCT, DSTDEV, DSTDEVP, DVAR, DVARP, and DGET); ARRAYTOTEXT.

  • Lookups' shape: an aggregation’s parameter may range over categories the reduced measure lacks; the result gains them and each cell reads the whole table (TEXTJOIN(Sep, TRUE, x OVER Product) with Sep per Time).

  • 72 statistical reductions (phase P4), each F(x OVER T, …):

    • descriptive: COUNT, COUNTA, COUNTBLANK, SUMA, AVERAGEA, MAXA, MINA, AVEDEV, MEDIAN, MODE (MODE.SNGL), GEOMEAN, HARMEAN, TRIMMEAN, DEVSQ, STDEV/STDEVP/STDEVA/STDEVPA, VAR/VARP/VARA/VARPA (and the .S/.P spellings), KURT, KURTP, SKEW, SKEWP, LARGE, SMALL, PERCENTILE(.INC/.EXC), QUARTILE(.INC/.EXC), PROB, SUBTOTAL and AGGREGATE;
    • conditional, with Excel’s criteria (">5", "<>x", wildcards */?/~): COUNTIF, COUNTIFS, SUMIF, SUMIFS, AVERAGEIF, AVERAGEIFS, MAXIFS, MINIFS;
    • sums of products: SUMPRODUCT, SUMX2MY2, SUMX2PY2, SUMXMY2, SERIESSUM, POLYNOMIAL, PERCENTOF;
    • per item (the result keeps the category): RANK (RANK.EQ), RANK.AVG, PERCENTRANK (.INC/.EXC), TREND, GROWTH;
    • regression and tests: CORREL (PEARSON), RSQ, COVAR (COVARIANCE.P), COVARIANCE.S, SLOPE, INTERCEPT, STEYX, FORECAST (FORECAST.LINEAR), Quantrix’s EXPA, EXPB and EXPFORECAST, CHITEST, FTEST, TTEST, ZTEST (and their dotted spellings), and AUTOCORREL (GSL’s lag-1 autocorrelation).
  • Positions, neighbours, running totals and recurrences (the plan’s phase P3). POSITION(T), @ITEM(T), @ID(T), @ITEMCOUNT(T); PREV(x, T, [n], [default]) and NEXT; windows SUM(x OVER T[FIRST..THIS]), AVERAGE(x OVER T[THIS-2..THIS]); and recurrences, a measure that reads its own earlier values (Balance = PREV(Balance, Time, 1, Opening) + Deposits), computed as an incremental scan in item order.
  • Aggregations grow up: several OVER categories (SUM(x OVER Time, Region)), OVER ALL EXCEPT Region, WHERE filters, parameters (one value per group, literal or a measure), reductions of several measures at once, and rows in item order. New: FIRST, LAST, S, TEXTJOIN.
  • Date arithmetic in days: a date plus a number is a date, the difference of two dates a number of days.

  • New measures (improv add-derived / define, the GUI’s formula list, pg_improv define) take their type and categories from the engine, so a text- or date-valued formula is a text or date measure, and an aggregation’s result drops the categories it reduces.

  • 118 built-in functions, with Excel’s names (the plan’s phase P1):

    • the logical family IF, IFS, SWITCH, CHOOSE, IFERROR, IFNA, CLEARERROR, CLEARZERO and BETWEEN, all lazy: an error or a missing cell in a branch IF does not choose never shows;
    • the error functions ISERROR, ISERR, ISNA, NA, ERROR and ERROR.TYPE;
    • 60 math and trigonometry functions (POWER, MOD, LN, LOG, SIN…ACOTH, FACT, COMBIN, GCD, HYPOT, …);
    • 17 rounding functions (ROUND(x, digits), ROUNDUP, TRUNC, CEILING, FLOOR.MATH, MROUND, EVEN, …), decimal-correct (ROUND(2.675, 2) is 2.68);
    • 26 text functions (LEFT, MID, FIND, SEARCH with wildcards, SUBSTITUTE, TEXTBEFORE, CONCAT, PROPER, VALUE, …), counting characters, not bytes.
  • The date family, 66 functions (phase P2):
    • information: ISBLANK, ISNUMBER, ISTEXT, ISNONTEXT, ISLOGICAL, ISDATE, ISNUMBERORDATE, ISEVEN, ISODD, N, T, TYPE;
    • text formatting: TEXT with Excel format codes, FIXED, DOLLAR, NUMBERVALUE, VALUETOTEXT; regular expressions REGEX, REGEXTEST, REGEXEXTRACT (first match only) and REGEXREPLACE, in the Rust regex syntax;
    • date and time: DATE, TIME, DATEVALUE, TIMEVALUE, the date and time parts, WEEKDAY, WEEKNUM, ISOWEEKNUM, DAYS360, DATEDIF, EDATE, EOMONTH, YEARFRAC, NETWORKDAYS/WORKDAY and their .INTL forms (no holidays argument yet), NOW, TODAY, LibreOffice’s DAYSINMONTH…YEARS, Gnumeric’s UNIX2DATE/DATE2UNIX, and Numbers' DUR2* over durations as days.
  • Statistical functions (the plan’s phase P4, scalars): 10 special functions (GAMMA, GAMMALN, BETA, BETALN, DIGAMMA, IGAMMA, POCHHAMMER, ERF, ERF.PRECISE, ERFC) and 44 distributions under Excel’s names, with legacy names as aliases where they mean the same thing (NORMDIST = NORM.DIST) and their own entries where they do not (NORMSDIST, TDIST, BETADIST, HYPGEOMDIST, …): the beta, binomial, chi-square, exponential, F, gamma, hypergeometric, log-normal, negative binomial, normal, Poisson, Student’s t and Weibull distributions and quantiles, plus GAUSS, PHI, FISHER, FISHERINV, CONFIDENCE.NORM, CONFIDENCE.T and STANDARDIZE. 326 more golden values (scripts/goldens/statistical.py). Dotted names whose prefixes are not functions themselves (NORM.S.DIST, T.DIST.2T) parse.
  • More aggregations: PRODUCT, SUMSQ, and over booleans AND, OR and XOR; AVERAGE (with AVG as an alias). SUM, MIN, MAX and the rest also take a list of arguments (SUM(a, b, c)).
  • Optional and repeating arguments (ROUND(x) or ROUND(x, 2)), and a parse error that shows the signature.
  • One function registry (improv_core_model::functions) drives the parser, the type checker, the engine, the GUI’s formula text, the CNL and a generated Function Reference page in the guide.
  • 634 golden values, checked through both the scalar evaluator and the dataflow engine: from LibreOffice 25.8 headless (scripts/goldens/p1.py), or from the Excel, Gnumeric, Numbers and Quantrix documentation where LibreOffice lacks a function or disagrees with Excel.
  • 49 financial functions (the plan’s phase P5 scalars), with Excel’s sign convention (cash paid out is negative):
    • time value of money: FV, PV, PMT, IPMT, PPMT, NPER, RATE (Newton’s method, then bisection; #NUM! without a root), CUMIPMT, CUMPRINC, ISPMT, EFFECT, NOMINAL, PDURATION, RRI, DOLLARDE and DOLLARFR;
    • depreciation: SLN, SYD, DB, DDB, VDB, and the French AMORDEGRC and AMORLINC;
    • bonds and securities, on the five day-count bases: ACCRINT, ACCRINTM, the COUP* family (COUPNCD/COUPPCD return dates), DISC, DURATION, MDURATION, INTRATE, ODDFPRICE, ODDFYIELD, ODDLPRICE, ODDLYIELD, PRICE, PRICEDISC, PRICEMAT, RECEIVED, TBILLEQ, TBILLPRICE, TBILLYIELD, YIELD, YIELDDISC and YIELDMAT. Day counting follows LibreOffice; where LibreOffice departs from Excel’s documented results (DURATION on actual/actual, PRICE/YIELD with one coupon left, EFFECT(0, n), DOLLARDE/DOLLARFR below 1, ACCRINT’s calc_method), Improv follows Excel. 457 golden values from LibreOffice 25.8 and Gnumeric 1.12 (scripts/goldens/financial.py; Gnumeric for ODDFPRICE/ODDFYIELD, which LibreOffice cannot compute).
  • Cash-flow reductions over an ordered category, in item order: NPV(rate, cf OVER Time), XNPV(rate, cf, dates OVER Time), IRR(cf OVER Time, [guess]), XIRR(cf, dates OVER Time, [guess]) (Newton’s method, then bisection; #NUM! without a sign change or a root), MIRR(cf OVER Time, finance_rate, reinvest_rate), FVSCHEDULE(principal, rate OVER Time), and GNU Oleo’s financial management rate of return FMRR(cf OVER Time, safe_rate, reinvest_rate, reinvest_min). A period with no cell is skipped, not zero (Excel’s rule for blanks in a range); an error flow is the result. 65 golden values from LibreOffice 25.8 over a column of flows, and from a transliteration of Oleo’s do_fmrr (scripts/goldens/financial_reduce.py).

  • improv.raise_errors (pg_improv): raise a LANGUAGE improv error value instead of returning NULL.

  • Operators ^, & and %. ^ is power with the mathematical convention: right-associative and tighter than unary minus (2^3^2 is 512, -2^2 is −4; the spreadsheets give 64 and 4). & joins two values as text, below +/- and above the comparisons. % divides by 100.

  • Formulas in your language. The GUI formula bar and improv define / add-derived read formulas in the formula locale (IMPROV_LOCALE, else the OS locale); in German: LibreOffice’s German names, a decimal comma and ; separators (WENN(Price > 1,5; RUNDEN(Price; 2); 0)). The GUI shows formulas the same way. Models store the English form.

Changed

  • Every release publishes pg_improv to PGXN, or fails. The PGXN step is its own workflow (pgxn.yml): called by each tagged release, or run by hand for a tag that missed PGXN. It checks the tag, Cargo and control versions agree, uploads ci/pgxn-dist.sh’s zip (a re-run of an uploaded version is a warning, not an error), and waits until api.pgxn.org lists the version. Missing PGXN secrets now fail the release instead of skipping it, which is how 0.8.0–0.9.0 never reached PGXN.

  • Every function names its parameters in signature help and the Function Reference, instead of their types: Excel’s argument names where Excel has the function, else LibreOffice’s, Gnumeric’s or R’s (ROUND(number, [num_digits=0]), SUMIF(range OVER T, criteria, [sum_range]), SORT(array OVER T, [sort_order=1] INTO K)).

  • Dimension errors say what and why, by name: A ranges over [Month] and B over [Region]: they share no category, so no cell has both … Reduce one first, e.g. SUM(B OVER Region), or give them a category in common, instead of [CategoryId(1)] vs [CategoryId(2)]. The same for function arguments, IF, […] that leaves a category out, and measures reduced together.

  • Mentat 1.16.0, from crates.io. The storage engine is now the published mentatdb crate (mentat = { package = "mentatdb", version = "=1.16.0" }), no longer a git dependency on Codeberg; cargo-deny drops its git source and the per-crate license clarifications. No code changes; storage speed is unchanged (A/B benchmark: docs/reviews/2026-10-18-mentat-1.16-upgrade.md).

  • Errors are typed values, shown as the spreadsheets show them: #DIV/0!, #NUM!, #VALUE!, #N/A (plus #NULL!, #NAME?, #REF! from ERROR). Division by zero is #DIV/0! and a domain error or overflow #NUM!, where they used to be NaN; an error operand propagates. LANGUAGE improv returns NULL for an error value (it used to return NaN), or raises it under improv.raise_errors.

  • MIN2/MAX2 are now aliases of MIN/MAX, which take any number of arguments.
  • Comparisons order text, dates and booleans, not only numbers.
  • NOT binds looser than a comparison, as in SQL: NOT Price > 15 is NOT (Price > 15). It used to parse as (NOT Price) > 15, a type error. Only a formula comparing a NOT of a boolean measure with <, <=, > or >= changes meaning (NOT a == b and NOT a <> b give the same values either way); write (NOT a) < b to keep the old reading.

Fixed

  • The GUI’s Postgres store loads bool min/max bindings. storage_pg built max(b) for a boolean column, which Postgres does not have; it now reads bool_or/bool_and, as pg_model’s loader does.

  • pg_improv: agg => 'min' or 'max' on a bool column. The load read max(value), which Postgres does not have for bool, so every load of such a binding (in each sync mode, and the logical worker’s rebuild) failed. It reads bool_and (min) and bool_or (max).

  • pg_improv: a define racing a logical-mode batch. The worker read model_version before taking the model’s lock, so a define that committed while the worker waited could see its new results overwritten by the old formula’s. The version is read again under the lock.
  • Calls that never returned now finish in milliseconds. Property tests over every built-in function (hegel, each call under a time budget) found loops whose trip count came from an argument: FACT, COMBIN, PERMUT, MULTINOMIAL of counts near 1e15 (now #NUM! once they overflow); VDB past 1e5 periods, CUMIPMT/CUMPRINC past 1e7, AMORDEGRC once its write-down rounds to 0 (0) or after 1e6 periods (#NUM!); the Bessel functions past order 1e7 and OPT_BINOMIAL past 1e4 steps (#NUM!; Gnumeric allows 1e5, which took 11 s); BINOM.INV and the R.Q* discrete quantiles past 2⁵³ trials; the quantile bisections (now 65 steps in the floats' order, where BETA.INV with huge shapes took 16 s); R.QHYPER of huge populations; R.PTUKEY with nmeans near f64::MAX; FMRR with a safe rate at or below −100% (#NUM!); and the skew-normal and skew-t far tails.
  • Precision. FLOOR/CEILING and their variants snap the quotient to 15 digits as LibreOffice does (CEILING(1.17e-10, 117) is 117, it was 0); PV/FV at small rates; R.PBETA’s upper tail at a small x; the incomplete beta just below x = 1, with one shape below the other’s ulp, or with shapes whose sum overflows; R.PF’s upper tail at a small x; beta quantiles under ε above the median (they were 0); the hypergeometric mass of populations past 1e6.
  • Panics. HDATE past Gregorian year 29000, IMIGAMMA of a real shape past 1e12 (#NUM!) and FORECAST.ETS with a seasonality near 1e19 (#VALUE!); UNIQUE(…, TRUE) of only repeated values is #N/A, not an empty list.
  • IMIGAMMA off the real axis. The upper regularized value for large |z| was computed as 1 − P and cancelled: IMIGAMMA("0.5","30+i",FALSE) gave 1.2e-5+3.4e-5i (it is 5.0e-15−8.1e-15i), the same as Gnumeric 1.12. For Re z > 0 past |z| ≈ Re a + |Im a|/2 it now uses Legendre’s continued fraction, so all four forms match mpmath to about 2e-13. The unregularized lower value after the asymptotic series was the regularized one (IMIGAMMA("1+i","40",TRUE,FALSE) gave 1, not 0.498−0.155i), and Γ(0, z) is now E₁(z) rather than #NUM!.
  • IMIGAMMA left of the imaginary axis. For Re z ≤ 0 (where neither continued fraction applies) it gave #NUM!, as Gnumeric does. All four forms now follow mpmath’s gammainc on the principal branch: IMIGAMMA("0","-1",FALSE,FALSE) is −1.895−πi (Γ(0, −1) = −Ei(1) − iπ), through the lower series (or Legendre’s fraction where the series would cancel) and Γ(a, z) = Γ(a) − γ(a, z). At a = 0, −1, −2, … the upper value is E₁ and its recurrence, the lower one #NUM! (a pole).
  • TUI import-csv that breaks a formula says so. Importing into a measure a formula uses (giving Price a new dimension, say) left every derived measure blank with only “imported N cell(s)” in the status. The status now adds “formulas not recomputed: …” with the engine’s error.
  • Binomial, beta, F and t with very large parameters. The regularized incomplete beta behind BINOM.DIST, BETA.DIST, F.DIST, T.DIST, NEGBINOM.DIST and the R.* kernels lost accuracy once both shapes passed about 1000, and was wrong from about 10⁸: BINOM.DIST(4e7, 1e8, 0.4, TRUE) gave −0.42 (it is 0.500043), and R.QBINOM(0.3, 1e16, 0.4) was 5.7 standard deviations low. For large shapes it now uses Loader’s saddle-point prefactor and runs the continued fraction to convergence.
  • LAMBERTW near −1/e. For x within about 700 doubles of −1/e it returned #NUM!: Halley’s iteration bounced between two values without converging. It now uses the branch-point series there, which matches mpmath to 1e-14 on both branches.
  • RANK, PERCENTRANK and TREND over an item that is text. That item is now #VALUE!, as in Excel, LibreOffice and Gnumeric, and the other items keep their results. PERCENTRANK(x OVER T) used to panic on such an item, and RANK gave it a rank.
  • Saving a partially loaded Mentat model no longer deletes data. A model from load_partial saved through its handle used to retract every cell outside the loaded closure; the save now only retracts the closure’s missing cells, as the Postgres store already did.
  • The TUI edits text, boolean and date cells incrementally, as it does numbers (through session::input_cell, like the GUI); it used to rebuild the whole engine for every non-number edit.
  • Measure[Cat] outside an aggregation is refused when the list leaves out one of the measure’s categories. It used to change only the type the checker saw: X = Quantity[Product] still produced every Time×Product cell. Inside an aggregation (SUM(Quantity[Product] OVER Time)) it works as before.

Security

  • duckdb 1.10506.1 (was 1.10505.0) moves its build-time zip dependency from 6.0.0 to 9.0.4, fixing RUSTSEC-2026-0367, -0368 and -0369 (SUID bits, symlink targets and permissions applied during ZIP extraction). It only ever unpacked DuckDB’s own archive at build time, but it no longer needs a waiver.

0.9.0 - 2026-10-16

pg_improv is ready for real databases: it builds and is tested on Postgres 15, 16, 17 and 18; it upgrades in place with ALTER EXTENSION; pg_dump keeps its models; it installs without the preload; and it is published to PGXN, with binary packages per Postgres major. A worked family-finance example shows a household’s accounts, statement reconciliation, budgets, net worth and savings goals in one model.

Added

  • pg_improv on Postgres 15, 16, 17 and 18 (pgrx features pg15…pg18; 17 stays the default). CI runs the whole suite on each.
  • Upgrades: sql/pg_improv--0.8.0--0.9.0.sql and --0.8.1--0.9.0.sql, so ALTER EXTENSION pg_improv UPDATE moves a live database forward. tests/upgrade.sh builds each earlier release, puts a logical-mode model on it, upgrades, and checks results, the worker, define and pg_dump.
  • tests/txn.sh: the transactional guarantees, end to end. In trigger mode a writer reads its own results, other sessions see them only after commit, and ROLLBACK, an error or a rolled-back savepoint undo them. In logical mode aborted work never reaches the results. Also checks a no-preload CREATE EXTENSION, that every object is in schema improv, and dump/restore.
  • PGXN: crates/pg_improv/META.json.in and ci/pgxn-dist.sh, which builds a buildable source dist (the extension and the six crates it links) that CI builds on every push and the release uploads with pgxn-release.
  • Release packages: pg_improv-<ver>-pg<N>-x86_64-linux.tar.gz for each supported major, from cargo pgrx package against that major’s PGDG build.
  • Release announcements: ci/announce.sh drafts and submits the postgresql.org news item (which feeds pgsql-announce) for feature and major releases. A patch release is skipped unless its CHANGELOG section has ### Security.
  • CI: ci/pg_improv.sh <PG>, one script for GitHub, Forgejo and a local run: fmt, clippy, #[pg_test], pgspot, txn.sh, logical.sh, and on 17 also upgrade.sh and the PGXN dist build.
  • Family-finance example (crates/pg_improv/examples/family-finance, guide chapter Improv in Postgres: a family’s finances).

Fixed

  • pg_improv: CREATE EXTENSION without shared_preload_libraries killed the session. _PG_init defined the postmaster-level GUC improv.database on every load; Postgres refuses that after startup with a FATAL. It is now defined only when preloading.
  • pg_improv: pg_dump lost every model. The improv.* catalog was not registered as extension configuration, so a dump held the result tables but restored the models empty. The catalog and its sequence are now dumped, and a restored database’s worker creates a new slot and catches up instead of trusting the dumped slot position.
  • pg_improv: binding a view gave an obscure error and left the model half bound. Logical and trigger sync need a table’s row changes, so bind_measure and set_sync_mode now refuse a view (or materialized or foreign table) up front with a message saying to bind a table or use manual mode. Views still bind in manual mode.
  • pg_improv on PG 18: HeapTupleHeaderGetRawXmin is ambiguous there (PG 18 exports a C function of that name), which broke the build.

Security

  • pg_improv’s install and update scripts pass pgspot. improv.mint_items pins search_path, and the extension creates its objects with plain CREATE instead of IF NOT EXISTS / OR REPLACE, so it cannot adopt an object another role created first. CI runs pgspot on every change.

0.8.1 - 2026-10-15

Fixed

  • pg_improv: a measure defined after the sync worker caught up is computed at once. In logical mode the worker rebuilt only when a decoded transaction touched a bound row, and improv.define() changes the model, not the data, so the new result table stayed empty until the next write to the fact table, with no error in improv.status. The worker now checks model_version on every poll. logical.sh covers a define with no data change.

0.8.0 - 2026-10-15

Improv runs inside Postgres, and a formula can be a SQL function. The pg_improv extension models your own tables and keeps results current incrementally (at 100k cells, a one-row change is visible about 50 ms after commit); LANGUAGE improv writes SQL functions in the formula language; the desktop and terminal apps open a Postgres-hosted model by URL and edit its rows. The GUI now follows NeXTSTEP Lotus Improv closely, scrolls wide grids sideways and can revert after a save conflict. A security review’s findings are fixed, and every crate is held at 90% function and branch coverage.

Added

  • Documentation. A Ways to Use Improv chapter (GUI, TUI, CLI, streaming, Postgres, LANGUAGE improv, server: what each is for and how to start), a refreshed introduction, getting-started and running pages, and man pages for improv-tui, improv-gui and improv-server (improv(1) gains stream, save-view, the CSV and refresh commands). The guide and API docs publish to Codeberg Pages and GitHub Pages.
  • Demo movies: the README and guide show the GUI, the TUI and Improv in Postgres in motion, each recorded by a script under docs/demo/.
  • Release binaries for Linux, macOS (arm64 and x86_64) and Windows: the CLI, TUI, GUI and server, with the man pages.
  • GUI: grids scroll sideways. A worksheet wider than its window has a NeXT horizontal scroller in the bottom strip, right of the row tiles, with the arrows grouped at its left end (spec §4.4). Before, the far columns could not be reached.
  • Revert to Saved after a save conflict: GUI File ▸ Revert to Saved and TUI R reload the model from the store (with a fresh save token), picking up the other writer’s changes, so the conflicting edit can be redone. Undo history is dropped; a failed reload changes nothing.

  • LANGUAGE improv: SQL functions written in Improv’s formula language (crates/pg_improv). CREATE FUNCTION margin(price float8, cost float8) RETURNS float8 LANGUAGE improv AS $$ price - cost $$. A trusted language: arguments are named inputs, Name = expr lines define intermediates, the last line is the result, and the DSL and controlled English both work. Numbers, booleans, text and dates/timestamps; NULL in gives NULL out where the result depends on it; division by zero is NaN; aggregations are rejected. Validated at CREATE FUNCTION; compiled once per backend (0.14 µs per call over inline SQL). Evaluation is the new improv_engine::scalar, which shares the dataflow engine’s per-cell operators.

  • pg_improv: Improv models over Postgres data (crates/pg_improv, crates/pg_model, crates/storage_pg, crates/store). Bind fact-table columns to categories and measures, define formulas, read results from improv_<model>.<measure> tables. Three update paths: logical decoding (default; a background worker tails a slot and applies each batch with the slot advance in one transaction), triggers (in the writer’s transaction), and improv.recalc() (explicit, in your transaction); plus improv.what_if and improv.status. The GUI, TUI, CLI and server open postgres://…?model=<name>. Measured on a c7i.4xlarge at 100k cells: logical keeps a writer’s UPDATE at 8 ms (results ~50 ms later); a trigger makes them visible at commit for ~1.1 s per write. See docs/src/postgres.md.

  • pg_improv: aggregated bindings. improv.bind_measure(…, agg => 'sum') (or avg, min, max, count) folds a fact table’s rows per coordinate into one input cell, in recalc, trigger and logical mode and in the GUI’s load; without agg duplicate rows remain an error. The GUI’s store refuses to save an edit to an aggregated measure (Integrity).

  • pg_improv: boolean, text and date measures. bind_measure takes the measure’s type from its column (bool; text/varchar/char; date/timestamp/timestamptz; the number types as before) and refuses others; define accepts boolean, text and datetime results, and result tables get a matching value column (boolean, text, timestamptz). Logical mode applies their row changes cell by cell like numbers' (the worker reads the slot’s text with TimeZone = UTC, DateStyle = ISO).

  • pg_improv Postgres extension, layer L0 (in progress). A pgrx 0.17 extension (crates/pg_improv, pg17) with an improv.* catalog that is a superset of improv_storage_pg’s, plus improv.create_model, bind_category, bind_measure, define, recalc and drop_model. recalc recomputes every derived measure in the caller’s transaction and writes only the changed rows to improv_<model>.<measure>. The new GUC improv.max_cells (default 5M) caps the input size. The Postgres-free logic is the new workspace crate improv_pg_model. Install and quick start: crates/pg_improv/README.md.

  • pg_improv layer L1: trigger-mode sync. improv.set_sync_mode(model, mode) installs (for trigger) or removes statement-level AFTER INSERT/UPDATE/DELETE/TRUNCATE triggers with transition tables on every bound relation. improv.on_change recomputes, inside the writer’s transaction, only the derived measures that depend on the changed inputs. It restricts the recompute to the touched coordinates when the chain is element-wise. Also new: improv.recalc(model, measures text[]) recomputes a measure subset and its dependents, and improv.what_if(model, edits jsonb) returns the derived cells an in-memory edit would change, without writing anything. README has the trigger/logical/recalc trade-off table.

  • Postgres-hosted models (pg_improv layer L3). The CLI, TUI, GUI and server open postgres://…?model=<name> as well as a Mentat file, through the new improv_store::Store seam. The new improv_storage_pg::PgModelStore keeps the model in the improv.* catalog: bound input measures read and write their fact table, unbound cells live in improv.cell, and improv.model_version drives the existing reload-and-retry conflict check. scripts/gui-shot.sh takes GUI_SHOT_DB to capture such a model.

  • Coverage gate. scripts/coverage.sh (and a coverage CI job on GitHub and Forgejo) fails when any crate drops below 90% of functions or branches; the workspace stands at about 96% / 95%. New guide docs/src/running.md: build, run each front end, security defaults, tests, coverage.

  • TUI: Shift+arrows select a range, drawn highlighted, and the status line shows its Sum (numeric cells only; Sum — when there are none), as the GUI does. A plain arrow, a click, or any re-layout collapses the range.

  • GUI screenshot regression in CI (review plan D5). A gui-shot job (GitHub and Forgejo, rust:1.97-trixie) runs scripts/gui-shot-check.sh, which compares the headless 1400×900 capture against the golden docs/reviews/golden/gui-1400x900.png and fails above 200 differing pixels (magick compare -metric AE -fuzz 2%), uploading the diff. --update refreshes the golden (see CONTRIBUTING.md).

  • CLI save-view. improv save-view <db> <view-id> <name> <measure> [--rows Cat,Cat] [--cols Cat,...] writes a named view the same shape the GUI saves (stacked rows/cols, remaining categories as pages pinned to their first item). improv list now prints a views: section.

  • GUI screenshot harness (scripts/gui-shot.sh). Builds the binaries, loads a fixed Time×Product×Scenario demo model, runs improv-gui on a headless Xvfb at 1400×900 and writes target/gui-shot/gui.png plus compare.png, the capture beside the NeXT Improv reference. Output is pixel-identical run to run.

  • GUI range selection. Shift+arrow (or Shift+hjkl), Shift+click and dragging across cells select a rectangle; a plain arrow or click collapses it. The status-bar Sum adds the range’s numbers.
  • GUI window title. The native title reads Improv — <file>, with a trailing • while edits are unsaved (an edited in-memory model, or a failed autosave).
  • GUI transient status. Status-bar messages (save, recalc, undo/redo, added formula, errors) clear themselves after 5 seconds.

Changed

  • improv_engine::session::Edit::value is a CellValue (was f64), so the live engine takes boolean, text and date edits and seeds every typed input cell. Engine::set still takes an f64.

  • improv.what_if returns jsonb values (was float8), so it reports boolean, text and date measures too (dates as RFC 3339 strings), and its edits may set inputs of those types.

  • Mentat 0.14 → 1.11.1 (pin 6fc2bc7f, Mentat master at v1.11.1). No Improv API changes were needed. Measured on 100k/200k-cell models (docs/reviews/2026-10-10-mentat-1.11-upgrade.md): loads, partial loads, evaluation and edits 9–26% faster, re-import 13–15% faster, first import ~10% slower, store files ~29% larger (new history and value indexes). Reported RSS is higher because Mentat now memory-maps the store (1 GiB cap); set MENTAT_MMAP_SIZE=0 to turn that off. The old pin 1af15e15 lived on an unpushed branch and was not fetchable from a clean clone; the new pin is on Mentat’s pushed master.

  • TUI: the status box grows to fit its content, so the edit/command prompt and messages stay visible when pages:/filters: lines are shown. The key help wraps to the terminal width, and the prompt sits right under the title so a short terminal clips the help first.

  • TUI: a derived measure’s formula shows on a status line in controlled English (Revenue = Price times Quantity).

  • GUI: the model browser now leads with a NeXT-style white list of saved views (Name - Worksheet rows with a worksheet icon). A single click selects a view and shows its computed description (measure, categories, pages); a double-click opens it. Categories and Measures move below as collapsible sections.

  • GUI: NeXT scrollers. The grid, model browser and formula list show an always-visible 19 px #808080 trough with a square #AAAAAA knob, a 1 px bevel on the knob and NeXT’s two arrow buttons grouped at the bottom of the vertical trough (one line per click).

  • GUI filtering moved to the tile menu. The worksheet’s Filters shelf is gone; right-click a category tile for a checkbox per item (uncheck to hide it from that worksheet) and Show all. A filtered tile reads Name*.

  • GUI grid field fills the table area. The white field reaches the worksheet’s edges instead of stopping at the last cell.
  • GUI model browser labels measures. Each measure shows a small gray input or formula label instead of the · / = prefix.

  • GUI first worksheet window. A fresh window opens clear of the application menu and is sized to its grid (360–900 × 300–700 px).

  • GUI grid follows NeXT Improv. Cells are plain white with thin black rules (no stripes, no per-cell buttons); the selection and its row and column header items fill #AAAAAA. Input cells carry a faint inset underline; derived cells show formula: … on hover. Double-click (or Enter / F2) edits a cell; a single click only selects it.

  • GUI category tiles follow NeXT Improv. Tiles are 17 px dark-gray chips with white names (no grip, no ⏷ button; right-click for Move to Rows / Columns / Pages). Page tiles sit top-left, each above a white item field that picks the page (replacing the < item [i/n] > stepper); column tiles sit top-right and row tiles bottom-left. Gutters size to their tiles, with no placeholder text, and highlight as drop targets only during a drag.

  • GUI worksheet windows open at 560×420 (was 480×320) so the grid and formula list fit.
  • GUI formulas are edited in place in the formula list. The top formula bar is gone: the selected row is the editor (Enter commits, errors show under the row, Esc reverts), and typing Name = formula on the list’s last line adds a derived measure.
  • GUI formula list lives in each worksheet window, under the grid, with a Calc button. The operator palette and the “New derived measure” form are gone.
  • GUI model browser and Info panel are NeXT windows. The docked explorer and inspector side panels are gone, so the dark workspace spans the full width above the bottom panels. The model browser (<file> - Model, bottom left; Categories, Measures, Views) has a close box and View ▸ Model Browser toggles it. The Info panel (top right, closed at start) opens from Info ▸ Info Panel… and closes from its close box. A fresh matrix starts right of the application menu.
  • GUI matrices are NeXT worksheet windows on a dark workspace. The scrollable canvas is gone: the area between the panels is a #555555 workspace, and each matrix floats on it as its own window with a black (key) or dark gray title bar reading <matrix> - Worksheet - <file> (Untitled when in memory), a close box while more than one matrix is open, and a bottom resize bar. Drag the title bar to move a window; clicking a window gives its matrix the keyboard. Window positions and sizes are saved in views as before, so existing views load unchanged.
  • GUI application menu replaces the tool palette and tab strip. A floating NeXTSTEP vertical menu (Info, File, Edit, Format, Worksheet, View, Graph, Print…, Services, Hide, Quit) with cascading submenus now carries pivot, undo/redo, chart, CSV, save view, save model, add/remove matrix, and the Info panel (inspector) toggle. The View submenu lists the saved views that the top tab strip used to show. New key equivalents: Ctrl/Cmd+S saves the model, Ctrl/Cmd+H hides and Ctrl/Cmd+Q quits, next to the existing undo/redo chords. None of them fire while a text field has focus. A selected row in the explorer and formula lists now shows a white face, so selection no longer looks the same as hover.
  • GUI theme is NeXTSTEP grayscale. The GUI uses NeXT’s four grays (#000000, #555555, #AAAAAA, #FFFFFF, plus a #808080 scroller trough) and nothing else: the selection is filled #AAAAAA instead of blue, corners are square, strokes are 1 px, the grid sits on white, and category tiles are dark gray with white text. Formula errors are marked by a 2 px underline rather than red, and charts use gray shades. Body text passes WCAG AA: black on #AAAAAA is 9.0:1, black on white 21:1, white on #555555 7.5:1.
  • GUI text is Arimo 12. The GUI bundles Arimo 1.33 Regular and Bold (OFL-1.1, crates/gui/assets/fonts/), metric-compatible with NeXTSTEP’s Helvetica, as its primary proportional font; egui’s fonts stay as glyph fallback. Body and button text are 12 pt, and headings are 12 pt bold.
  • GUI grid right-aligns numbers so their digits line up, as Improv does; text, booleans and dates stay left-aligned. The cell editor for a numeric measure is right-aligned to match.
  • GUI item headers are plain text in a ruled band. Row and column headers (Q1, Widget) were beveled button chips. They now draw as plain dark text with rule lines, as in Improv, so only the category tiles look draggable.

Performance

  • pg_improv logical mode applies changes incrementally (G1). The sync worker keeps each model loaded with a live engine, turns decoded row changes into input-cell edits, and writes only the result rows that changed (a one-row UPDATE on a 100k-cell model rewrites two result rows). It rebuilds on a structural change, TRUNCATE, a new item, or an error. It also logs a standby snapshot after each batch so polls decode only new WAL. Commit → result visible at 100k cells (p50): 1161 → 52 ms for one row, 1552 → 559 ms for a bulk UPDATE.
  • Store load is no longer one query per cell (P1). load_model / load_partial fetch (measure, coord, value) in one query per value attribute (three in all) instead of a query per cell. On a 100k-cell model (release CLI, 100×1000 CSV) improv eval went from 279.9 s to 0.58 s and improv list from 283.2 s to 0.67 s. Date cells now load back as dates instead of text.
  • Engine edits cost O(changed measures), not O(model) (P3). session::Engine now returns a copy-on-write session::Snapshot (Arc<HashMap<MeasureId, Arc<MeasureValues>>>): an edit shares every unchanged measure with the previous snapshot instead of cloning all tracked cells. On the incremental_many_edits stress test (release, 5,000 single-cell edits) the time per edit drops from 950 us to 62 us at 10k cells (1,052 to 16,097 edits/s), and from 5,639 us to 71 us at 100k cells (177 to 14,039 edits/s). It is now almost flat in model size. Engine::new/set/clear/apply return Snapshot, and callers clone it cheaply.

Fixed

  • Numbers display without binary noise. Every front end showed a value at full f64 precision, so 1173 * 0.05 read 58.650000000000006. They now show 15 significant digits (58.65); stored values and exports keep every bit.

  • pg_improv: item ids are minted in one place. improv.mint_items (created by both the extension and improv_storage_pg::CATALOG_SQL) mints ids for new dimension values, serialized per model, with a unique (model_id, category_id, name) index. improv.recalc, the trigger and worker paths and the GUI’s store all call it, so concurrent loads agree on ids and nothing is minted twice. Minting no longer bumps model_version.

  • Postgres saves no longer clobber SQL edits to bound fact tables (storage_pg, design §9.2 G2). save_model now writes only what changed since the handle loaded (or last saved). Each bound cell it changes or removes is guarded by its loaded value (… WHERE value IS NOT DISTINCT FROM <loaded>), so a cell SQL changed in the meantime fails the whole save with Conflict (“reload and retry”). A removed bound cell sets the value column to NULL and keeps the row. A save deletes only the catalog rows (categories, items, measures, views, improv.cell cells) it had loaded, so rows added by another client survive. A save with no changes writes no cells. PgModelStore::snapshot / set_snapshot carry the base across handles, like loaded_tx; without a snapshot a save writes everything unchecked, as before.

  • pg_improv: recalc, define and bind_* no longer fail with “SELECT FOR UPDATE is not allowed in a non-volatile function” when they are the first statement of a transaction.

  • Broadcast binary ops with the larger operand on the left. A formula such as Net = Price[Time,Product] - Discount[Product] (or *, +, /) evaluated to no cells. Only the mirrored Discount - Price worked. The dataflow MapBinary joined its operands on the full coordinate, so a row matched only when the right operand already spanned the result’s dimensions. Join, MapBinary and two-argument scalar calls now share one broadcast-join helper that keys both sides on their shared categories.

  • Incremental recalculation no longer drops cells whose value went down. The engine’s update stream orders a changed cell’s +new before -old when the new value sorts lower, and the session snapshot applied the retraction by deleting the key, which wiped the value just written. So Engine::set lost, for example, Revenue when a Price decreased. A retraction now removes a key only if it still holds the retracted value.

  • Sandboxed external functions on non-FHS hosts (NixOS). The interpreter is now run by its canonical host path, and /nix/store is bound read-only when present. Before, every sandboxed call failed on NixOS with execvp python3: No such file or directory.

  • A save no longer clobbers another process’s writes. save_model retracts stored cells the model lacks, so when two processes shared a store (improv set beside a running GUI or server) the second saver deleted the first’s new cells. A save now checks the store’s transaction high-water against the one it loaded at and, if another writer committed since, fails with StoreError::Conflict and writes nothing. The GUI and TUI report “reload and retry”; the server answers 409 Conflict and drops its cached model so a retry reloads. New ModelStore::{tx_high_water, loaded_tx, set_loaded_tx, reload_model}.

  • Storage: a measure’s category order survives save/load. :measure/categories is a set, so a reload returned the categories sorted by id, and anything mapped by position (SQL/CSV columns, coordinates) landed on swapped categories: refresh-sql on a 2-dimension measure wrote {Year=A,Region=2025}. The order is now stored in a new :measure/category-order attribute. Stores written before it load as before (id order) and gain it on their next save; no migration needed.
  • TUI: the grid scrolls to keep the cursor visible on models larger than the terminal (previously the cursor could move off-screen).
  • TUI: mouse clicks select the cell under the pointer (they were offset by the row-label column and selected the column to the right).
  • TUI: text and boolean input cells can be edited (parsed per the measure’s type, as improv set does); previously every edit had to be a number.
  • TUI: editing is refused when an axis is empty or fully filtered. It used to store a cell with a missing dimension.

  • TUI: [ / ] page correctly when an empty category precedes another page dimension.

  • CLI --at accepts every natural spelling of a coordinate. set and scenario now take repeated flags (--at Time=Q1 --at Product=Widget) and space-separated pairs (--at Time=Q1 Product=Widget) as well as the comma-joined form, merging them. Naming a category twice is a clear error, and stray non-pair arguments are still rejected.

  • GUI tool-palette icons no longer render as tofu boxes. Undo, redo, import/export and save-view used glyphs (↶ ↷ ⇄ ▤) missing from egui’s bundled fonts; they now use glyphs those fonts contain, and a unit test checks every palette glyph against the loaded fonts.
  • The matrix no longer draws over the Inspector. Gutter tiles and the page well escaped the canvas clip (egui’s nested panels reset the clip rect) and painted on top of the side panels in small windows. They are now clipped to the canvas. The window also opens at 1280×800 (was eframe’s 800×600) with a 960×600 minimum.
  • The GUI no longer loses in-memory work silently. File ▸ Save (Ctrl+S) is disabled for an in-memory model instead of reporting “saved model”, and quitting an edited in-memory model warns first; a second Quit discards it.
  • GUI menus stay on screen. A submenu that would run off the right edge cascades to the menu’s left instead and is lifted to keep its bottom on screen, and the menu now opens on the workspace rather than over the formula bar’s label.
  • Re-saving a model no longer piles up cell datoms (P2). save_model diffs cells against the store: an unchanged cell is not re-asserted, a value left under another type’s attribute is retracted, and a cell removed from the model (cleared in the GUI, deleted through the server) is retracted instead of lingering on disk and coming back on the next load. An unchanged re-save of a 100k-cell model now adds no datoms (it added 200 and grew the file ~30 KB) and takes 1.3 s instead of 321 s.
  • improv init no longer wipes an existing store. It installs the schema only; it used to save an empty model, which under the cell diff above would have retracted every stored cell.

Security

  • External functions: the host picks the sandbox. Every body runs Restricted unless the operator sets IMPROV_EXTFN_TRUSTED=1; a model’s pure: false no longer turns the sandbox off (S2).
  • External functions fail closed. Without bwrap (bubblewrap) a Restricted body is refused with “bwrap not found; install bubblewrap or set IMPROV_EXTFN_ALLOW_UNSANDBOXED=1”; that variable falls back to rlimits only. A failed setrlimit aborts the spawn (S4, S18).
  • External functions: tighter bwrap. Only /usr, /bin, /lib, /lib64 and /etc are bound read-only; /tmp, /home and /root are empty tmpfs; all namespaces are unshared (no network). The child environment is cleared to PATH=/usr/bin:/bin, HOME=/tmp and LANG, so API tokens and cloud credentials no longer leak (S5, S6).
  • External functions: bounded output. stdout and stderr are drained concurrently and capped at 1 MiB each; output over 64 KiB no longer deadlocks into a timeout (S7).
  • External functions: the timeout kills the process group, so forked grandchildren die with the body (S8).
  • Wasm functions: a fuel budget stops runaway loops (the worker thread ends), linear memory is capped at 64 MiB, and bodies must start with wat: or base64: (a bare path is no longer read from disk) (S9).
  • Python functions: the body is passed verbatim as JSON data instead of inside an escaped raw string, so backslashes keep their meaning (S20).
  • Server: the refresh scheduler is off by default (IMPROV_SCHEDULER=1 enables it) and runs only external functions listed by digest in the IMPROV_EXTFN_ALLOW file, always in the Restricted sandbox. Serving a shared model no longer runs its code (S1).
  • Server: request limits. 10 s header-read timeout (slow-loris), 30 s request timeout, 64 requests in flight, 1 MiB bodies, 10,000 edits per /eval (S10, S13).
  • Server: write validation. Writes need an existing input measure, a coordinate covering exactly its categories, and finite values. Writes are serialized, so concurrent ones no longer lose updates. New IMPROV_API_TOKENS_RO read-only tokens (S12).
  • Server: internal errors return {"error":"internal error","request_id":N} and log the detail, instead of echoing store paths (S14).
  • Server: auth hardening. Constant-time token comparison; open mode on a non-loopback address needs IMPROV_ALLOW_OPEN=1 (S15).
  • Server: model cache. Requests share one cached model, reloaded only after a write, instead of loading the store up to three times per request (P4).
  • SQL refresh is read-only. A stored SqlSource.query must be a single SELECT/WITH statement (check_read_only_sql; stacked statements are refused), and every backend executes it read-only: Postgres in a READ ONLY transaction, DuckDB in a READ ONLY transaction with enable_external_access = false (no read_csv('/etc/passwd'), URLs or ATTACH), SQLite only if sqlite3_stmt_readonly. A data-modifying CTE (WITH x AS (DELETE ...) SELECT ...) is refused by the server.
  • Postgres fails closed on cleartext: this build has no TLS, so connect_postgres refuses a non-loopback host unless the connection string says sslmode=disable explicitly, and refuses sslmode=require (it cannot be honoured). Use an SSH tunnel to a loopback port.
  • Postgres NUMERIC columns now import as numbers (they failed to decode).
  • CSV export neutralizes formula injection. Text cells, item names and headers starting with =, +, -, @, tab or CR are written with a leading ', so Excel/LibreOffice show them as text instead of running them (S16). Numbers are untouched. ExportSpec { neutralize_formulas: false, .. } with export_measure_csv_with turns it off for an exact round trip.
  • CSV import is size-capped. A field over 1 MiB, a record over 64 MiB (checked while streaming, so an unterminated quote can’t buffer the file) or more than ImportSpec::max_records records (default 10,000,000) is an error instead of an out-of-memory (S17).
  • CNL parser depth bound (S3). The nl_formula recursive-descent parser had no nesting limit: one ~200 KB POST /nl/parse of nested parens overflowed the stack and aborted improv-server. Paren nesting plus operator count is now capped at 200 (as in the formula parser), returning the new NlError::TooDeep; tested on a 2 MiB stack with 100k parens.

[0.7.0] - 2026-09-24

The GUI is rebuilt against Lotus Improv / Quantrix reference material, and Improv becomes buildable by anyone who clones it.

Added

  • Margin gutters with edge-docked category tiles. Tiles now sit in gutters that frame the grid — column tiles along its top edge, row tiles down its left, page/unplaced categories in a corner well — and pivoting is dragging a tile from one gutter to another. The previous horizontal shelf above the table was structurally wrong: the references show the axes anchored to the edges they control. Adjacency is constructed from egui’s panel contract rather than approximated, and is asserted by this codebase’s first headless egui frame test, proven non-vacuous by feeding the old shelf’s geometry in and requiring rejection.
  • A canvas of matrices. A view holds several independently pivoted matrices, each with its own axes, filters, cursor and gutters, placed and resized on a scrollable canvas. This also delivers multi-measure display, previously open. Matrices are child Uis, not egui::Windows, because a window is a floating layer that cannot scroll inside a parent scroll area.
  • Numbered formula list. Every derived measure’s formula is visible at once, numbered, with an enable checkbox per formula, inline error state, and click-to-select. Disabling is a real model operation that survives save and reload, not a GUI-only flag, and dependents recompute without the disabled formula.
  • Quoted and qualified names in formulas. 'Unit Price' — exactly what a CSV header produces — now has a spelling, with '' for an embedded quote. Eight of nine previously unspellable names round-trip; only the empty name remains unspellable. Dotted names (Matrix.Measure) parse and fail with a clear error rather than inventing a namespace that does not exist yet.
  • Multi-matrix view schema: CanvasRect and MatrixPlacement, with View::from_matrices/primary/matrices.
  • Per-matrix title bars, document tabs for saved views, and a selection aggregate readout.
  • Undo/redo over bounded model snapshots, and focus-aware keyboard shortcuts so grid keys only fire when the grid owns focus.

Fixed

  • Strings containing newlines or tabs were silently corrupted on save. "Line\nBreak" reloaded as "LinenBreak". The escape was emitted but the EDN reader dropped the backslash, so any description, name, or Text cell carrying a newline or tab lost data with no error. Fixed on both sides: raw emission here, and the reader/printer fixed upstream in Mentat.
  • Models larger than ~5461 cells could not be saved — save_model panicked inside Mentat’s transactor. Saves are chunked, and the ceiling is per attribute queue rather than per transact.
  • Typed cell display and editing key on the measure’s declared type, never the text’s shape, so 42 typed into a Text measure stays text.
  • Derived measures exported their empty input storage instead of computed values; CSV export now evaluates through the engine.
  • improv set silently wrote a dimensionally invalid cell when --at was forgotten: improv set db 100 10 Product=A reported success and stored a cell at the empty coordinate, which then evaluated to nothing. Stray arguments are rejected with a message naming the flag you meant, and the coordinate is checked against the measure’s declared dimensions.
  • A Unicode crash in the formula highlighter, an empty-axis divide-by-zero, CSV item-ID aliasing across imports, non-atomic CSV import and cell edits, a formula bar that offered text no parser would accept, and stale non-dimension categories blanking the grid.
  • rustls 0.23.43 → 0.23.45 (RUSTSEC-2026-0285, build dependency only).

Changed

  • Mentat is a pinned git dependency, not a sibling path dependency. A fresh clone previously could not even parse its manifest (failed to read ../mentat/Cargo.toml), so nobody without a sibling checkout could build Improv; CI masked this by cloning Mentat beside the checkout in every job. Verified by building a bare clone with no sibling present.
  • The demo scripts build the CLI once instead of invoking cargo run per command: sample-model.sh went from 12m31s to about 3s.
  • Scale claims are stated end-to-end (build + save + reload + evaluate) rather than from evaluate() alone.

[0.6.0] - 2026-09-07

Added

  • ModelStore::load_partial: loads only a measure set’s dependency closure (its formula chain / external-call args), not every cell of every measure in the store — the out-of-core design doc’s recommended first step, built. engine::dataflow/engine::session needed zero changes. CLI eval/show now use it.
  • improv stream: a stdin→stdout streaming compute pipeline. Reads <measure> <value> [Cat=Item,...] edit lines from stdin, applies each incrementally to a live engine, and prints only the changed cells of one or more target measures to stdout as they land — producer | improv stream model.db Revenue | consumer.
  • CSV/TSV import/export (improv_storage_csv): the baseline data on-ramp named in IMPROV.txt, previously missing. CLI import-csv/export-csv mirror import-sql/export-sql’s column-to-dimension mapping syntax; a GUI Import/Export wizard and a TUI I/E command prompt wire it into all three interfaces.
  • Hosted refresh scheduler in improv-server: the same due-measure/ refresh loop as the CLI’s serve-refresh daemon now runs as a background task (IMPROV_SCHEDULER/IMPROV_SCHEDULER_TICK_SECS), with GET /scheduler/status to observe it.
  • improv_data_source: shared import logic (category/measure setup, name→id item interning) extracted out of storage_sql/storage_csv’s independent duplication; every public function signature unchanged.
  • GUI formula syntax highlighting + inline error display: the formula bar highlights identifiers/functions/numbers/strings/date-literals/operators and shows a failed parse’s error position inline, via a pure formula_highlight::scan/highlight_formula.
  • Formula-parser fuzz target (fuzz/fuzz_targets/fuzz_formula_parser.rs).
  • extfn OS-level sandbox: subprocess runtimes (Python/R/Julia/Pure) now run under bwrap (namespace isolation) when available plus OS resource limits (CPU/memory/FDs/procs) always, fail-open by design; WASM was already sandboxed by construction (wasmi, no host imports).

Fixed

  • Non-atomic model saves (crash-safety): save_model transacted the model in up to 6 separate SQLite transactions; a crash between them left a partial save. Now one InProgress, one commit — all-or-nothing.
  • Parser panic on multi-byte UTF-8 (found by the new fuzz target / adversarial-input test): the tokenizer cast a raw byte to char and could walk off a UTF-8 character boundary. Now decodes real characters.
  • Parser stack overflow on deeply-nested parentheses (a real DoS on attacker-controlled formula text): recursive descent now bounds nesting depth (MAX_PARSE_DEPTH) and errors cleanly instead of overflowing.
  • CI/local gate scoping: cargo fmt/cargo clippy now target our 11 crates explicitly; --all/--workspace could reach the vendored Mentat path dependency and, transitively, whatever it depends on.

[0.5.0] - 2026-08-28

Added

  • DuckDB as a first-class SQL backend (bundled build; Backend::Duckdb, ConnKind::Duckdb).
  • Date values in the engine’s DD value lane (CellValue::Date), and standalone/broadcast literal measures (a bare X = 5 scalar that broadcasts into other formulas).
  • What-if scenarios as first-class model data: Scenario = a named overlay of input-cell overrides (Model.scenarios, with_scenario), deterministic; CLI scenario + eval --scenario.
  • External-function runtimes R, Julia, WASM (in-process wasmi), and Pure-lang, alongside Python.
  • Server bearer-token authentication (IMPROV_API_TOKEN / IMPROV_API_TOKENS; /health public; open mode when unset).
  • Virtualized large-grid rendering in the GUI (mixed-radix on-demand row tuples via body.rows — millions of row lines never materialized), and charting the full Cartesian product of stacked axes.
  • Large-model stress tests (crates/engine/tests/stress.rs): scale-eval up to 1M cells and an incremental-edit throughput test (--ignored).
  • NeXTSTEP look-and-feel for the desktop GUI, matching the original Lotus Improv: a NeXTSTEP theme (gray desktop, chiseled/beveled controls, squared corners, paper-white grid), on-grid category tiles at the grid margins as the pivot gesture (drag a tile between Rows/Columns/Pages margins), a top formula bar (<Measure> = <expr>), chiseled grid headers with a Rows \ Columns corner stub, a NeXT-style tool palette, and multi-category-per-axis stacking (stack >1 category on an axis; the grid renders the Cartesian product with nested headers and group-outlined rows).
  • Refresh scheduler daemon (serve-refresh): honors each measure’s RefreshPolicy automatically — on every tick it refreshes the due measures (on-load once, interval every N seconds). The scheduling decision is a pure, unit-tested core_model::schedule; external-call measures also carry a policy (define ... --refresh).
  • SQL refresh policy + refresh-all: SqlSource records a RefreshPolicy (manual / on-load / interval); CLI import-sql --refresh ... sets it and refresh-all <db> [source.sqlite] refreshes every external-sourced measure (CALL + SQL) at once. Policy is advisory metadata (a scheduler that honors timing is future work); the engine core is untouched.
  • CALL(...) / SQL(...) definition grammar: core_model::parser:: parse_definition parses a measure definition as an ordinary formula or a whole-RHS source form (Target = CALL(func, args...) / Target = SQL("query")), keeping source forms off the engine’s expression grammar. CLI define / register-ext / refresh-ext make external-call measures usable end to end.
  • Chart view (improv-gui): a Chart toggle plots the selected measure as grouped bars (optional line overlay), drawn with egui::Painter (no new dependency), honoring filters and page pinning.
  • External-function measures wired into the engine (Phase 6): a measure can be defined as func(arg_measures...) (Model.external_calls); engine::external::refresh_external_measure evaluates the registered ExternalFn per coordinate via improv_extfn and writes input cells — host-side, so the dataflow core stays pure. ExternalFn/Language moved to core_model; defs + calls persist through Mentat.
  • Saved views + filters in the UI (improv-gui, improv-tui): save the current layout as a named view, load it to reproduce measure + axis placement
    • pins + filters, and filter a category to a subset of items. GUI: Views panel + Filters checkboxes. TUI: S save, v cycle, f/F filter.
  • PostgreSQL backend + connection management (Phase 7): SQL import/export/ refresh now work over a backend abstraction (SQLite + Postgres via postgres); serde Connection descriptors keep credentials out of band (password-less DSN + password_env, resolved at connect time, redacted logs).
  • External-function runtime (improv_extfn, Phase 6): a registry of typed, purity-asserted external functions evaluated in an isolated Python subprocess (timeout + JSON marshalling), speaking core_model::Value — the runtime the engine’s Expr::Call will dispatch to (wiring pending). Isolated-mode + timeout, not yet an OS sandbox.
  • GUI keyboard grid navigation (improv-gui): arrow/hjkl move a highlighted cell cursor; Enter/F2 edit, [/] page, n/N cycle measures; click also moves the cursor.
  • Saved views + filters (core_model::View/Filter, Quantrix/Improv parity): a View captures a measure, an axis-order permutation (rows/columns/pages), pinned page items, and per-category filters (restrict a dimension to a subset). Persisted through Mentat (:view/* datoms), survives save/load. The data model both interfaces can drive; UI wiring follows.
  • GUI drag-and-drop pivoting (improv-gui): an axis shelf (Rows / Columns / Pages) lets you drag category chips between axes (egui drag-and-drop) or use per-chip → / a Pivot button, with per-page-dimension < > selectors — the Improv/Quantrix re-pivot, no formula edits. Grid re-pivots live.
  • SQL live-query measures (Phase 7): an imported SQL measure now records a refreshable SqlSource on the model (improv_storage_sql::add_sql_measure / refresh_sql_measure); CLI refresh-sql re-runs the stored query and replaces the measure’s cells (persisted via a :measure/sql-source datom). SQL data re-enters as ordinary input cells, so the engine recomputes dependents with no SQL path of its own; these measures are marked nondeterministic (refresh-gated).
  • TUI pivoting + mouse (improv-tui): p rotates categories across rows/columns/pages (Improv/Quantrix-style re-pivot, no formula changes), and left-click selects a cell (mouse capture enabled). Complements the existing arrow navigation, [/] paging, e/Enter editing, and measure cycling.
  • Nix flake: nix develop dev shell with the Rust toolchain, GUI runtime libraries on LD_LIBRARY_PATH (so improv-gui runs), and the tooling.
  • TUI paging (improv-tui): [ / ] cycle the pinned item of a measure’s extra (3rd+) dimension, so multi-dimensional measures are fully viewable slice-by-slice; a page i/n indicator and a key-hint footer were added.
  • SQL connectivity (improv_storage_sql, Phase 7, SQLite): import a SELECT into a new input measure (columns → categories/items/cells) and export a measure’s cells to a SQL table. CLI import-sql / export-sql. SQL data enters as ordinary input cells, so the deterministic engine core is untouched; identifiers are validated and values bound (injection-safe).
  • Named scalar functions in formulas: ABS, ROUND, FLOOR, CEIL, SQRT, NEG, MIN2, MAX2 are now callable as NAME(args...) in formula text (parser registry core_model::parser::scalar_func, arity-checked), evaluated deterministically by the engine — the in-process foundation for Phase 6’s external-language CALL(...) runtime.
  • Desktop GUI (improv_gui, egui/eframe): improv-gui <db> — a model explorer, an editable pivot grid (input cells edit through the live engine with autosave; derived cells read-only), a formula editor (edit/add derived measures from formula text), and an inspector (metadata, dimensions, dependencies, formula-in-English, error-cell count). Phase 5 toolkit decision: egui/eframe.
  • Non-numeric value lane: the engine dataflow now carries a tagged CellValue (Num/Bool/Text/Err), so boolean and text derived measures evaluate end-to-end (e.g. Hot = Price > 15 yields a boolean). Comparisons and NOT/AND/OR produce Bool. CLI/TUI/server render via CellValue.
  • Live incremental edit API (improv_engine::session::Engine): builds the differential-dataflow graph once and applies input-cell edits as deltas (set/clear/apply), recomputing only affected coordinates — no rebuild.
  • TUI live editing: edit input cells in the pivot grid (e/Enter), derived measures recompute live via the session engine; autosave on quit.
  • Server POST /measures/:id/eval: apply edits through the live engine and return the recomputed snapshot (what-if by default; "persist": true writes through).
  • Textual formula parser (improv_core_model::parser): parse_formula / parse_expr accept Improv formula text (Revenue = Price * Quantity, precedence, comparisons, AND/OR/NOT, SUM|AVG|MIN|MAX(x OVER Cat)), resolving names against the model.
  • Scalar built-in functions in the engine: ABS, ROUND, FLOOR, CEIL, SQRT, NEG, MIN2, MAX2 (numeric); comparison/logical operators evaluate in the numeric lane (1.0/0.0).
  • CLI: add-derived <db> <id> <name> <formula> (define a formula measure) and eval <db> <measure-id> (compute a derived measure via the engine); add-measure now takes trailing category names to declare a measure’s dimensions. The full v1 flow — model, formula, incremental recalculation — now works end-to-end from the CLI.
  • TUI (improv_tui): a VisiCalc-style terminal pivot viewer (improv-tui <db>) — renders a measure as a 2-D grid (categories on rows/columns, extra dims as pages), keyboard navigation, measure cycling, panic-safe terminal teardown.
  • Server (improv_server): a JSON HTTP API (improv-server <db> [addr]) — /health, /model, /measures, /measures/:id/values, /nl/parse, /nl/describe, /measures/:id/cells.
  • Multi-layer derived measures: engine::evaluate builds derived measures in topological order (cycles rejected), so a derived measure may reference another derived measure.
  • Tests: property tests (proptest) for model/codec/CNL round-trips; fuzz targets (cargo-fuzz) for the CNL parser, model JSON, and coordinate codec; engine determinism suite (bit-for-bit reproducibility, insertion-order independence) and #[ignore] stress tests (100k-cell recalculation).
  • CI/CD: GitHub + Codeberg workflows for the full quality gate, cross-platform build/test, release qualification, and docs publishing.
  • Core model (improv_core_model): categories, items, measures, coordinates, dimension-aware formula AST, value/error types. JSON round-trip.
  • Storage (improv_storage_mentat): persist a model as datoms on the embedded (SQLite) Mentat store and reconstruct it by query. Save↔load round trip.
  • Engine (improv_engine): formula compiler (type + dimension inference, lowering to a Join/Aggregate/Map plan) and differential-dataflow evaluation. Verified against the canonical Time×Product revenue oracle.
  • CLI (improv_cli): init, add-category, add-item, add-measure, set, list, show, export over a Mentat-backed store.
  • Natural language (improv_nl_formula): controlled-English ⇄ formula parse/describe with a stable round trip.
  • Project infrastructure: workspace, rustfmt.toml, clippy.toml, deny.toml, .typos.toml, CI, dual license (Apache-2.0 OR MIT), contributor guide.