Release 2026-09-09
This page is part of the documentation for Orleans.Lattice 9.9.0 (release line 9.9), built 2026-10-04. It is also published as markdown, with every table and list, at 2026-09-09.md, and llms.txt lists every page.Part of the changelog.
Patch release on the 9.6 line. Seven packages advance to 9.6.2: Orleans.Lattice, Orleans.Lattice.Api.TreeAdmin, Orleans.Lattice.Backup, Orleans.Lattice.GrainIndex, Orleans.Lattice.Membership, Orleans.Lattice.Replication and Orleans.Lattice.Schema. Fourteen advance to 9.6.1: Orleans.Lattice.Api.Auth.Grpc, Orleans.Lattice.Api.Backup.Grpc, Orleans.Lattice.Api.Data.Grpc, Orleans.Lattice.Api.Replication.Grpc, Orleans.Lattice.Api.Schema.Grpc, Orleans.Lattice.Api.State, Orleans.Lattice.Api.State.Grpc, Orleans.Lattice.Api.Telemetry.Grpc, Orleans.Lattice.Api.TenantAdmin, Orleans.Lattice.Api.TenantAdmin.Grpc, Orleans.Lattice.Api.TreeAdmin.Grpc, Orleans.Lattice.Dashboards, Orleans.Lattice.Replication.Grpc and Orleans.Lattice.Tenancy. Each is tagged per docs/RELEASING.md. Every other published package is unchanged and stays on its current version. In particular the Orleans.Lattice.Explorer family continues to publish from the 9.4 line, so the Explorer credential-trust fixes that this wave carries in source are not claimed here and ship separately in a 9.4 patch wave.
Three themes account for the wave. The largest is authorization, where ten entries close seams whose enforcement was weaker than the contract the surface published: a second, caller-supplied identifier that was composed and acted upon without ever reaching the access gate; a failed-attempt lockout that could be bypassed, or turned into a self-inflicted denial of service; a tenant suspension honoured locally while its peers kept applying that tenant's writes; and four caches an unauthenticated caller could grow without bound. The second is arithmetic that overflowed instead of saturating, where an extreme-but-permitted TimeSpan option added to a tick count wrapped to a past instant and expired a lease or a deadline at the moment it was set. Every remaining site now saturates; ordinary configurations compute an identical value and are unchanged. The third is the cross-tree atomicity protocol, whose six-finding audit closes the paths by which a saga's outcome could be reported as decided when it was not, or stranded when its terminal decision failed to persist.
Being a patch wave, the public surface grows only where a fix could not be expressed without it: LatticeOptions.MaxDurableUnresolvedReplayWork with its DefaultMaxDurableUnresolvedReplayWork companion, the LatticeMetrics.LeafUnresolvedPrepareLedgerBeyondCap instrument, and a TxStatus.Indeterminate case that lets a registry state that it cannot determine a saga's outcome rather than imply one. Nothing is removed or renamed.