Manticore Search vs OSSEC

Manticore shipped 29.0.3 through 29.0.6 across four days after the 29.0.2 release notes consolidated the sharding work, and has now opened the 29.1 line. The patches are shaped by what 29.0 exposed: internal sort helper columns leaking into LEFT JOIN output, NEAR and proximity distances reset by repeated JSON query fixup, malformed binary-API search counts allocating before validation, and fatal binlog replay errors that failed to name the --replay-flags value an operator needs. The 29.1.0 opener is not engine work at all — it bumps the bundled manticore-load tool and gives it worker init and finalize hooks.

The pattern after a major line opens is holding: the commit-level train runs at multiple releases a day while the newly exposed surfaces — sharded tables, LEFT JOIN, JSON query parsing — report their edge cases back, each fix arriving with regression coverage attached rather than accumulating into a batch. The 29.0.6 binlog change is a small tell about where the team's attention sits: improving the error text an operator reads at 3am is the kind of fix that only gets prioritised once real clusters are running the new line.

The patch cadence should keep compressing toward the ordinary rhythm as the 29.0 edge cases drain. The next substantive engine item is more likely to come from the columnar and KNN thread than from sharding, which has just had its release.