Multiplayer Collaborative Canvas · View 01 of 23 · Context and scope
Decisions
- The platform owns the document's state and its history, and nothing about what the document means. Shapes, components, design-system semantics and prototyping all live in the client; the platform sequences intent it does not interpret beyond structural validity.
- Sharing is resolved inside the platform rather than by the product's own permission layer, because a revocation has to reach a socket that is already open — a decision that only works if the capability is bound at admission (view 22).
- Assets never travel through the session: the document holds a content hash and the bytes move client-to-storage, which keeps a 100 MB image out of the ordering path (view 11).
Deliberately out of scope
- The rendering engine and the editor's own undo UI — only the semantics of a shared undo are the platform's problem (view 10 of the requirement).
- Plugin execution: the plugin host is a caller with a quota, not code the platform runs.
- Billing and entitlements. The platform reads limits and never decides them.
Assumptions
- 4 million monthly active editors, 11 million monthly viewers, 120,000 workspaces — a stated assumption, not a measurement.
- Viewers outnumber editors by roughly three to one, which is what justifies giving them a separate distribution path.
- Identity is federated to the workspace's own tenant; guest viewers arrive through link scope with no account.
