Multiplayer Collaborative Canvas · View 02 of 23 · Context and scope
Decisions
- Editor sockets terminate on the session host that sequences the document, so the acknowledgement costs one hop and not three. Viewers and presence leave through managed fan-out instead, where an extra hop is free (ADR-06).
- The operation log is a per-document partition in Cosmos DB rather than a stream broker: 900 million documents need 900 million independent logs, which is a partitioning problem, not a topic problem (ADR-09).
- Checkpoints are written by the session that already holds the document in memory. No second implementation of document application exists on the write path (ADR-10).
What may fail
- Fan-out: presence and viewer broadcast are shed under load and have no availability target of their own.
- Checkpoint store: a cold open fails with a typed error while live sessions carry on from the log.
- Nothing else. If the log cannot be written, the document goes read-only and says so — the platform never accepts an edit it may lose (ADR-04).
Numbers
- Ack p99 ≤ 120 ms in-region; remote edit visible p99 ≤ 250 ms; presence p99 ≤ 150 ms.
- 120,000 operations/second steady, 400,000 for a 60 s burst; 1.5 million presence messages/second after coalescing.
- All stated assumptions, sized for 300,000 concurrent connections at peak.
