Multiplayer Collaborative Canvas · View 08 of 23 · Structure
Decisions
- The session router is a placement service, not a proxy: it claims the lease and names the host, then gets out of the data path. Putting it in the path would add a hop to every operation and make it the platform's own single point of failure (ADR-03).
- The rebuild verifier exists because the checkpoint writer is the session itself. A background job replays the log independently and diffs the result, which is how a one-way application bug is caught before a user finds it (ADR-10).
- The control plane is a separate deployment with its own store, so the blast radius of a sharing-service failure is admissions and not live editing.
Assumptions
- Session hosts are memory-optimised and hold whole documents; the p99 60 MB document and the 500 MB ceiling size the node (ADR-08).
- The capability cache holds a 5-minute grace window — long enough to survive a control-plane restart, short enough that a revocation is never older than the window.
Risks
- A single platform component owns both the socket and the sequencer. That is the deliberate decision of the set (ADR-01), and it concentrates the failure: a bad deploy to the session host is a product-wide read-only event, which is why releases are gated on convergence replay (view 20).
