Multiplayer Collaborative Canvas · View 09 of 23 · Structure
Decisions
- The session API is the only stateful interface; sharing, assets and history are ordinary request/response services, which is what lets them scale and fail independently.
- The plugin host is a first-class caller with its own quota and capability, because a bulk change to 400 layers is a legitimate use that looks exactly like an attack.
- Asset bytes never enter an API: the asset service issues a short-lived pre-signed URL and the client talks to storage directly (ADR-13).
Dependencies that must be survivable
- Entra ID is on the admission path. Its loss stops new sessions and must not stop open ones — hence in-band token renewal and the cached capability grace window.
- Web PubSub carries presence and viewers. Its loss degrades the experience and must never block an acknowledgement.
- Malware scanning is asynchronous by construction: an unscanned asset is referenced and not served.
Omitted
- The asynchronous search feed and the metadata-only analytics export, both drawn in views 01 and 10, are left off this page to keep the fan readable.
