Multiplayer Collaborative Canvas · View 10 of 23 · Data
Decisions
- The acknowledgement is sent after the append commits and replicates in-region, never before. That is the whole of the platform's durability promise, and it is what makes RPO 0 in-region true rather than aspirational (ADR-04).
- Operations carry intent on the document graph — create, delete, reparent, set property, reorder — not rendered diffs, which is what makes history, undo and merge expressible at all (ADR-02).
- The derived stage is fed from the committed log, so a search index or a thumbnail can be rebuilt without touching the edit path.
Limits as requirements
- 256 KB per operation and 200 operations/second per client, enforced with a typed rejection and a retry hint rather than unbounded buffering.
- An operation that is structurally invalid, references an unknown object or would create a cycle is refused at the admit stage — one malformed operation never stalls a document's stream.
Assumptions
- Metadata-only export to the analytics estate: document content is excluded by construction, not by policy.
- Checkpoint cadence 30 minutes of activity; log retained 30 days past the checkpoint.
