Multiplayer Collaborative Canvas  ·  View 11 of 23  ·  Data

State Classes

Five classes of state with five different recovery stories — the page that decides what is backed up.

Editable source SVG draw.io All views
Authoritative state System of record Operation log RPO 0 in-region Lease & epoch fencing token Control plane Grants & links Version names Comments Audit log immutable, 7 years Derived state — droppable Rebuildable from the log Checkpoints 30 min cadence Version index Search index Thumbnails Volatile by design Session state in memory Presence 0 s retention Capability cache 5 min grace Written once, never mutated Asset blobs content-addressed Renditions regenerable Exports TTL 7 days materialise State Classes — What Is Truth, What Is Derived, What Is Volatile Data store Application we own event / async Only the two authoritative boxes are backed up. Everything in the derived box is rebuilt from the log; losing the volatile box costs a reconnect. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • Only the operation log, the lease and the control plane are authoritative; only they are backed up. Checkpoints, indexes, thumbnails and search are rebuilt from the log, and session state and presence are simply lost (ADR-09).
  • Presence is never written anywhere. Its retention is zero seconds beyond delivery, which is both a privacy property and the reason it can be shed freely (ADR-07).
  • Assets are written once and never mutated, so a content hash is a permanent reference and deduplication within a tenant is safe.

Consequences

  • A corrupt checkpoint, a bad index deploy and a wrong thumbnail have one remedy — rebuild — instead of three recovery procedures.
  • Losing the volatile class costs every connected client a reconnect, which is why the reconnect path has a latency budget (p95 1.5 s) rather than being an error handler.
  • The capability cache is the one piece of volatile state with a correctness role: its 5-minute grace window is a deliberate, bounded compromise on revocation during a control-plane outage.

Assumptions

  • Operation log 6 TB/day after compression; 40 TB/month of new assets; audit records 7 years.
◀  Data Flow — One Operation All views Data Model  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-1011-state-classes