Multiplayer Collaborative Canvas  ·  View 12 of 23  ·  Data

Data Model

Nine entities, and the one that does not exist: the document graph itself.

Editable source SVG draw.io All views
tenant tenant_id PK residency_region plan_tier cmk_key_uri document document_id PK tenant_id FK -> tenant schema_version head_seq deleted_at operation document_id PK seq PK epoch author_id op_kind payload committed_at checkpoint checkpoint_id PK document_id FK seq blob_uri bytes grant grant_id PK document_id FK principal_id role source revoked_at session_lease document_id PK epoch host_id expires_at named_version version_id PK document_id FK seq name created_by comment comment_id PK document_id FK anchor_object_id anchor_seq orphaned asset content_hash PK tenant_id FK -> tenant bytes scan_state 1 : N 1 : N N : 1 N : M 1 : N 1 : 1 1 : N 1 : N Data Model — Document, Operation, Authority The document graph is not a table: it exists only as the fold of its operations, materialised into a checkpoint that references the assets it needs. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • The document graph is not stored as rows. It is the fold of its operations, materialised into a checkpoint — which is why `document.head_seq` and not a shape table is the document's state (ADR-02).
  • `operation` is keyed by (document_id, seq) with the epoch recorded on every row. The epoch is the fence: an append from a host holding an older epoch is rejected by the store, not by a service (ADR-03).
  • `session_lease` is one row per document, and it is the only mutable row on the authority path. Everything else about authority is append-only.

Assumptions

  • `comment.anchor_seq` records the version the anchor was valid at, so an orphaned comment can say when it was orphaned.
  • `asset.scan_state` is part of the model rather than a side table, because an unscanned asset must be referenceable but not servable.
  • Residency and customer-managed keys live on `tenant`, so a document's region and key are resolved without a join at admission.

Risks

  • Partitioning by document means no cross-document transaction exists. A feature that needs one — moving a component library between documents atomically — is a new design, not a new query (ADR-08).
◀  State Classes All views Critical Flow — Edit to Acknowledgement  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-1012-document-data-model