[
  {
    "id": "01-system-context",
    "title": "Multiplayer Collaborative Canvas — System Context",
    "layout": "context",
    "system": {
      "label": "Multiplayer Canvas Platform",
      "sub": "Live document sessions"
    },
    "groups": [
      {
        "side": "left",
        "title": "People",
        "nodes": [
          {
            "id": "designer",
            "label": "Designer",
            "kind": "actor",
            "sub": "edits live",
            "rel": "operations",
            "dir": "in"
          },
          {
            "id": "stake",
            "label": "Stakeholder",
            "kind": "actor",
            "sub": "link, comment only",
            "rel": "comments",
            "dir": "in"
          },
          {
            "id": "admin",
            "label": "Workspace admin",
            "kind": "actor",
            "rel": "sharing rules",
            "dir": "in"
          }
        ]
      },
      {
        "side": "top",
        "title": "Clients",
        "nodes": [
          {
            "id": "web",
            "label": "Web editor",
            "kind": "external",
            "sub": "local replica",
            "rel": "socket",
            "dir": "in"
          },
          {
            "id": "mobile",
            "label": "Mobile viewer",
            "kind": "external",
            "rel": "read-only",
            "dir": "in"
          }
        ]
      },
      {
        "side": "right",
        "title": "Depends on",
        "nodes": [
          {
            "id": "entra",
            "label": "Microsoft Entra ID",
            "kind": "external",
            "rel": "sign-in, tokens"
          },
          {
            "id": "scan",
            "label": "Malware scanning",
            "kind": "external",
            "sub": "uploaded assets",
            "rel": "verdicts"
          },
          {
            "id": "notify",
            "label": "Notification service",
            "kind": "external",
            "rel": "mentions",
            "kind2": "async"
          },
          {
            "id": "billing",
            "label": "Entitlements",
            "kind": "external",
            "sub": "plan, seats",
            "rel": "limits"
          }
        ]
      },
      {
        "side": "bottom",
        "title": "Downstream",
        "nodes": [
          {
            "id": "search",
            "label": "Search service",
            "kind": "external",
            "rel": "index feed",
            "kind2": "async"
          },
          {
            "id": "analytics",
            "label": "Analytics estate",
            "kind": "external",
            "sub": "metadata only",
            "rel": "exports",
            "kind2": "batch"
          },
          {
            "id": "audit",
            "label": "Audit & support",
            "kind": "external",
            "rel": "audit events",
            "kind2": "async"
          }
        ]
      }
    ],
    "note": "Clients: web editor, desktop app (same replica) and mobile viewer. Out of scope: the rendering engine, design-system semantics, prototyping playback, plugin execution, billing.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "02-high-level-architecture",
    "title": "High-Level Architecture — Edit Path and Fan-Out",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Clients",
        "nodes": [
          {
            "id": "cweb",
            "label": "Web editor",
            "kind": "external",
            "sub": "local replica"
          },
          {
            "id": "cmob",
            "label": "Mobile viewer",
            "kind": "external"
          }
        ]
      },
      {
        "title": "Edge & admission",
        "nodes": [
          {
            "id": "afd",
            "label": "Front Door + WAF",
            "kind": "integration"
          },
          {
            "id": "adm",
            "label": "Admission service",
            "kind": "app",
            "sub": "authn, capability"
          }
        ]
      },
      {
        "title": "Session tier",
        "nodes": [
          {
            "id": "router",
            "label": "Session router",
            "kind": "app",
            "sub": "lease + epoch"
          },
          {
            "id": "host",
            "label": "Session host",
            "kind": "app",
            "sub": "the sequencer"
          }
        ]
      },
      {
        "title": "Record",
        "nodes": [
          {
            "id": "oplog",
            "label": "Operation log",
            "kind": "store",
            "sub": "Cosmos DB"
          },
          {
            "id": "lease",
            "label": "Lease & epoch",
            "kind": "store",
            "sub": "Cosmos DB"
          }
        ]
      },
      {
        "title": "Fan-out",
        "nodes": [
          {
            "id": "pubsub",
            "label": "Web PubSub",
            "kind": "integration",
            "sub": "presence, viewers"
          }
        ]
      },
      {
        "title": "Derived & assets",
        "nodes": [
          {
            "id": "ckpt",
            "label": "Checkpoints",
            "kind": "store",
            "sub": "Blob Storage"
          },
          {
            "id": "assets",
            "label": "Assets",
            "kind": "store",
            "sub": "content-addressed"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "host",
        "to": "ckpt",
        "label": "checkpoint",
        "kind": "async"
      },
      {
        "from": "host",
        "to": "pubsub",
        "label": "presence",
        "kind": "async"
      },
      {
        "from": "cweb",
        "to": "assets",
        "label": "pre-signed PUT",
        "route": "gutter"
      }
    ],
    "note": "Editor sockets terminate on the session host; viewers and presence leave through managed fan-out.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "03-actors-and-journeys",
    "title": "Actors and the Journeys That Carry the Value",
    "layout": "actors",
    "groups": [
      {
        "title": "People in the file",
        "kind": "boundary",
        "actors": [
          {
            "id": "a-designer",
            "label": "Product designer",
            "sub": "4 M / month",
            "goal": "Work in the same file as my colleague without either of us losing a change or waiting for a save.",
            "journeys": [
              {
                "id": "j-together",
                "label": "Design together, live"
              },
              {
                "id": "j-offline",
                "label": "Keep working offline"
              },
              {
                "label": "Roll back to yesterday"
              }
            ]
          },
          {
            "id": "a-reviewer",
            "label": "Stakeholder",
            "sub": "11 M / month",
            "goal": "Open the link someone pasted in chat, see what changed, and leave a comment where it belongs.",
            "journeys": [
              {
                "id": "j-review",
                "label": "Review by shared link"
              },
              {
                "label": "Follow someone's cursor"
              }
            ]
          },
          {
            "id": "a-admin",
            "label": "Workspace admin",
            "sub": "120 k workspaces",
            "goal": "Remove a leaver's access and know it took effect while they still had the file open.",
            "journeys": [
              {
                "label": "Revoke access now"
              },
              {
                "label": "Recover a deleted file"
              }
            ]
          }
        ]
      },
      {
        "title": "Machines in the file",
        "kind": "cloud",
        "actors": [
          {
            "id": "a-plugin",
            "label": "Plugin host",
            "kind": "external",
            "sub": "quota-bound",
            "goal": "Apply a bulk change to 400 layers without being mistaken for a denial-of-service attack.",
            "journeys": [
              {
                "label": "Bulk-edit under quota"
              }
            ]
          },
          {
            "id": "a-sre",
            "label": "Platform SRE",
            "kind": "platform",
            "sub": "on call",
            "goal": "Know within a minute that one client's document has drifted from the server's version.",
            "journeys": [
              {
                "label": "Catch divergence early"
              },
              {
                "label": "Re-host a lost session"
              }
            ]
          }
        ]
      }
    ],
    "note": "Three journeys are mapped in the next views: design together, review by link, and the return from offline.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "04-journey-design-together",
    "title": "Journey — Two Designers, One File",
    "layout": "journey",
    "actor": {
      "label": "Product designer",
      "sub": "web editor, office Wi-Fi",
      "goal": "Move the same frames as my colleague and never think about saving",
      "trigger": "A review in forty minutes and two people splitting the work",
      "success": "One file, both sets of changes, no duplicate layers and no lost work"
    },
    "phases": [
      {
        "title": "Open",
        "sub": "file already live"
      },
      {
        "title": "Edit in parallel"
      },
      {
        "title": "Collide",
        "moment": true
      },
      {
        "title": "Hand off"
      },
      {
        "title": "Present",
        "moment": true
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Opens the file"
            },
            {
              "label": "Sees two cursors"
            }
          ],
          [
            {
              "label": "Drags a frame"
            },
            {
              "label": "Renames layers"
            }
          ],
          [
            {
              "label": "Both move one layer"
            }
          ],
          [
            {
              "label": "@mentions a reviewer"
            }
          ],
          [
            {
              "label": "Opens in the meeting"
            }
          ]
        ]
      },
      {
        "title": "What the platform does",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Warm session, roster"
            }
          ],
          [
            {
              "label": "Local echo, then ack"
            }
          ],
          [
            {
              "label": "Sequenced, last write wins"
            }
          ],
          [
            {
              "label": "Comment anchored"
            }
          ],
          [
            {
              "label": "Checkpoint, named version"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "Trusts it",
          "Fine",
          "Doubts it"
        ],
        "points": [
          1,
          2,
          0,
          1,
          2
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [],
          [],
          [
            {
              "label": "Layer jumps back once"
            }
          ],
          [],
          [
            {
              "label": "Stale thumbnail in the file list"
            }
          ]
        ]
      }
    ],
    "note": "The trough is the only moment the convergence rules become visible to a person: the loser of a concurrent move must be told, not silently corrected.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "05-journey-review-by-link",
    "title": "Journey — Stakeholder Reviews by Shared Link",
    "layout": "journey",
    "actor": {
      "label": "Stakeholder",
      "sub": "no account, mobile first",
      "goal": "See the latest version and leave one comment in the right place",
      "trigger": "A link pasted into a chat thread ten minutes before a call",
      "success": "Comment lands on the right object and the designer answers it"
    },
    "phases": [
      {
        "title": "Receive link"
      },
      {
        "title": "Open",
        "moment": true
      },
      {
        "title": "Watch live"
      },
      {
        "title": "Comment"
      },
      {
        "title": "Get an answer"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Taps a chat link"
            }
          ],
          [
            {
              "label": "Loads a 60 MB file"
            }
          ],
          [
            {
              "label": "Follows a cursor"
            }
          ],
          [
            {
              "label": "Pins a comment"
            }
          ],
          [
            {
              "label": "Reads the reply"
            }
          ]
        ]
      },
      {
        "title": "What the platform does",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Link scope resolved"
            }
          ],
          [
            {
              "label": "Checkpoint + log tail"
            }
          ],
          [
            {
              "label": "Viewer broadcast only"
            }
          ],
          [
            {
              "label": "Anchored, durable"
            }
          ],
          [
            {
              "label": "Mention notified"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "Easy",
          "Fine",
          "Gives up"
        ],
        "points": [
          2,
          0,
          2,
          1,
          2
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [],
          [
            {
              "label": "Blank canvas while assets load"
            }
          ],
          [],
          [
            {
              "label": "Anchor object deleted"
            }
          ],
          []
        ]
      }
    ],
    "note": "A viewer never reaches the sequencer: their whole experience is a checkpoint, a log tail and a broadcast group.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "06-journey-offline-and-back",
    "title": "Journey — Offline on a Train, Back at the Office",
    "layout": "journey",
    "actor": {
      "label": "Product designer",
      "sub": "desktop app, no network",
      "goal": "Keep working on the file I already had open and not lose an hour of it",
      "trigger": "A tunnel, a flight, or a hotel network that resolves nothing",
      "success": "Every offline change is in the file, or I am told exactly what is not"
    },
    "phases": [
      {
        "title": "Lose the network",
        "moment": true
      },
      {
        "title": "Keep editing"
      },
      {
        "title": "Reconnect"
      },
      {
        "title": "Merge",
        "moment": true
      },
      {
        "title": "Continue"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Keeps dragging"
            }
          ],
          [
            {
              "label": "Makes 800 edits"
            }
          ],
          [
            {
              "label": "Opens the laptop"
            }
          ],
          [
            {
              "label": "Checks their work"
            }
          ],
          [
            {
              "label": "Carries on"
            }
          ]
        ]
      },
      {
        "title": "What the platform does",
        "kind": "system",
        "cells": [
          [
            {
              "label": "State: reconnecting"
            }
          ],
          [
            {
              "label": "Local op buffer"
            }
          ],
          [
            {
              "label": "Catch-up by replay"
            }
          ],
          [
            {
              "label": "Merge or branch"
            }
          ],
          [
            {
              "label": "Fresh checkpoint"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "Calm",
          "Uneasy",
          "Afraid"
        ],
        "points": [
          0,
          1,
          1,
          0,
          2
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [
            {
              "label": "Is this saved anywhere?"
            }
          ],
          [],
          [],
          [
            {
              "label": "Edits to a deleted frame"
            }
          ],
          []
        ]
      }
    ],
    "note": "Beyond the 30-day log horizon the merge becomes a recoverable branch the user is told about — never a silent discard.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "07-layered-architecture",
    "title": "Layered Architecture",
    "layout": "bands",
    "bands": [
      {
        "name": "Clients",
        "nodes": [
          {
            "id": "l-web",
            "label": "Web editor",
            "kind": "external",
            "sub": "local replica"
          },
          {
            "id": "l-desk",
            "label": "Desktop app",
            "kind": "external"
          },
          {
            "id": "l-mob",
            "label": "Mobile viewer",
            "kind": "external"
          },
          {
            "id": "l-plug",
            "label": "Plugin host",
            "kind": "external"
          }
        ]
      },
      {
        "name": "Edge",
        "nodes": [
          {
            "id": "l-afd",
            "label": "Front Door + WAF",
            "kind": "integration"
          },
          {
            "id": "l-adm",
            "label": "Admission",
            "kind": "app",
            "sub": "authn, capability"
          },
          {
            "id": "l-tok",
            "label": "Token renewal",
            "kind": "security"
          },
          {
            "id": "l-rate",
            "label": "Rate limiting",
            "kind": "integration"
          }
        ]
      },
      {
        "name": "Real-time",
        "nodes": [
          {
            "id": "l-sock",
            "label": "Editor sockets",
            "kind": "app"
          },
          {
            "id": "l-pres",
            "label": "Presence coalescer",
            "kind": "app",
            "sub": "10 Hz cap"
          },
          {
            "id": "l-wps",
            "label": "Web PubSub groups",
            "kind": "integration"
          },
          {
            "id": "l-shed",
            "label": "Shedding policy",
            "kind": "platform"
          }
        ]
      },
      {
        "name": "Session",
        "nodes": [
          {
            "id": "l-seq",
            "label": "Sequencer",
            "kind": "app",
            "sub": "one per document"
          },
          {
            "id": "l-conf",
            "label": "Conflict rules",
            "kind": "app"
          },
          {
            "id": "l-catch",
            "label": "Catch-up",
            "kind": "app"
          },
          {
            "id": "l-ckw",
            "label": "Checkpoint writer",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Record",
        "nodes": [
          {
            "id": "l-log",
            "label": "Operation log",
            "kind": "store",
            "sub": "per document"
          },
          {
            "id": "l-lease",
            "label": "Lease & epoch",
            "kind": "store"
          }
        ]
      },
      {
        "name": "Derived",
        "nodes": [
          {
            "id": "l-ckpt",
            "label": "Checkpoints",
            "kind": "store"
          },
          {
            "id": "l-ver",
            "label": "Version index",
            "kind": "store"
          },
          {
            "id": "l-asset",
            "label": "Assets & renditions",
            "kind": "store"
          },
          {
            "id": "l-srch",
            "label": "Search feed",
            "kind": "queue"
          }
        ]
      },
      {
        "name": "Platform",
        "nodes": [
          {
            "id": "l-entra",
            "label": "Entra ID",
            "kind": "security"
          },
          {
            "id": "l-kv",
            "label": "Key Vault",
            "kind": "security"
          },
          {
            "id": "l-mon",
            "label": "Azure Monitor",
            "kind": "platform"
          },
          {
            "id": "l-share",
            "label": "Sharing & grants",
            "kind": "app"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "l-sock",
        "to": "l-seq",
        "label": "operations"
      },
      {
        "from": "l-seq",
        "to": "l-log",
        "label": "fenced append"
      },
      {
        "from": "l-pres",
        "to": "l-wps",
        "label": "presence",
        "kind": "async"
      },
      {
        "from": "l-adm",
        "to": "l-share",
        "label": "capability"
      }
    ],
    "note": "Only the Session layer holds authority; every layer above it is a replica and every layer below it is derived — except the Record layer.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "08-platform-components",
    "title": "Platform Components (C4 Level 2)",
    "layout": "nested",
    "boxes": [
      {
        "title": "Document plane — Azure",
        "kind": "cloud",
        "dir": "col",
        "children": [
          {
            "title": "Edge",
            "kind": "boundary",
            "nodes": [
              {
                "id": "c-afd",
                "label": "Front Door + WAF",
                "kind": "integration"
              },
              {
                "id": "c-adm",
                "label": "Admission service",
                "kind": "app",
                "sub": "capability binding"
              },
              {
                "id": "c-router",
                "label": "Session router",
                "kind": "app",
                "sub": "placement"
              }
            ]
          },
          {
            "title": "Session tier — AKS",
            "kind": "boundary",
            "nodes": [
              {
                "id": "c-host",
                "label": "Session host",
                "kind": "app",
                "sub": "sequencer + socket"
              },
              {
                "id": "c-catch",
                "label": "Catch-up service",
                "kind": "app"
              },
              {
                "id": "c-ckw",
                "label": "Checkpoint writer",
                "kind": "app"
              },
              {
                "id": "c-verify",
                "label": "Rebuild verifier",
                "kind": "app",
                "sub": "log vs snapshot"
              }
            ]
          },
          {
            "title": "Record and derived state",
            "kind": "boundary",
            "nodes": [
              {
                "id": "c-log",
                "label": "Operation log",
                "kind": "store",
                "sub": "Cosmos DB"
              },
              {
                "id": "c-lease",
                "label": "Lease & epoch",
                "kind": "store",
                "sub": "Cosmos DB"
              },
              {
                "id": "c-ckpt",
                "label": "Checkpoints",
                "kind": "store",
                "sub": "Blob Storage"
              },
              {
                "id": "c-ver",
                "label": "Version index",
                "kind": "store",
                "sub": "PostgreSQL"
              }
            ]
          }
        ]
      },
      {
        "title": "Control plane",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Services",
            "kind": "plain",
            "nodes": [
              {
                "id": "c-share",
                "label": "Sharing service",
                "kind": "app",
                "sub": "grants, links"
              },
              {
                "id": "c-comment",
                "label": "Comment service",
                "kind": "app"
              },
              {
                "id": "c-asset",
                "label": "Asset service",
                "kind": "app",
                "sub": "upload intent"
              },
              {
                "id": "c-admin",
                "label": "Admin API",
                "kind": "app"
              }
            ]
          },
          {
            "title": "Stores",
            "kind": "plain",
            "nodes": [
              {
                "id": "c-meta",
                "label": "Metadata store",
                "kind": "store",
                "sub": "PostgreSQL"
              },
              {
                "id": "c-cap",
                "label": "Capability cache",
                "kind": "store",
                "sub": "Redis"
              },
              {
                "id": "c-audit",
                "label": "Audit log",
                "kind": "store",
                "sub": "immutable"
              }
            ]
          }
        ]
      }
    ],
    "outside": [
      {
        "id": "c-wps",
        "label": "Web PubSub",
        "kind": "integration",
        "sub": "viewer fan-out"
      },
      {
        "id": "c-entra",
        "label": "Entra ID",
        "kind": "external"
      },
      {
        "id": "c-blobassets",
        "label": "Asset blobs",
        "kind": "store",
        "sub": "content-addressed"
      },
      {
        "id": "c-scan",
        "label": "Malware scanning",
        "kind": "external"
      }
    ],
    "edges": [
      {
        "from": "c-afd",
        "to": "c-adm",
        "label": "upgrade"
      },
      {
        "from": "c-adm",
        "to": "c-share",
        "label": "resolve grant"
      },
      {
        "from": "c-router",
        "to": "c-lease",
        "label": "claim epoch"
      },
      {
        "from": "c-host",
        "to": "c-log",
        "label": "fenced append"
      },
      {
        "from": "c-ckw",
        "to": "c-ckpt",
        "label": "snapshot",
        "kind": "async"
      },
      {
        "from": "c-host",
        "to": "c-wps",
        "label": "presence",
        "kind": "async"
      },
      {
        "from": "c-asset",
        "to": "c-blobassets",
        "label": "pre-signed"
      },
      {
        "from": "c-scan",
        "to": "c-asset",
        "label": "verdict",
        "kind": "async"
      }
    ],
    "note": "The rebuild verifier replays the log and diffs it against the live snapshot. Omitted: every service reads Entra ID and writes Azure Monitor.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "09-integration-surface",
    "title": "Integration Surface — Who Calls In, What It Calls Out",
    "layout": "hub",
    "left": {
      "title": "Callers",
      "nodes": [
        {
          "id": "i-ed",
          "label": "Editor clients",
          "kind": "external",
          "sub": "web, desktop",
          "rel": "editor socket"
        },
        {
          "id": "i-vw",
          "label": "Viewer clients",
          "kind": "external",
          "sub": "mobile, link",
          "rel": "viewer group"
        },
        {
          "id": "i-mc",
          "label": "Machines",
          "kind": "external",
          "sub": "plugins, export",
          "rel": "batch ops"
        }
      ]
    },
    "centre": {
      "title": "Platform interfaces",
      "nodes": [
        {
          "id": "i-api",
          "label": "Canvas platform APIs",
          "kind": "app",
          "sub": "session · sharing · assets"
        }
      ]
    },
    "right": {
      "title": "Dependencies",
      "nodes": [
        {
          "id": "i-entra",
          "label": "Entra ID",
          "kind": "external",
          "sub": "OIDC",
          "rel": "token check",
          "dir": "out"
        },
        {
          "id": "i-wps",
          "label": "Web PubSub",
          "kind": "integration",
          "rel": "group publish",
          "dir": "out"
        },
        {
          "id": "i-blob",
          "label": "Blob & scanning",
          "kind": "store",
          "sub": "pre-signed",
          "rel": "assets",
          "dir": "out"
        }
      ]
    },
    "note": "Four interfaces behind one surface: session, sharing, assets, history. Omitted to keep the view readable: the asynchronous search feed and the metadata-only analytics export, both shown in views 01 and 10.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "10-edit-path-data-flow",
    "title": "Data Flow — One Operation, End to End",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Client",
        "nodes": [
          {
            "id": "f-rep",
            "label": "Local replica",
            "kind": "external",
            "sub": "renders first"
          },
          {
            "id": "f-buf",
            "label": "Op buffer",
            "kind": "external",
            "sub": "unacked ops"
          }
        ]
      },
      {
        "title": "Admit",
        "nodes": [
          {
            "id": "f-cap",
            "label": "Capability check",
            "kind": "app"
          },
          {
            "id": "f-val",
            "label": "Schema & bounds",
            "kind": "app",
            "sub": "256 KB cap"
          },
          {
            "id": "f-rate",
            "label": "Rate limit",
            "kind": "integration",
            "sub": "200 ops/s"
          }
        ]
      },
      {
        "title": "Sequence",
        "nodes": [
          {
            "id": "f-seq",
            "label": "Sequencer",
            "kind": "app",
            "sub": "one per document"
          },
          {
            "id": "f-conf",
            "label": "Conflict rules",
            "kind": "app",
            "sub": "four classes"
          }
        ]
      },
      {
        "title": "Commit",
        "nodes": [
          {
            "id": "f-log",
            "label": "Operation log",
            "kind": "store",
            "sub": "fenced append"
          }
        ]
      },
      {
        "title": "Distribute",
        "nodes": [
          {
            "id": "f-sock",
            "label": "Editor sockets",
            "kind": "app"
          },
          {
            "id": "f-wps",
            "label": "Viewer broadcast",
            "kind": "integration",
            "sub": "Web PubSub"
          }
        ]
      },
      {
        "title": "Derive",
        "nodes": [
          {
            "id": "f-ckpt",
            "label": "Checkpoints",
            "kind": "store",
            "sub": "every 30 min"
          },
          {
            "id": "f-ver",
            "label": "Version index",
            "kind": "store"
          },
          {
            "id": "f-feed",
            "label": "Search & audit feed",
            "kind": "queue",
            "sub": "metadata only"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "f-seq",
        "to": "f-buf",
        "label": "ack with seq",
        "kind": "return",
        "route": "gutter"
      }
    ],
    "note": "The acknowledgement is the only thing the client waits for, and it is only ever sent after the append commits.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "11-state-classes",
    "title": "State Classes — What Is Truth, What Is Derived, What Is Volatile",
    "layout": "nested",
    "boxes": [
      {
        "title": "Authoritative state",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "System of record",
            "kind": "plain",
            "nodes": [
              {
                "id": "s-log",
                "label": "Operation log",
                "kind": "store",
                "sub": "RPO 0 in-region"
              },
              {
                "id": "s-lease",
                "label": "Lease & epoch",
                "kind": "store",
                "sub": "fencing token"
              }
            ]
          },
          {
            "title": "Control plane",
            "kind": "plain",
            "nodes": [
              {
                "id": "s-grant",
                "label": "Grants & links",
                "kind": "store"
              },
              {
                "id": "s-ver",
                "label": "Version names",
                "kind": "store"
              },
              {
                "id": "s-com",
                "label": "Comments",
                "kind": "store"
              },
              {
                "id": "s-audit",
                "label": "Audit log",
                "kind": "store",
                "sub": "immutable, 7 years"
              }
            ]
          }
        ]
      },
      {
        "title": "Derived state — droppable",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Rebuildable from the log",
            "kind": "plain",
            "nodes": [
              {
                "id": "s-ckpt",
                "label": "Checkpoints",
                "kind": "store",
                "sub": "30 min cadence"
              },
              {
                "id": "s-vidx",
                "label": "Version index",
                "kind": "store"
              },
              {
                "id": "s-srch",
                "label": "Search index",
                "kind": "store"
              },
              {
                "id": "s-thumb",
                "label": "Thumbnails",
                "kind": "store"
              }
            ]
          },
          {
            "title": "Volatile by design",
            "kind": "plain",
            "nodes": [
              {
                "id": "s-sess",
                "label": "Session state",
                "kind": "app",
                "sub": "in memory"
              },
              {
                "id": "s-pres",
                "label": "Presence",
                "kind": "app",
                "sub": "0 s retention"
              },
              {
                "id": "s-cap",
                "label": "Capability cache",
                "kind": "store",
                "sub": "5 min grace"
              }
            ]
          }
        ]
      },
      {
        "title": "Written once, never mutated",
        "kind": "boundary",
        "nodes": [
          {
            "id": "s-asset",
            "label": "Asset blobs",
            "kind": "store",
            "sub": "content-addressed"
          },
          {
            "id": "s-rend",
            "label": "Renditions",
            "kind": "store",
            "sub": "regenerable"
          },
          {
            "id": "s-exp",
            "label": "Exports",
            "kind": "store",
            "sub": "TTL 7 days"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "s-log",
        "to": "s-ckpt",
        "label": "materialise",
        "kind": "async"
      }
    ],
    "note": "Only the two authoritative boxes are backed up. Everything in the derived box is rebuilt from the log; losing the volatile box costs a reconnect.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "12-document-data-model",
    "title": "Data Model — Document, Operation, Authority",
    "layout": "er",
    "canvas": {
      "width": 1850,
      "cols": 5
    },
    "rowGap": 250,
    "entities": [
      {
        "id": "tenant",
        "name": "tenant",
        "kind": "store",
        "row": 0,
        "col": 0,
        "attrs": [
          "tenant_id  PK",
          "residency_region",
          "plan_tier",
          "cmk_key_uri"
        ]
      },
      {
        "id": "document",
        "name": "document",
        "kind": "store",
        "row": 0,
        "col": 1,
        "attrs": [
          "document_id  PK",
          "tenant_id  FK -> tenant",
          "schema_version",
          "head_seq",
          "deleted_at"
        ]
      },
      {
        "id": "operation",
        "name": "operation",
        "kind": "store",
        "row": 0,
        "col": 2,
        "attrs": [
          "document_id  PK",
          "seq  PK",
          "epoch",
          "author_id",
          "op_kind",
          "payload",
          "committed_at"
        ]
      },
      {
        "id": "checkpoint",
        "name": "checkpoint",
        "kind": "store",
        "row": 0,
        "col": 3,
        "attrs": [
          "checkpoint_id  PK",
          "document_id  FK",
          "seq",
          "blob_uri",
          "bytes"
        ]
      },
      {
        "id": "grant",
        "name": "grant",
        "kind": "store",
        "row": 1,
        "col": 0,
        "attrs": [
          "grant_id  PK",
          "document_id  FK",
          "principal_id",
          "role",
          "source",
          "revoked_at"
        ]
      },
      {
        "id": "lease",
        "name": "session_lease",
        "kind": "store",
        "row": 1,
        "col": 1,
        "attrs": [
          "document_id  PK",
          "epoch",
          "host_id",
          "expires_at"
        ]
      },
      {
        "id": "version",
        "name": "named_version",
        "kind": "store",
        "row": 1,
        "col": 2,
        "attrs": [
          "version_id  PK",
          "document_id  FK",
          "seq",
          "name",
          "created_by"
        ]
      },
      {
        "id": "comment",
        "name": "comment",
        "kind": "store",
        "row": 1,
        "col": 3,
        "attrs": [
          "comment_id  PK",
          "document_id  FK",
          "anchor_object_id",
          "anchor_seq",
          "orphaned"
        ]
      },
      {
        "id": "asset",
        "name": "asset",
        "kind": "store",
        "row": 0,
        "col": 4,
        "attrs": [
          "content_hash  PK",
          "tenant_id  FK -> tenant",
          "bytes",
          "scan_state"
        ]
      }
    ],
    "relations": [
      {
        "from": "tenant",
        "to": "document",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "document",
        "to": "operation",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "operation",
        "to": "checkpoint",
        "label": "N : 1",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "checkpoint",
        "to": "asset",
        "label": "N : M",
        "kind": "optional",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "document",
        "to": "grant",
        "label": "1 : N",
        "from_side": "s1",
        "to_side": "n"
      },
      {
        "from": "document",
        "to": "lease",
        "label": "1 : 1",
        "from_side": "s3",
        "to_side": "n"
      },
      {
        "from": "operation",
        "to": "version",
        "label": "1 : N",
        "from_side": "s1",
        "to_side": "n"
      },
      {
        "from": "operation",
        "to": "comment",
        "label": "1 : N",
        "from_side": "s3",
        "to_side": "n"
      }
    ],
    "note": "The document graph is not a table: it exists only as the fold of its operations, materialised into a checkpoint that references the assets it needs.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "13-edit-acknowledgement-sequence",
    "title": "Critical Flow — An Edit From Keystroke to Acknowledgement",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "q-user",
        "label": "Designer",
        "kind": "actor"
      },
      {
        "id": "q-rep",
        "label": "Local replica",
        "kind": "external"
      },
      {
        "id": "q-host",
        "label": "Session host",
        "kind": "app"
      },
      {
        "id": "q-log",
        "label": "Operation log",
        "kind": "store"
      },
      {
        "id": "q-wps",
        "label": "Web PubSub",
        "kind": "integration"
      },
      {
        "id": "q-peer",
        "label": "Other editor",
        "kind": "external"
      }
    ],
    "messages": [
      {
        "from": "q-user",
        "to": "q-rep",
        "label": "drags a frame",
        "kind": "call"
      },
      {
        "from": "q-rep",
        "to": "q-rep",
        "label": "render immediately",
        "kind": "self"
      },
      {
        "from": "q-rep",
        "to": "q-host",
        "label": "op, parent seq 4811",
        "kind": "call"
      },
      {
        "from": "q-host",
        "to": "q-host",
        "label": "validate, sequence, resolve",
        "kind": "self"
      },
      {
        "from": "q-host",
        "to": "q-log",
        "label": "append at epoch 7",
        "kind": "call"
      },
      {
        "from": "q-log",
        "to": "q-host",
        "label": "committed, replicated",
        "kind": "return"
      },
      {
        "from": "q-host",
        "to": "q-rep",
        "label": "ack seq 4812",
        "kind": "return"
      },
      {
        "from": "q-host",
        "to": "q-peer",
        "label": "op seq 4812",
        "kind": "async"
      },
      {
        "from": "q-host",
        "to": "q-wps",
        "label": "cursor, coalesced",
        "kind": "async"
      },
      {
        "from": "q-wps",
        "to": "q-peer",
        "label": "presence frame",
        "kind": "async"
      },
      {
        "from": "q-host",
        "to": "q-rep",
        "label": "dropped: delete won",
        "kind": "error"
      }
    ],
    "note": "Message 11 is the conflict path: the author is told their edit lost, never silently corrected. Nothing waits on message 9 or 10.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "14-reconnect-and-catch-up",
    "title": "Critical Flow — Reconnect, Catch-Up and Offline Merge",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "r-rep",
        "label": "Local replica",
        "kind": "external"
      },
      {
        "id": "r-adm",
        "label": "Admission",
        "kind": "app"
      },
      {
        "id": "r-router",
        "label": "Session router",
        "kind": "app"
      },
      {
        "id": "r-host",
        "label": "Session host",
        "kind": "app"
      },
      {
        "id": "r-log",
        "label": "Operation log",
        "kind": "store"
      },
      {
        "id": "r-ckpt",
        "label": "Checkpoints",
        "kind": "store"
      }
    ],
    "messages": [
      {
        "from": "r-rep",
        "to": "r-adm",
        "label": "reattach at seq 4800",
        "kind": "call"
      },
      {
        "from": "r-adm",
        "to": "r-adm",
        "label": "re-resolve capability",
        "kind": "self"
      },
      {
        "from": "r-adm",
        "to": "r-router",
        "label": "place document",
        "kind": "call"
      },
      {
        "from": "r-router",
        "to": "r-host",
        "label": "attach, epoch 7",
        "kind": "call"
      },
      {
        "from": "r-host",
        "to": "r-log",
        "label": "ops after 4800",
        "kind": "call"
      },
      {
        "from": "r-log",
        "to": "r-host",
        "label": "130 ops",
        "kind": "return"
      },
      {
        "from": "r-host",
        "to": "r-rep",
        "label": "catch-up, then live",
        "kind": "return"
      },
      {
        "from": "r-rep",
        "to": "r-host",
        "label": "812 buffered ops",
        "kind": "call"
      },
      {
        "from": "r-host",
        "to": "r-log",
        "label": "append merged",
        "kind": "call"
      },
      {
        "from": "r-host",
        "to": "r-ckpt",
        "label": "cold path: snapshot",
        "kind": "async"
      },
      {
        "from": "r-host",
        "to": "r-rep",
        "label": "past horizon: branch kept",
        "kind": "error"
      }
    ],
    "note": "Message 10 is the alternative to replay when the client is further behind than the retained log; message 11 is the case beyond 30 days.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "15-session-handover",
    "title": "Session Handover — Losing the Authority and Getting It Back",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Steady state",
        "nodes": [
          {
            "id": "h-a",
            "label": "Session host A",
            "kind": "app",
            "sub": "epoch 7, owner"
          },
          {
            "id": "h-lease",
            "label": "Lease",
            "kind": "store",
            "sub": "15 s TTL, renewed"
          }
        ]
      },
      {
        "title": "Loss",
        "nodes": [
          {
            "id": "h-fail",
            "label": "Node lost",
            "kind": "risk",
            "sub": "no drain"
          },
          {
            "id": "h-exp",
            "label": "Lease expires",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Claim",
        "nodes": [
          {
            "id": "h-router",
            "label": "Session router",
            "kind": "app"
          },
          {
            "id": "h-ep",
            "label": "Epoch 8 issued",
            "kind": "app",
            "sub": "monotonic"
          }
        ]
      },
      {
        "title": "Fence",
        "nodes": [
          {
            "id": "h-log",
            "label": "Operation log",
            "kind": "store",
            "sub": "rejects epoch 7"
          }
        ]
      },
      {
        "title": "Rehydrate",
        "nodes": [
          {
            "id": "h-b",
            "label": "Session host B",
            "kind": "app",
            "sub": "checkpoint + tail"
          },
          {
            "id": "h-ckpt",
            "label": "Checkpoints",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Reattach",
        "nodes": [
          {
            "id": "h-ctrl",
            "label": "Admission control",
            "kind": "integration",
            "sub": "jittered backoff"
          },
          {
            "id": "h-cli",
            "label": "Clients",
            "kind": "external",
            "sub": "unacked ops resent"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "h-fail",
        "to": "h-cli",
        "label": "state: reconnecting",
        "kind": "error",
        "route": "gutter"
      }
    ],
    "note": "A zombie host A that wakes up still believing it owns the document writes at epoch 7 and is rejected: the fence is at the log, not in the router.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "16-presence-and-edit-planes",
    "title": "Two Planes — Edits, Presence and What Gives Under Load",
    "layout": "swimlane",
    "stages": [
      "Client",
      "Edge",
      "Session host",
      "Record",
      "Fan-out",
      "Peers"
    ],
    "lanes": [
      {
        "title": "Edit plane",
        "cells": [
          [
            {
              "label": "Op, rendered first"
            }
          ],
          [
            {
              "label": "Capability check"
            }
          ],
          [
            {
              "label": "Sequence + resolve"
            }
          ],
          [
            {
              "label": "Fenced append",
              "kind": "store"
            }
          ],
          [
            {
              "label": "Direct socket push"
            }
          ],
          [
            {
              "label": "Apply at seq"
            }
          ]
        ]
      },
      {
        "title": "Presence plane",
        "cells": [
          [
            {
              "label": "Cursor at 20 Hz"
            }
          ],
          [
            {
              "label": "Rate limit"
            }
          ],
          [
            {
              "label": "Coalesce to 10 Hz"
            }
          ],
          [],
          [
            {
              "label": "Web PubSub group",
              "kind": "integration"
            }
          ],
          [
            {
              "label": "Render cursors"
            }
          ]
        ]
      },
      {
        "title": "Viewer plane",
        "cells": [
          [
            {
              "label": "Open by link"
            }
          ],
          [
            {
              "label": "Link scope"
            }
          ],
          [
            {
              "label": "Snapshot + tail"
            }
          ],
          [
            {
              "label": "Checkpoint read",
              "kind": "store"
            }
          ],
          [
            {
              "label": "Viewer group",
              "kind": "integration"
            }
          ],
          [
            {
              "label": "Read-only render"
            }
          ]
        ]
      },
      {
        "title": "Under load",
        "cells": [
          [
            {
              "label": "Buffer locally"
            }
          ],
          [
            {
              "label": "429 + retry hint",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Defer presence",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Never deferred",
              "kind": "opportunity"
            }
          ],
          [
            {
              "label": "Shed presence, then viewers",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Stale cursors"
            }
          ]
        ]
      }
    ],
    "note": "The Record column is the one cell in the shedding row that cannot be degraded: an edit is acknowledged or refused, never queued in hope.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "17-deployment-architecture",
    "title": "Deployment — Home Region, Paired Region, Zone Redundancy",
    "layout": "nested",
    "boxes": [
      {
        "title": "Azure — West Europe (document home)",
        "kind": "cloud",
        "dir": "col",
        "children": [
          {
            "title": "Edge",
            "kind": "boundary",
            "nodes": [
              {
                "id": "d-afd",
                "label": "Front Door + WAF",
                "kind": "integration",
                "sub": "anycast"
              },
              {
                "id": "d-pl",
                "label": "Private Link",
                "kind": "security",
                "sub": "no public data path"
              }
            ]
          },
          {
            "title": "AKS — zones a, b, c",
            "kind": "boundary",
            "nodes": [
              {
                "id": "d-host",
                "label": "Session host pool",
                "kind": "app",
                "sub": "memory-optimised"
              },
              {
                "id": "d-adm",
                "label": "Admission pool",
                "kind": "app"
              },
              {
                "id": "d-ctl",
                "label": "Control-plane pool",
                "kind": "app"
              },
              {
                "id": "d-jobs",
                "label": "Checkpoint & verify",
                "kind": "app",
                "sub": "jobs"
              }
            ]
          },
          {
            "title": "Data services — zone-redundant",
            "kind": "boundary",
            "nodes": [
              {
                "id": "d-cos",
                "label": "Cosmos DB",
                "kind": "store",
                "sub": "op log, strong"
              },
              {
                "id": "d-pg",
                "label": "PostgreSQL",
                "kind": "store",
                "sub": "metadata, HA"
              },
              {
                "id": "d-redis",
                "label": "Redis",
                "kind": "store",
                "sub": "capability cache"
              },
              {
                "id": "d-blob",
                "label": "Blob RA-GZRS",
                "kind": "store",
                "sub": "checkpoints, assets"
              }
            ]
          },
          {
            "title": "Managed real-time",
            "kind": "boundary",
            "nodes": [
              {
                "id": "d-wps",
                "label": "Web PubSub",
                "kind": "integration",
                "sub": "viewer groups"
              }
            ]
          }
        ]
      },
      {
        "title": "Azure — North Europe (paired)",
        "kind": "cloud",
        "dir": "row",
        "children": [
          {
            "title": "Warm standby",
            "kind": "boundary",
            "nodes": [
              {
                "id": "d-host2",
                "label": "Session hosts",
                "kind": "app",
                "sub": "scaled to minimum"
              },
              {
                "id": "d-adm2",
                "label": "Admission",
                "kind": "app"
              }
            ]
          },
          {
            "title": "Replicated state",
            "kind": "boundary",
            "nodes": [
              {
                "id": "d-cos2",
                "label": "Cosmos replica",
                "kind": "store",
                "sub": "async, 5 s lag"
              },
              {
                "id": "d-blob2",
                "label": "Blob secondary",
                "kind": "store"
              },
              {
                "id": "d-pg2",
                "label": "PostgreSQL replica",
                "kind": "store"
              }
            ]
          }
        ]
      }
    ],
    "outside": [
      {
        "id": "d-entra",
        "label": "Entra ID",
        "kind": "external"
      },
      {
        "id": "d-hsm",
        "label": "Key Vault HSM",
        "kind": "security",
        "sub": "customer keys"
      },
      {
        "id": "d-mon",
        "label": "Azure Monitor",
        "kind": "platform",
        "sub": "+ Grafana"
      },
      {
        "id": "d-ci",
        "label": "GitHub Actions",
        "kind": "external",
        "sub": "build, deploy"
      }
    ],
    "edges": [
      {
        "from": "d-cos",
        "to": "d-cos2",
        "label": "async replication",
        "kind": "batch"
      },
      {
        "from": "d-host",
        "to": "d-cos",
        "label": "fenced append"
      }
    ],
    "note": "One write region per document, pinned by residency policy. Failover is a declared operation with a 5 s loss window, not an automatic active-active merge.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "18-observability",
    "title": "Observability — Signal by Pipeline Stage",
    "layout": "grid",
    "columns": [
      "Admission",
      "Session host",
      "Operation log",
      "Fan-out",
      "Derived state"
    ],
    "rows": [
      {
        "title": "Latency",
        "cells": [
          [
            {
              "label": "Admit p99"
            }
          ],
          [
            {
              "label": "Ack p99 ≤ 120 ms"
            }
          ],
          [
            {
              "label": "Commit p99"
            }
          ],
          [
            {
              "label": "Presence p99 ≤ 150 ms"
            }
          ],
          [
            {
              "label": "Cold open p95"
            }
          ]
        ]
      },
      {
        "title": "Saturation",
        "cells": [
          [
            {
              "label": "Connections per node"
            }
          ],
          [
            {
              "label": "Documents per host"
            }
          ],
          [
            {
              "label": "RU/s per partition"
            }
          ],
          [
            {
              "label": "Messages per group"
            }
          ],
          [
            {
              "label": "Checkpoint lag"
            }
          ]
        ]
      },
      {
        "title": "Correctness",
        "cells": [
          [
            {
              "label": "Rejected ops"
            }
          ],
          [
            {
              "label": "Conflicts by class"
            }
          ],
          [
            {
              "label": "Fenced rejects"
            }
          ],
          [],
          [
            {
              "label": "Rebuild diff"
            }
          ]
        ]
      },
      {
        "title": "User-visible",
        "cells": [
          [
            {
              "label": "Failed admissions",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Divergence checksums",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Read-only minutes",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Presence shed %"
            }
          ],
          [
            {
              "label": "Thumbnail staleness"
            }
          ]
        ]
      },
      {
        "title": "Cost",
        "cells": [
          [
            {
              "label": "Cost per admission"
            }
          ],
          [
            {
              "label": "$ per editor-hour"
            }
          ],
          [
            {
              "label": "RU + storage"
            }
          ],
          [
            {
              "label": "$ per million msgs"
            }
          ],
          [
            {
              "label": "Blob tier mix"
            }
          ]
        ]
      }
    ],
    "note": "Divergence checksums and read-only minutes are the two signals no other platform metric substitutes for: one says the document is wrong, the other says it cannot be saved.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "19-session-lifecycle",
    "title": "Session Lifecycle — Admission to Release and Back",
    "layout": "cycle",
    "centre": {
      "label": "Document session",
      "sub": "one authority"
    },
    "nodes": [
      {
        "label": "Admitted",
        "kind": "app",
        "sub": "capability bound",
        "id": "y1"
      },
      {
        "label": "Live",
        "kind": "app",
        "sub": "sequencing",
        "id": "y2"
      },
      {
        "label": "Checkpointed",
        "kind": "store",
        "sub": "every 30 min",
        "id": "y3"
      },
      {
        "label": "Idle",
        "kind": "app",
        "sub": "60 s grace",
        "id": "y4"
      },
      {
        "label": "Released",
        "kind": "platform",
        "sub": "lease dropped",
        "id": "y5"
      },
      {
        "label": "Re-hosted",
        "kind": "app",
        "sub": "epoch + 1",
        "id": "y6"
      }
    ],
    "ringLabels": [
      "first op",
      "30 min cadence",
      "last client leaves",
      "final snapshot",
      "reopen or host loss",
      "clients reattach"
    ],
    "note": "An idle document costs storage and nothing else, and a lost host enters the same ring one step earlier than a clean release.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "20-release-and-rollout",
    "title": "Release — Convergence as a Gate, Rollout as a Drain",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Source",
        "nodes": [
          {
            "id": "p-repo",
            "label": "Monorepo",
            "kind": "external",
            "sub": "client + server"
          },
          {
            "id": "p-schema",
            "label": "Op schema",
            "kind": "app",
            "sub": "versioned"
          }
        ]
      },
      {
        "title": "Build",
        "nodes": [
          {
            "id": "p-ci",
            "label": "Build & test",
            "kind": "app",
            "sub": "GitHub Actions"
          },
          {
            "id": "p-img",
            "label": "Signed image",
            "kind": "store",
            "sub": "ACR, attested"
          }
        ]
      },
      {
        "title": "Gates",
        "nodes": [
          {
            "id": "p-replay",
            "label": "Convergence replay",
            "kind": "decision",
            "sub": "randomised orders"
          },
          {
            "id": "p-fuzz",
            "label": "Op fuzzing",
            "kind": "decision"
          },
          {
            "id": "p-perf",
            "label": "Ack latency budget",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Canary",
        "nodes": [
          {
            "id": "p-can",
            "label": "1% of new sessions",
            "kind": "app"
          },
          {
            "id": "p-watch",
            "label": "Divergence watch",
            "kind": "platform",
            "sub": "checksum mismatch"
          }
        ]
      },
      {
        "title": "Rollout",
        "nodes": [
          {
            "id": "p-pin",
            "label": "Version-pinned sessions",
            "kind": "app",
            "sub": "no mid-life swap"
          },
          {
            "id": "p-drain",
            "label": "Drain on release",
            "kind": "app",
            "sub": "idle documents first"
          }
        ]
      },
      {
        "title": "Rollback",
        "nodes": [
          {
            "id": "p-prev",
            "label": "Previous version",
            "kind": "app",
            "sub": "re-host on reopen"
          },
          {
            "id": "p-stop",
            "label": "Stop the line",
            "kind": "risk",
            "sub": "divergence > 0"
          }
        ]
      }
    ],
    "note": "A live session never changes code version: a rollout waits for documents to be released and re-hosts them on the new build.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "21-security-trust-zones",
    "title": "Security — Trust Zones and What Crosses Them",
    "layout": "zones",
    "zones": [
      {
        "title": "Internet",
        "kind": "trust",
        "nodes": [
          {
            "id": "z-ed",
            "label": "Editor client",
            "kind": "external"
          },
          {
            "id": "z-link",
            "label": "Viewer by link",
            "kind": "external",
            "sub": "no account"
          },
          {
            "id": "z-plug",
            "label": "Plugin host",
            "kind": "external"
          }
        ]
      },
      {
        "title": "Edge",
        "kind": "trust",
        "nodes": [
          {
            "id": "z-afd",
            "label": "Front Door + WAF",
            "kind": "integration"
          },
          {
            "id": "z-adm",
            "label": "Admission",
            "kind": "app",
            "sub": "token + capability"
          },
          {
            "id": "z-rate",
            "label": "Quota & rate limits",
            "kind": "integration"
          }
        ]
      },
      {
        "title": "Application — private",
        "kind": "trust",
        "nodes": [
          {
            "id": "z-host",
            "label": "Session hosts",
            "kind": "app"
          },
          {
            "id": "z-ctl",
            "label": "Control plane",
            "kind": "app",
            "sub": "grants, history"
          },
          {
            "id": "z-asset",
            "label": "Asset service",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Data — private endpoints",
        "kind": "trust",
        "nodes": [
          {
            "id": "z-log",
            "label": "Operation log",
            "kind": "store",
            "sub": "tenant keys"
          },
          {
            "id": "z-meta",
            "label": "Metadata",
            "kind": "store"
          },
          {
            "id": "z-blob",
            "label": "Checkpoints & assets",
            "kind": "store",
            "sub": "CMK on enterprise"
          }
        ]
      },
      {
        "title": "Keys and evidence",
        "kind": "trust",
        "nodes": [
          {
            "id": "z-kv",
            "label": "Key Vault HSM",
            "kind": "security"
          },
          {
            "id": "z-audit",
            "label": "Audit log",
            "kind": "store",
            "sub": "immutable, 7 years"
          },
          {
            "id": "z-bg",
            "label": "Break-glass",
            "kind": "risk",
            "sub": "approved, logged"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "z-ed",
        "to": "z-adm",
        "label": "WSS + token"
      },
      {
        "from": "z-adm",
        "to": "z-host",
        "label": "bound capability"
      },
      {
        "from": "z-host",
        "to": "z-log",
        "label": "private, fenced"
      },
      {
        "from": "z-bg",
        "to": "z-audit",
        "label": "every access",
        "kind": "async"
      }
    ],
    "note": "Operators have no routine content path: break-glass is a separate identity, approved per use, and its own access is a record in the audit log.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "22-admission-and-authorisation",
    "title": "Identity — Admission, Capability and Revocation Mid-Session",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "x-user",
        "label": "Stakeholder",
        "kind": "actor"
      },
      {
        "id": "x-cli",
        "label": "Client",
        "kind": "external"
      },
      {
        "id": "x-entra",
        "label": "Entra ID",
        "kind": "external"
      },
      {
        "id": "x-adm",
        "label": "Admission",
        "kind": "app"
      },
      {
        "id": "x-share",
        "label": "Sharing service",
        "kind": "app"
      },
      {
        "id": "x-host",
        "label": "Session host",
        "kind": "app"
      }
    ],
    "messages": [
      {
        "from": "x-user",
        "to": "x-cli",
        "label": "opens a shared link",
        "kind": "call"
      },
      {
        "from": "x-cli",
        "to": "x-entra",
        "label": "sign in, OIDC",
        "kind": "call"
      },
      {
        "from": "x-entra",
        "to": "x-cli",
        "label": "token, 60 min",
        "kind": "return"
      },
      {
        "from": "x-cli",
        "to": "x-adm",
        "label": "connect: document, token",
        "kind": "call"
      },
      {
        "from": "x-adm",
        "to": "x-adm",
        "label": "verify token and tenant",
        "kind": "self"
      },
      {
        "from": "x-adm",
        "to": "x-share",
        "label": "resolve role",
        "kind": "call"
      },
      {
        "from": "x-share",
        "to": "x-adm",
        "label": "commenter, link scope",
        "kind": "return"
      },
      {
        "from": "x-adm",
        "to": "x-host",
        "label": "bind capability",
        "kind": "call"
      },
      {
        "from": "x-host",
        "to": "x-cli",
        "label": "connected: comment only",
        "kind": "return"
      },
      {
        "from": "x-share",
        "to": "x-host",
        "label": "grant revoked",
        "kind": "async"
      },
      {
        "from": "x-host",
        "to": "x-cli",
        "label": "detached in under 10 s",
        "kind": "error"
      }
    ],
    "note": "The capability is bound once at admission and re-evaluated on every grant change — messages 10 and 11 are the path that makes revocation a platform guarantee rather than a page reload.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  },
  {
    "id": "23-failure-classes",
    "title": "Failure Classes — Detect, Contain, Recover, and What the User Sees",
    "layout": "grid",
    "columns": [
      "Detect",
      "Contain",
      "Recover",
      "The user sees"
    ],
    "rows": [
      {
        "title": "Client drop",
        "cells": [
          [
            {
              "label": "Heartbeat miss"
            }
          ],
          [
            {
              "label": "Local op buffer"
            }
          ],
          [
            {
              "label": "Replay from seq"
            }
          ],
          [
            {
              "label": "\"Reconnecting\""
            }
          ]
        ]
      },
      {
        "title": "Session host loss",
        "cells": [
          [
            {
              "label": "Lease not renewed"
            }
          ],
          [
            {
              "label": "Only its documents"
            }
          ],
          [
            {
              "label": "Re-host, epoch + 1"
            }
          ],
          [
            {
              "label": "A 10 s pause"
            }
          ]
        ]
      },
      {
        "title": "Split authority",
        "cells": [
          [
            {
              "label": "Stale epoch write"
            }
          ],
          [
            {
              "label": "Rejected at the log"
            }
          ],
          [
            {
              "label": "Zombie self-detaches"
            }
          ],
          [
            {
              "label": "Nothing"
            }
          ]
        ]
      },
      {
        "title": "Log unavailable",
        "cells": [
          [
            {
              "label": "Append errors"
            }
          ],
          [
            {
              "label": "Fail closed on save"
            }
          ],
          [
            {
              "label": "Resume on recovery"
            }
          ],
          [
            {
              "label": "\"Read-only\"",
              "kind": "risk"
            }
          ]
        ]
      },
      {
        "title": "Control plane down",
        "cells": [
          [
            {
              "label": "Grant lookup fails"
            }
          ],
          [
            {
              "label": "5 min cached grace"
            }
          ],
          [
            {
              "label": "New joins fail closed"
            }
          ],
          [
            {
              "label": "Cannot open new files"
            }
          ]
        ]
      },
      {
        "title": "Poison operation",
        "cells": [
          [
            {
              "label": "Apply crash loop"
            }
          ],
          [
            {
              "label": "Quarantine op + author"
            }
          ],
          [
            {
              "label": "Fix forward, replay"
            }
          ],
          [
            {
              "label": "One edit refused"
            }
          ]
        ]
      },
      {
        "title": "Fan-out degraded",
        "cells": [
          [
            {
              "label": "Publish lag"
            }
          ],
          [
            {
              "label": "Shed presence first"
            }
          ],
          [
            {
              "label": "Capacity added"
            }
          ],
          [
            {
              "label": "Cursors freeze"
            }
          ]
        ]
      },
      {
        "title": "Region loss",
        "cells": [
          [
            {
              "label": "Health probes"
            }
          ],
          [
            {
              "label": "Documents re-home"
            }
          ],
          [
            {
              "label": "RTO 15 min"
            }
          ],
          [
            {
              "label": "Up to 5 s lost",
              "kind": "risk"
            }
          ]
        ]
      },
      {
        "title": "Silent divergence",
        "cells": [
          [
            {
              "label": "Checksum mismatch"
            }
          ],
          [
            {
              "label": "Pin client version"
            }
          ],
          [
            {
              "label": "Re-snapshot client"
            }
          ],
          [
            {
              "label": "A brief reload"
            }
          ]
        ]
      }
    ],
    "note": "Only two rows are visible as a degradation the user must be told about in words: read-only when the log cannot be written, and the loss window after a regional failover.",
    "meta": {
      "v": "1.0",
      "owner": "Platform Architecture",
      "date": "2026-10"
    }
  }
]