No-Code SaaS Automation Platform · View 10 of 21 · Data
The finding
- Trigger cursor and subscription state is small, hot, unglamorous, and the only store in this architecture whose loss is unrecoverable. Lose the ledger and you rebuild from it; lose a cursor and you have silently chosen between duplicate effects and a permanent gap.
- It is therefore drawn as a bordered zone, not grouped with the other operational state, and Section 13 keeps it as the only per-connection state in an otherwise stateless ingest tier.
Assumptions
- RPO 0 for the trigger event log, the step ledger, definitions, connections and audit. RPO 60 s for quota counters and projections — a lost counter overshoots a quota, which costs a 429, not a wrong answer.
- Audit retained 7 years independently of the workspace's own retention setting, so a workspace cannot shorten its own accountability record.
Trade-off
- Making cursors as durable as the event log would remove the risk and roughly double the cost of the hottest small store in the platform. Unresolved, and it is the second half of Core Architecture Question 1.
