Consistency
Status: 🟡 In progress — ADR-0003 is Proposed and spike-gated. This page describes the hypothesis, not a decided architecture. Do not treat it as decided fact.
What is at stake
The consistency model is the decision the entire kernel rests on. It determines where authoritative current state lives, how read-your-write is guaranteed, and what “rebuildable from the log” actually means in steady-state operation. Three claims from the source pack cannot all be true under a naive design: the Serving Store is a rebuildable projection (implies async derivation), read-your-write is < 1s (implies synchronous current state), and projection lag is normally < 5s (implies async projection).
Pure event-sourcing of an operational transactional store is the classic failure mode here. Palantir’s Object Storage v2 is not pure event-sourcing — it is a transactional current-state store with a separate history/lineage path. That observation shapes the hypothesis.
The hypothesis (not decided)
An Action commits the event/statement log and the authoritative current-state row in one Postgres transaction. Read-your-write is served immediately off current state. Only secondary indexes — search, topology materializations, spatial, scenario overlays — are asynchronous projections with measurable lag. “Rebuildable from the log” is a recovery and audit property, not the steady-state read path.
The Serving Store is the read surface maintained by the Projection Engine. Under this hypothesis, simple reads are fast current-state lookups; secondary indexes have projection lag bounded by the async projection pipeline.
Falsification bar: if synchronous event-log + current-state dual-write cannot hold p95 < 250 ms at 1M entities and 1K actions/min, fall back to CQRS with an explicit session-pinned read-your-write path.
The spike must also answer: for statement-backed Attributes (ADR-0004), does authority/conflict resolution run inside the write transaction or in the async projection, and what is the read-your-write guarantee for those attributes specifically?
See also
- Concepts — Source of Truth / Consistency
- Data Model — statement-backed attributes interact with consistency
- Topology — precomputed topology projections interact with projection lag
- Offline — expected-version optimistic concurrency depends on current state
- ADR-0003 — hypothesis and falsification bar in full
Open questions
- Everything on this page. ADR-0003 is the architecture freeze gate. Until the spike (POC 4 / POC 5) runs and its result is recorded, no downstream work should hard-code assumptions about the write path without flagging them.
- Statement-backed attribute conflict resolution timing (in-transaction vs. async) is an explicit open question in ADR-0003.