Reconcile and retain
Last updated
A Weald client holds a full local copy of every group it belongs to, so catching up is reconciliation rather than a download. Missing envelopes are found by range-based set reconciliation, documents converge as CRDTs with periodic snapshots, and history below a checkpoint can be deleted without breaking either.
Reconciliation
Two peers compare ranges of what they hold instead of listing everything. The exchange is bounded, so a client that has been away for a month does not pay in proportion to the month.
Because sequence numbers are assigned by the relay and gaps are legal, reconciliation works over the set that exists rather than over a dense range. A gap is not evidence of loss.
Documents that converge
Board state, tickets and plans are CRDT documents rather than messages, so two people editing at once converge instead of conflicting. A semantic conflict, two people deciding different things, is shown to a human rather than resolved silently.
A document writes a snapshot every 512 changes or 256 KB. That is what makes a cold start affordable: a new device replays a snapshot and the changes after it, not every change since the workspace began.
Cold start
A new device does not wait for the whole history before it is useful. Four phases run concurrently, with published targets.
| Phase | Contents | Target |
|---|---|---|
| Skeleton | Roster, channels, board indexes, open tickets | Under 5 seconds |
| Recent | The last 30 days of every group | Under 60 seconds |
| Backfill | Older history, snapshots first, throttled | Background |
| Media | Fetched on demand | Never part of cold start |
Backfill pauses below 20 percent battery. While it is incomplete the client states the range it has in words rather than showing a percentage, and says nothing at all once the index is complete.
Search
Search is client-side, over one encrypted index per workspace, written in the same transaction that applies an envelope so it cannot drift from the data. The index is sealed at rest with a device-bound key that is never wrapped for anybody else, and it is rebuildable from local state with no network.
There is no server-side search index and there will not be one. A relay cannot index ciphertext, and giving it the ability to would be the trust boundary change this whole design exists to avoid.
Retention and compaction
Compaction drops history below a checkpoint so a workspace stops growing forever. A client holding admin authority drives it, because the relay cannot read what it would be deciding about.
That has a consequence worth knowing up front: a workspace whose admin devices stay offline accumulates uncompacted history, unevicted agent leaves and a stale access set, and nothing on the server side repairs it. A weekly health check in the client covers exactly that, along with attestation liveness and access set freshness.
Specifications
The reconciliation algorithm, the channel model and the retention rules are published in the wire and conformance document sets.