ADR 0010: Hosted recovery does not use a Queues write-ahead log or multi-master sync

ADR 0010: Hosted recovery does not use a Queues write-ahead log or multi-master sync

Status: Accepted Date: 2026-10-23 Scope: Symphony Deciders: Ravindra Boddipalli

Context

Two ways to shrink the data-loss window were considered (Symphony’s docs/DATA_DURABILITY.md, Options considered): a Cloudflare Queues write-ahead log fed by the Worker, and Ignite-style multi-master sync between SQLite and Postgres.

Decision

Neither is used. Replaying requests re-runs server logic that generates ids, timestamps and sequences, and re-triggers side effects (emails, webhooks); Queues are at-least-once with no strict order, limited to 128 KB per message, and a journaled request may never commit. Litestream already ships the SQLite WAL, so a second log duplicates it. Multi-master merge (last writer wins or CRDTs) breaks accounting and stock invariants: invoice and stock-move numbering, reserving the last unit, posting into a closed period, balance fields. Those need one authority per tenant.

Consequences

• Each tenant has a single writer at a time; replication is leader-based.
• Queues remain acceptable for verification only (periodic checkpoints compared with the newest replica).

Verification

Recorded in the decisions log of DATA_DURABILITY.md.