Repository navigation
Open
Labels
app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)effort/lLarge: multi-day or open-ended; expect staged check-insLarge: multi-day or open-ended; expect staged check-inskind/designA design proposal (design-architect): multi-step, phased, decision-bearingA design proposal (design-architect): multi-step, phased, decision-bearingmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels addedpriority/normalOrdinary priority (the default)Ordinary priority (the default)source/creatorFiled by the new-issue-creator jobFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item
Description
From the #2059 investigation (hot-world sharding)
The landed investigation doc for #2059 (doc/2026-10-30T19-35-00Z_investigation_hot_world_sharding/, §3 rung 2, §5) designs region partitioning as sibling shard-worlds under a thin coordinator, with entity handoffs at region seams as a journaled export from region A + import to region B — a two-step handoff, not a distributed transaction. The doc states the semantics honestly (cross-region atomicity does not exist; an entity mid-handoff is visibly in transit) but deliberately does not design the handoff record format. This issue designs it, so the #2046 synthesis adopts a designed seam instead of an aspirational one.
Design to produce
- Export/import record pair: the journal entries each side writes (export from A, import to B), their fields, and the ordering/idempotency rules — including what makes a handoff complete vs stuck.
- Client observation: what a client holding the entity sees at each step of the handoff (before export, in transit, after import), and which reads/writes are legal in each state.
- Failure recovery: import never arrives, import arrives twice, region B is down mid-handoff, coordinator dies between export and import — recovery path for each, with no entity duplication and no silent loss as the invariants.
- Coordinator's role: what the coordinator world journals about a handoff (region map + handoff records per the investigation §5) and what it must never do (no cross-region transaction emulation).
Acceptance criteria
- Design recorded in a doc under
doc/and linked from this issue - Export/import formats specified precisely enough to implement against
pkgs/id/src/world/actor.rs's journaled-entry patterns (cf.CrossWorldWrite) - Each failure case above walked through with the recovery outcome stated
- Anything buildable that falls out is filed as its own issue(s)
Program: ID platform expansion, epic #2056. Parent investigation: #2059. Consumer: #2046 (serverless edition v1 synthesis).
Metadata
Metadata
Assignees
Labels
app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)effort/lLarge: multi-day or open-ended; expect staged check-insLarge: multi-day or open-ended; expect staged check-inskind/designA design proposal (design-architect): multi-step, phased, decision-bearingA design proposal (design-architect): multi-step, phased, decision-bearingmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels addedpriority/normalOrdinary priority (the default)Ordinary priority (the default)source/creatorFiled by the new-issue-creator jobFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item
Activity
dezren39 commentedon Oct 31, 2026
Intake review
Related: parent #2059; sibling #2819.
Notes: design-stage issue spun out of #2059; body already carries an acceptance section, so none was appended. No merged PR or commit found this run that implements this design — verified still live.
Risks: design drift if the sibling design lands first and changes shared assumptions (hot-world sharding seams) — the two designs should be read together before either is implemented.
Suggested approach: keep as design; when picked up, the design output should land as a linked implementation issue per the standing "a design is not finished work" rule.
🤖 Agent note · filed
dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up
pkgs/idjournal patterns, sibling id: design: native-spill write lease protocol for hot worlds (from #2059) #2819), post a decision-ready design record, and route the implementation as phased packets.dezren39 commentedon Nov 1, 2026
🤖 Agent note · triaged — CONFIRMED; design record below; design production routed as one packet (task 5802)
a9e976ac245d94682ff7ada8dd5562cc58c9b00f(gh api contents + code search, 2026-11-01):doc/2026-10-30T19-35-00Z_investigation_hot_world_sharding/). Its §3 rung 2 (doc lines 161–170) settles the model: sibling shard-worlds under a thin coordinator; a boundary crossing is a journaled export from region A + import to region B — a two-step handoff, not a distributed transaction. Its §5 (lines 247–252) bounds the coordinator journal to membership, the region map, and handoffs and requires the seam to stay visible (an entity mid-handoff is in transit, visibly). Its §9 (lines 298–300) files this issue as the handoff-format design. The model is decided; the record format is genuinely undesigned.JournalEntryenum atpkgs/id/src/world/mod.rs:475— typed serde variants with replay semantics documented per variant;CrossWorldWriteatworld/mod.rs:580is the precedent for a policy-adjacent journal record;WorldLimitsatworld/mod.rs:59is the configurability precedent.WorldActor::persistatpkgs/id/src/world/actor.rs:376appends + fsyncs and turns the world read-only on failure;set_cross_world_writeatactor.rs:882shows the journal-before-apply ordering (persist first, then mutate core state) every handoff step must follow.Design record (the record the design doc must produce)
actor.rs's journaled-entry patterns.JournalEntryvariants on both sides (export record in A, import record in B) plus coordinator handoff open/close records; (2) handoff payloads carried inside genericCommittedevents; (3) coordinator-only records, shards journal nothing.world/mod.rs:475convention), lets each shard's journal be the source of truth for its side (required for the coordinator-dies walk), and matches theCrossWorldWriteprecedent. Option 2 buries a state machine inside opaque payloads; option 3 contradicts §5 and makes coordinator loss unrecoverable.handoff_id; the seam stays visible (in-transit is a client-observable state, never papered over); the coordinator journals only membership, region map, and handoffs — no entity state, no cross-region transaction emulation.handoff_idderivation; transfer payload (full snapshot vs snapshot + journal reference) and its bounds; completion (import journaled in B and coordinator closure journaled) vs stuck (policy window after export) with a named recovery owner per state; the client state table (owned-by-A / in-transit / owned-by-B × legal reads/writes); the four failure walks from this issue's body; shared coordinator-journal conventions with sibling id: design: native-spill write lease protocol for hot worlds (from #2059) #2819, read together before writing (the intake review's drift warning).packets/task5744-2818-region-seam-handoff-design.json, enqueued as queue task 5802, dedupe keyrepo-health:v1:fix:developing-today/code:issue:2818, queuerepo-health-code-pilot, status queued.37 remaining items
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
developing-today commentedon Nov 3, 2026
🤖 Agent note · picked up
developing-today commentedon Nov 3, 2026
🤖 Agent note · done (triage verdict: design deliverable ALREADY DONE; issue stays open for consumer adoption)
Evidence (fresh, 2026-11-03):
198ace8af109ce7d53acd5af342fb981b1e752c2).doc/2026-11-01_design_id2818.md(44,787 bytes, blobe26a45cea8) — dedicatedEntityExported/EntityImportedjournal variants plus coordinator open/close records, record fields and ordering/idempotency rules, client transit semantics, failure-recovery walks, and five sequentially mergeable implementation packets. That covers this issue's "Design to produce" list and its doc-under-doc/acceptance item.Routing: none new — #3870 owns the implementation, #2046 owns adoption. No branch, worktree, or competing design created. This coverage triage (task 7986) completes as triaged / already_done for the design deliverable.
(Note: posted via the developing.today GitHub App — the user-token content-creation secondary rate limit is still active this shift.)