Straggler Fence: Watermark, Fail-Closed Reads, Tombstoned Restore

Straggler Fence: Watermark, Fail-Closed Reads, Tombstoned Restore A sequence diagram generated by Archify. append delete-user-X tombstone offset is the evidence destroy per-user key destruction receipt, instant effect publish deletion watermark consumer offline — watermark held return: request to serve still behind the watermark catch up past watermark first no serving until caught up read with destroyed key fail closed: key gone reads fail, data does not leak replay backup through tombstones only live state returns live state, no resurrection restore verified clean Erase + watermark Straggler fence Tombstoned restore Erasure · keys + watermark · Sequence participant Erasure keys + watermark Event Log · tombstones · Sequence participant Event Log tombstones Key Store · per-user keys · Sequence participant Key Store per-user keys Consumer · offline, catching up · Sequence participant Consumer offline, catching up Restore · via tombstones · Sequence participant Restore via tombstones Legend main request return security async trace