Scale storage and resilience with independent policies for serving Hosts and encrypted block copies.
Choose where queries can run separately from where durable bytes live.
| Layer | What it provides | Trust required |
|---|---|---|
| Host replica | Workspace state, branch heads and query execution | Authority to decrypt and serve |
| Custodian copies | Encrypted, content-addressed blocks | Storage service without plaintext access |
A Host can serve a large workspace by retrieving blocks as needed. Each custodian can hold a subset; the whole workspace need not fit on one provider's disk.
Place encrypted blocks across eligible providers. Policies can combine copy counts, region and operator diversity, price limits and service requirements. Prefer lower-cost offers within those constraints while keeping decryption confined to approved Hosts.
Place serving Hosts and frequently accessed blocks near demand to improve response times. Storage capacity, network paths and available offers determine the achievable cost and performance.
Reconciliation compares required placement with observed live replicas and block holders, then repairs deficits. Multiple approved Hosts support query continuity; independent custodian copies protect the underlying data.
Keep sensitive processing on your phone while distributing ciphertext, or authorize additional personal devices for serving redundancy. Each workspace makes that choice independently.
The replication walkthrough connects capacity, regional placement, failover and transaction durability. Backup and restore preserves separate recovery points.
Developer reference
Host replication governs branch scope, serving replicas and timing such as SyncBeforeFinalize, AsyncAfterFinalize or PullOnDemand. Custodian policy governs encrypted blocks through min_block_copies, region constraints and holder liveness.
Signed custody events feed a per-block holder index. Reconciliation recruits holders for specific deficits; demand-fetched blocks can also satisfy the durability floor. Eviction preserves that floor. Requested placement, observed holdings and query readiness remain distinct states.
BlockReplicationMode::Sync waits for the required block-copy evidence before branch-head publication. Async permits publication after its transaction durability barrier and reconciles additional copies afterward. Journal-enabled publication also requires its durable journal witness.
Synchronous policy trades publication latency and availability for a stronger replication condition. Asynchronous deficits stay visible. Replication protects continuity through covered failures; archived recovery points remain useful for erroneous changes or failures beyond that envelope.