Design format 4 — two-tier writes + cross-process group commit

[pango07]

What

The full design for the committed track's big rung — format 4: intent queues + lease-elected cross-process group commit — written into LARVA-DESIGN.md §6 (new subsection "Two-tier writes and cross-process group commit") plus the §5 layout tree and a §14 status update. Design only; no code changes.

The design in five sentences

1. A write can be acknowledged at durability instead of at ordering iff its outcome is fully client-determined: pure INSERT, auto-generated pk (t.uuid() / leased t.sequence()), no other uniqueness constraints.
2. Those writes (tier A) become one create-only PUT to a per-writer queue/ prefix — durable at ack, zero contention, folded into the log later by a lease-elected compactor whose folds are idempotent by construction (client-generated pks + skip-on-existing-pk), with own-writes overlaid so read-your-writes holds.
3. Everything else (tier B) queues as ordered intents that a lease-elected leader batches into single log slots — the existing in-process group-commit planning loop promoted across process boundaries — with per-intent verdicts embedded in the entry, read back via the log-tail reads writers already do.
4. The lease is a performance mechanism, never a correctness one: the create-only log slot stays the sole arbiter, so split leadership / zombie leaders / clock skew waste work but cannot corrupt — every failure mode reduces to races format 3 already handles.
5. The fast path is preserved (lone uncontended writers take slots directly, as today), and the physics is stated: constraint-bearing sync commits still floor at one PUT round-trip — format 4 moves work off the ordered path rather than cheating it.

Decision points to bless (or veto) before implementation

• Auto-classification, default on for format-4 stores — no new API surface; upgrading is the opt-in. Alternative: a larva({ fastAppends: false }) escape hatch if you want belt-and-suspenders.
• Tier-A visibility semantics: durable at ack, globally visible at fold (target sub-second); committedAt/time-travel granularity for those rows is the fold commit. Documented honestly rather than hidden.
• Envelope claims: ~100–250 ordered tx/s at realistic batching, unlimited parallel tier-A appends — these will be measured on the fake-S3 bench before any doc states them as shipped numbers.

Next

On merge, implementation starts as its own PR: core (queue/lease/fold/verdict machinery + classification), then the test gauntlet extension (leader kill, lease steal, crash-mid-fold, mixed-tier property harness), then docs/bench.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
larva-db	Ready	Preview, Comment	Jul 10, 2026 8:16pm