direction: right

tenant: "Tenant workflow" {
  wrangler: "Wrangler\ncode + bindings + migration tag"
  console: "Worker detail\nplacement + namespaces + events"
}

control: "control-01" {
  api: "Control plane\nimmutable versions + stable assignment"
  quota: "Quota service\nnamespace reservation"
  ingress: "HAProxy → shared compute pool"
}

compute: "compute-01 / compute-02" {
  dispatcher: "Trusted dispatcher\nactive route lookup + invocation metering"
}

data: "Native Durable Objects pool" {
  shard0: "data-02-0\nshared workerd process" {
    apps0: "many stateful applications"
    sqlite0: "native namespaces\nSQLite + alarms"
    cron0: "organization Cron coordinators\nleases + retries + alarms"
  }
  shard1: "data-02-1\nshared workerd process" {
    apps1: "many stateful applications"
    sqlite1: "native namespaces\nSQLite + alarms"
    cron1: "organization Cron coordinators\nleases + retries + alarms"
  }
  future: "additional data-node members\nnew placement capacity"
  journal: "encrypted deployment journal\nintent + lifecycle events"
}

observe: "Alloy" {
  metrics: "readiness · namespaces\nobjects · storage bytes"
  evidence: "systemd journal + OTLP traces"
}

tenant.wrangler -> control.api: "1  upload + optimistic migration"
control.api -> control.quota: "2  reserve namespace growth"
control.api -> data.shard0: "3  stage on stable assigned member"
control.api -> data.shard1: "or assigned member"
control.api -> control.ingress: "4  publish active version route"
control.ingress -> compute.dispatcher: "tenant hostname"
compute.dispatcher -> data.shard0: "authenticated private forwarding"
compute.dispatcher -> data.shard1: "authenticated private forwarding"
data.shard0.cron0 -> compute.dispatcher: "scheduled invocation"
data.shard1.cron1 -> compute.dispatcher: "scheduled invocation"
data.shard0 -> observe
data.shard1 -> observe
tenant.console -> control.api: "scoped read API"

boundary: "Placement and durability boundary" {
  text: "Applications and organization Cron coordinators keep stable member assignments.\nAdding members does not remap or replicate existing SQLite state.\nCurrent cutover is stop-before-start and may briefly interrupt every app on that member."
}