Storage that refuses to become a coordinator

The vector store under my research pipeline receives tensors from the extraction engines and the embedders and hands back an address. For a while it also tracked which consumers had accepted which payloads, de-duplicated by content, and answered questions about consumer schemas, because each of those was convenient for someone. I took them out and wrote the boundary down.

Every one of them made the store a coordinator, and a coordinator is a single point of contention and a second source of truth.

What an append is

A producer sends an envelope. The store parses the envelope, recomputes the content hash over the tensor bytes, and checks the envelope's characteristics against the current generation; any mismatch is a hard reject. It writes a journal entry first, then the payload and the identifier, then a lineage row in the database, and the call returns a reference. Generations roll automatically on payload count, byte size or age, with the reason logged.

In · the envelope, as bytes

magicverdtypeshapespec hashenginetensor bytes

Written, in order

1

2

payloadid

3

lineage row in the database

Row 1 is the journal: fixed-size entries under a magic header, the newest in orange. Out · the reference

genshardrowoffsetcontent hashURIsize

What it refuses to be

The store does not de-duplicate, and the lineage hash over work item, specification and content is metadata, never a key. Those rules are enforced by checks in the build that fail if the forbidden patterns appear in the source, so the boundary survives the next person's convenience.

Two appends, the same bytes

One shard · two rows lit

two references, no content key

Durability and admission

Before the listener binds, every shard that was being written when the daemon died is walked and its journal replayed. A per-shard lock serialises appends to one shard while other shards proceed.

A shard after a crash · before the listener binds

Journal

Payload

Identifier

Up to the last consistent entry, kept

Torn tail, truncated and counted in a metric

Admission · one shard's queue

Past the high-water mark (the dark line) the store answers busy with a retry hint, and the client sleeps for it.

The client breaker moves from closed to open, then probes half-open.

What this demonstrates

Knowing what a component is for and defending it: a store that does one thing durably, returns an address, and keeps coordination where coordination belongs, with the rules enforced mechanically rather than by review.

The boundary and the decision to remove the coordinator state were mine; AI coding agents, a mix of frontier and open-source models, implemented the store under my governance system.