One owner, explicit durable boundaries.

A single Go process owns the configured SQLite or PostgreSQL database contract, event journal, job leases and embedded dashboard. External clients see stable protocol contracts rather than internal packages.

Request path

1. Authentication resolves an administrator, application user or scoped service identity.
2. Authorization checks the operation, bearer scopes and collection rule.
3. Input is bounded and parsed into typed values or a typed filter AST.
4. The provider transaction changes records and writes required event, audit and outbox facts.
5. Only committed state becomes visible to SSE subscribers and job workers.

The transaction invariant

BEGIN
  write record mutation
  append durable event
  append audit fact
  enqueue webhook / Lambda jobs
COMMIT

If any required write fails, the transaction rolls back. A worker never observes an outbox job for a record change that did not commit.

Database providers

SQLite embeds storage beneath the owner-only data directory. PostgreSQL uses an external server with explicit URL, TLS and pool configuration. Provider adapters deliberately use different SQL and locking primitives while preserving one observable HTTP contract. The provider suite runs against PostgreSQL 16, 17 and 18 in both normal and race-enabled CI.

Storage boundaries

The configured database owns schema metadata, record tables, identities, sessions, events, jobs, audit facts and file metadata. File bytes use generated keys beneath the local data directory or a private S3-compatible bucket. Client filenames never select storage paths.

Concurrency and recovery

Optimistic record versions reject stale mutations. Jobs use provider-appropriate atomic claims, finite leases and expired-lease recovery. SSE consumers resume from sequence IDs. Backups use a native SQLite snapshot where applicable plus a portable logical archive for both providers.

Authority boundaries

Scaling boundary

The current consistency model assumes one Trestle process owns writes, jobs and event ordering. Run clients and downstream workers horizontally if needed, but do not point multiple Trestle processes at the same SQLite or PostgreSQL database.