Storage and recovery machinery
In plain language: Cursors does not need one database to do everything. SQLite keeps a body's or mailbox's operational truth. Immutable encrypted blocks replicate through swarms and ordinary stores. DuckDB analyzes derived snapshots. rclone moves verified material between providers. Fountain symbols help recover from missing pieces.
Keeping those roles explicit makes the system easier to port, inspect, and resurrect.
SQLite: operational object memory
The first Cloudflare service gives each admitted mailbox its own SQLite-backed Durable Object. It holds admission state, request nonces, quotas, settings, encrypted envelopes, short-lived signals, expiry indexes, and minimal system events.
Local and native bodies should use the same pattern without requiring Cloudflare: one transactional journal per authority boundary, WAL/checkpoint discipline, explicit schema versions, and export into signed immutable checkpoints. SQLite is a backing store for a live body; it is not the global truth of a world.
Immutable object and swarm store
Cursor records, capability records, receipts, signed release heads, encrypted checkpoints, and content blocks use stable content IDs. They can be copied by BitTorrent, WebTorrent, HTTP webseeds, object storage, removable media, or friends. A carrier may disappear without changing the object's identity.
The swarm may be public and hostile. Hashes detect altered pieces; authenticated encryption protects invited content; record signatures and capability validation decide what can enter accepted history.
DuckDB: derived analytical lenses
DuckDB is useful for local, columnar inspection of exported cursor graphs, receipts, availability samples, and mailbox traffic. Its tables are rebuildable read models, not authority. A cockpit can query them for timelines, causal slices, quota trends, or recovery simulations without forcing analytical indexes into every live mailbox.
rclone: carrier adapter
rclone's provider adapters are valuable for mirroring encrypted blocks and signed manifests to user-owned stores. The Cursors boundary should invoke rclone with narrow source/destination grants, verify content IDs after transfer, and record receipts. An rclone remote name, cloud account, or path is a hint—not identity.
Fountain recovery
Systematic fountain symbols can scatter encrypted objects across intermittent peers and stores. Recovery needs enough independent symbols rather than every original piece. The signed manifest pins coding parameters, source object hashes, and symbol IDs so malicious or stale symbols are rejected.
Future VFS and WASM edges
A browser/native VFS can present immutable objects, mailbox journals, checkpoints, and derived tables through one inspectable namespace while retaining their distinct semantics. WASM may later make parsers and recovery codecs portable; it is not required to define the records today.
Rebuild rule
If a body is lost, recover accepted signed roots and encrypted immutable material first, then rebuild SQLite and DuckDB views. Never treat an unverified database backup as more authoritative than the signed object history it indexes.
See Resurrection capsules, Mailboxes, and Cryptofabrics.
The executable durable-write coordinator is documented under Proving that a write is durable. It requires content-hash read-back and independent failure domains before reporting success.