Recent writes leave the host before compute sleeps.
Sleeping compute is useful only when durability does not wait for sleep. OnDemandDB captures PostgreSQL physical WAL or committed SQLite WAL frames, encrypts and verifies immutable R2 objects, and measures exactly how far protected storage trails the local engine.
Reads stay available when protection falls behind.
OnDemandDB tracks the local and verified-R2 boundary separately: LSNs for PostgreSQL and frame revisions for SQLite. If acknowledged writes remain unprotected for five minutes, new owner, architect, and writer transactions open read-only inside the selected engine. SQL parsing is not the security boundary.
Protected boundary advancesmutations available
If lag reaches 5 minutesreads continue · mutations blocked
Close the chain
Drain leases, protect the final engine boundary, stop cleanly, publish a complete base, then remove hot state.
Restore natively
The next SQL call restores the latest complete base plus its contiguous verified WAL chain.
Prove recovery
Isolated restore drills verify hashes, generation, engine identity, the replayed LSN or revision, integrity, and boot.