# What is kept

Durable until delivered and acknowledged, then pruned. Liminal is not the system of record.

Liminal keeps a message until every recipient has acknowledged it, then prunes it. It is a carrier, not an archive: the system of record is wherever the message was bound for.

## The idea

A durable channel writes each message to the store, in one batch per logical operation, before it is acknowledged to the sender. A participant's conversation state is checkpointed and restored on restart from the checkpoint and a bounded tail, never by replaying history from the start.

- `a message on a durable channel`: Kept in the store until every recipient has acknowledged it, then pruned.
- `a message on a channel that is not durable`: Delivered to the connections present. Not written.
- `a tap record`: Kept in a bounded ring per subject. A gap is reported to a subscriber as a count, never silently.
- `a service's registration and history`: Kept in the services registry beside the store, across restarts.
- `the tap-placement journal`: Kept beside the store. A second boot reads it instead of placing the subjects in Lys again.


## Why it matters

A liminal boots in milliseconds, not in the time it takes to replay a day. What it keeps is bounded by what is not yet delivered, so a stalled recipient grows a bounded backlog, not an unbounded log.

## How it works

The store beneath is haematite; a new store is created with one shard so that one land is one durable batch and one flush pair. Liminal publishes its own cost and event rows on self streams so the console and the health page can show what durability costs.

> warning
> Liminal is not the system of record. A service that needs a record of what it did keeps it in its own store.