The queue stores the question

How the Citizen Profile Service keeps CRM and the Semarchy golden boundary in sync — durable work items, late mapping, and one referee. Step through with ← →, play with space.

Walkthrough

Conflict rules, always on

Compare causes, not clocks. A change made without seeing the current value is concurrent — and concurrent means a conflict case, not an overwrite.
Concurrent edits to the same field: keep both, ask a human.
Absence is never deletion. Only an explicit removal of a value the source actually saw.
Applying the same update twice must change nothing. This is why retries and echoes are safe.

Reading the diagram

Settled — contracted or Profile-owned

Depends on a contract that does not exist yet

Conflict or failure

Acknowledged by the target

Sync Work Items carry no personal data. Payloads exist only on the adapter → target arrow, built at send time.

Proposed glossary terms

Internal Sync Dispatcher — reads committed private events inside the Profile boundary and emits target-aware work items.

Sync Work Item — a durable pointer row keyed on citizen, resource and target, carrying a minimum Profile version and no personal data.

Outbound Sync View — the shared, target-neutral read model of the current syncable value per field; the same selection logic the public fetch API exposes.

Sync Adapter — the per-target executor that maps at send time and owns the per-target ledger. Sync Application narrows to this.

—

0 / 0