Durability

Last updated 29 October 2026

Read this when you run databases in production: where each region keeps the replicas, how maintenance behaves, and which releases of the package work together. Guarantees states when a commit is durable.

Every region databases are created in keeps a database’s three replicas the same way, one in each of three availability zones of the region: us-east-1, ap-southeast-1.

Replicas

synced() resolves once two of the three replicas hold every commit made before it. A replica that restarts, or comes back after its host or its disk was lost, catches up from the other two before it takes part again (see Ursula in Tonbo), and older commits and snapshots move to object storage in the same region. To take a database elsewhere, or keep a copy to go back to after a mistake of your own, export it (see Backups and salvage).

Maintenance

Tonbo restarts the replicas one at a time for maintenance. Replication pauses for a few seconds while another replica takes over. Commits continue on your host meanwhile, and the package sends them again until Tonbo takes them.

Versions

Use @tonbo/sqlite-ursula 0.11. Its releases within 0.11 work with each other and with the service, which runs Ursula 0.11, the open-source server behind Tonbo, and other minor releases do not. A release within 0.11 opens the databases and local copies another one left, so upgrade a database’s writer by stopping the old process before the new one opens the database.