How Saara syncs across every device with no server in the middle — and why the math guarantees it agrees.
The ledger is a bag of facts you can only ever add to. Syncing is pouring two bags together and keeping one of each. Pour in any order, as many times as you like — you always end up with the same bag. No server decides who wins. Convergence is math, not coordination.
CRDT — Conflict-free Replicated Data Type. A data structure built so independent copies on different devices can be edited offline and then merged automatically, with no coordinator, always landing on the same result. No locks, no central authority picking a winner, no manual merge conflict.
A set you can only add to, never remove. Merging two replicas is just their union — every element either side has seen. Union works flawlessly because of three algebraic properties:
Any set of devices, merging in any order, any number of times → the same final set. That is the whole reason no server is needed.
Each device holds some events. They overlap on e2. Merge them in whichever order you like — both bags end up identical, and merging again does nothing.
Every TaskTransition has a unique id. Merge = insert the entries you don't already hold. It can never conflict and never loses an event. Your reliability score is a fold over this ledger — so every device that merged the same events computes the same numbers.
The current row values (title, area, due date) use last-writer-wins by updatedAt. Also a CRDT — always agrees — but lossy: two devices editing the same field concurrently keep only the newer edit.
// ledger, append-only — the whole reason merging can't conflict
if (!await _exists(db.taskTransitions, e.id)) {
await db.into(db.taskTransitions).insert(e);
}Net effect: history + score are never lost (G-Set); field values always agree but a simultaneous same-field edit can drop the loser (LWW). Not a bug — two CRDT semantics doing their different jobs.
The transport (Wi-Fi QR sync) is pairwise — two devices at a time. But each device exports the entire ledger it holds, including events it learned from others. So facts spread across the whole fleet:
You don't need to pair every device with every other — just enough sync paths that events can reach everyone.
Switching devices isn't a "restore" — a new device just merges the ledger and folds the same history into the same state.
Because there's no server, the safety net is only as fresh as your last sync or export. A device lost or wiped before syncing its newest events has no cloud copy to fall back on.
The escape hatch is already built: the encrypted export file is a full ledger snapshot — drop one into a folder or share it to yourself for a portable, restore-anywhere backstop, without reintroducing a server.
Sharing an invite is just emitting a signed ledger event and getting it into another user's ledger. "Blockchain" bundles three things; Saara wants only two:
The real constraint is transport, not trust. An invite-as-signed-blob over any channel (WhatsApp, Signal, email) is truly serverless. Only live device-to-device over the internet hits NAT/firewalls and needs a minimal, blind rendezvous that sees only ciphertext.
The special part: signed events let a person carry a portable, verifiable reliability record — proof they kept their word that no server owns and no one can forge. Self-sovereign reputation — the teeth behind P-Integrity's "others own the mirror."