Postgres WAL on the floor.

The platform segments its CAP trade per surface, and durability follows the split. The available-first tier — the near-cache and the EchoMQ stream log — rides the floor this chapter built: its pages and its trimmed stream slices become Graft commits replicated to Tigris, and the commit LSN binds replica, consumer, and store on one cursor (Module 13). The consistency-first ledger is a different surface: balances and an append-only transaction ledger in Postgres, mutated all-or-nothing, where a committed payout must never be lost. Its durable record is its own write-ahead log, with its own LSN — a different log over different bytes. Graft replicating its commit LSN to Tigris does not archive Postgres's WAL; the two are disjoint, and the money's off-site recovery is, today, unsolved on the floor.

That is the gap this module closes in design. Postgres point-in-time recovery and a streaming replica are the ledger's launch prerequisites (codemojex.postgres.md, “the work before real money”), and the question is whether to answer them with a parallel, off-platform backup tool or to bring the WAL onto the engine, the fence, the bucket, and the cursor the rest of the floor already shares. The design surfaces that as a four-arm fork and rules it; the dives walk the idea, the mechanism, and the decision.