Consistency, Repair, And Failure Boundaries

DSM exposes several coordination models under one runtime, but they do not have the same correctness contract. This page gives the concept-level map before you read protocol details.

The Three Questions

Question	DSM model
What is the latest value for this key?	Register collection
Who is the active owner for this key?	Lease collection
How do multiple local updates converge?	CRDT collection

Correctness starts with choosing the right question. Repair can close replication gaps, but it cannot turn the wrong model into the right one.

Register Boundary

Registers converge by lineage ordering and conflict resolution. They are a good fit for route hints and metadata where the newest or resolved value is enough.

Failure boundary:

• a remote upsert with an incompatible RecordCodec fingerprint is ignored locally
• a non-commutative custom resolver can diverge peers
• a merged entity without valid lineage metadata is rejected

Use ConflictResolver.verified(...) in tests or staging when introducing custom resolvers.

Lease Boundary

Leases represent active ownership with term, renewal, transfer, release, verification, and fencing tokens.

Failure boundary:

• AUTONOMOUS mode favors local availability and can operate during membership uncertainty
• QUORUM mode rejects acquire, renew, and transfer while membership is unstable or majority visibility is unavailable
• downstream side effects must honor fencing; otherwise stale workers can still act outside DSM

QUORUM protects a narrower class of ownership workflows. It does not make every DSM collection strongly consistent.

CRDT Boundary

CRDT collections allow local updates that converge through merge semantics. They fit counters and mergeable state where concurrent writes are expected.

Failure boundary:

• CRDT state and update codecs must stay compatible across nodes
• convergence depends on commutative/idempotent merge behavior
• CRDTs do not provide single-owner semantics

Repair Boundary

Repair is the mechanism that closes missed traffic:

Repair is not historical replay for every event. It repairs visible collection state.

Operational Signals

Signal	Meaning
recordAntiEntropySweepOutcome	Whether background repair is succeeding, failing, or skipping work.
recordSchemaFingerprintMismatch	Register peers are running incompatible record schemas.
recordLeaseVerify / recordFencingReject	Lease correctness boundary is being exercised.
recordBackpressureDecision	Sync traffic is being throttled, delayed, or rejected.

Related Pages

• Collection Types
• Repair And Anti-Entropy
• Error Codes