Chapter 14 — Convergence Boundaries and Responses Already Returned
Chapter objective: After this chapter, a developer can map local successes during a partition to post-recovery convergence and identify business commitments that eventual state cannot govern.
Learning objectives
- Separate response semantics, current visible state, and eventual converged state.
- Explain autonomous versus quorum coordination during a partition.
- Identify external effects that repair cannot revoke.
- Draw consistency boundaries for route hints, leases, counters, and order facts.
Prerequisites
- Concurrent conflict and Lease behavior from Chapters 6–7 are understood.
- Online delta, repair, and ChangeStream loss are understood.
- "One final value" is separate from "only one success along the way."
Case progress
A network partition separates node-a and
node-b. Both update the route hint and return OK to their
callers. After recovery, the resolver selects one winner. Replicas agree
again, while both callers have already acted on their individual
successes.
Convergence cannot revoke the past
Both T2 responses happened. Delta/repair at T3 can converge the current T4 value, but it cannot make a client forget an OK or automatically compensate email, payment, shipment, or an external write.
Three separate contracts clarify the responsibilities:
| Contract | Question | DSM alone can guarantee |
|---|---|---|
| local operation | when does put/acquire/increment return? |
local collection outcome |
| convergence | how do replicas reach compatible state after recovery? | semantics specific to Register/Lease/CRDT |
| business commitment | can a returned success be retried, revoked, or reconciled? | requires transaction, idempotency, fencing, or compensation |
Collection behavior during a partition
Register: two OK responses and one eventual winner
Both nodes can accept candidates and later select one current value by metadata and resolver. This fits a route hint because the losing candidate can be superseded and an authoritative health source can publish again. It does not make one of two accepted order updates disappear from history.
Lease: explicit availability/exclusivity trade-off
AUTONOMOUS mode can produce holders on both sides and relies on an external fencing token to reject the old owner. QUORUM mode rejects acquire while membership is unstable or a majority is absent, exchanging availability for a stronger issuance constraint. Both modes depend on downstream token validation; an in-memory holder decision cannot restrain a disconnected old process.
CRDT: safe merge does not imply legal business state
Request counts can increase locally and merge after recovery. That property fits metrics. It does not prove that inventory decrements respect a lower bound or preserve an audit trail.
Rejection list
The following state does not become a suitable DSM authority merely because it eventually converges:
- order transitions and irreversible approvals;
- inventory deductions and quota consumption;
- payment, refund, and ledger entries;
- business events requiring complete history;
- cross-resource transactions requiring one definite caller outcome.
DSM can cache or coordinate rebuildable state around these systems. Transactional facts, idempotency protocols, and audit systems retain authority.
Counterexample and fault injection
ChaosIntegrationTest contrasts two Lease choices:
autonomous mode can create dual holders during a partition, while quorum
mode rejects acquire without a majority and resumes only after recovery
and restabilization. The comparison asks the business owner whether
paused work or temporary duplicate execution is less harmful and whether
fencing/idempotency protects the side effect.
Experiment
cd submodule/dsm
mvn -q -pl dsm-integration-test -am \
-Dtest=ChaosIntegrationTest \
-Dsurefire.failIfNoSpecifiedTests=false testReview partition-contract.json. Every state records
localResponse, partitionBehavior,
healedState, and externalGuard. "Eventual
consistency handles it" is not a complete field value.
Experiment acceptance card
| Field | Content |
|---|---|
| Command | The Maven chaos test above;
node --test tests/chapter-assets.test.mjs |
| Input or fault | network partition, operations on both sides, recovery, and anti-entropy |
| Observable result | Register/repair converges; autonomous Lease can have dual holders; quorum Lease fails closed |
| Evidence level | E3: multi-node chaos behavior test |
| This experiment does not prove | Compensated business effects, cross-resource transactions, or suitable production network parameters |
Review
- One eventual winner does not revoke two OK responses returned during a partition.
- Collection semantics govern current coordination state, not the whole business-commitment protocol.
- Lease mode makes the availability/issuance trade-off explicit.
- Orders, inventory, payments, and event history remain in their authoritative systems.
Next
Arc 4 carries these boundaries into application engineering. Chapter 15 introduces domain ports so business code publishes routes, claims shards, and records requests without scattering DSM APIs.