Geo quorum planning

Question: can a failure make an unsafe quorum configuration safe?

Keep membership, availability, and response thresholds separate.

Two counts, two jobs

A health observation does not reconfigure membership.

Derive the strict inequality

Disjoint sets of sizes R and W require R+W distinct members.

If R+W>N, disjoint read/write sets are impossible.

For two write sets, require 2W>N.

At equality, disjoint sets still fit.

Predict a partition

Five configured replicas: west has 3, east has 2.

Connection fails. Each side sees only itself as healthy.

With R=W=2, both can obtain responses.

Should either report intersection safety?

Availability cannot shrink the universe

Using local healthy N would incorrectly approve both disjoint sides.

With R=W=3, only west can form the required routes.

Route by parallel response latency

North: 2 replicas at 12. South: 2 at 35. West: 1, offline.

For three responses: north → still need 1 → south.

Route [north,south], modeled latency 35, configured N=5.

Any threshold below 35 has only two available replicas, so cannot finish sooner.

Deterministic execution order

1. Count configured membership.
2. Copy healthy positive-capacity regions.
3. Sort by latency, then name.
4. Build read and write prefixes separately.
5. Report capacity failures before intersection status.

Do not sort or modify the caller's input slice.

What does “safe” mean here?

Only the required set-intersection property.

The planner does not order writes, choose versions, elect a leader, or change membership.

Latency is the maximum selected regional latency, not a full transaction timing model.

Reconstruct and test

• N=7, R=W=4: four available can proceed; three cannot.
• N=5, R=2, W=3: read/write sets can be disjoint.
• Repeat tests with the same membership and different health flags.
• All-healthy round trips cannot expose a shrinking-N bug.

Exercise

Geo replication checkpoint