Membership & Failure Detection

Separate version freshness, suspicion scores and state transitions. A delayed heartbeat is not proof of process death.

Deduplicate by freshness

Local b has (2,8) then (2,3); remote has (2,9). Keep local (2,8) and request b.

Local (5,1) beats remote (4,200): incarnation dominates heartbeat.

Derive phi from actual adjacent gaps

History [100,200,200,150,350] keeps gaps 100 and 200. Mean=150, samples=2, accepted endpoint=350. At now650, phi≈0.869.

Do not sort. Compare integers before subtraction and accumulate without int64 overflow.

Course machine: reporter identity matters

Quorums 2/2: a-suspect, a-suspect, b-suspect → suspect. a-confirm, a-confirm, c-confirm → dead.

Suspect and confirm use separate dedupe sets. This is SWIM-inspired; it omits original SWIM probing and suspicion timers.

Incarnation and reset boundaries

Alive at the same incarnation resets non-dead state and histories. Dead requires a higher incarnation to revive.

After reset, a reporter can count again. Reporter history is local to one call.

Transfer

Predict: a-suspect/5, alive/5, a-suspect/5, b-suspect/5, c-confirm/4. Then explain how a long pause causes suspicion without a crash, and why membership cannot silently redefine a consensus quorum.