Eliminating Cross-Database Split-Brain by Construction: Pre-Freeze Coordination with Node-Autonomous Recovery

Abstract

Cross-database split-brain is normally treated as a protocol problem: to stop two independently deployed databases from disagreeing about a shared outcome, one adds a consensus group, a quorum rule, or an external arbiter. We take the opposite route and eliminate the failure class instead of defending against it. The business-asset databases in our design never exchange a message with one another, each performs only single-node local transactions with its own local replication, and every cross-database decision is taken by a stateless business-layer coordinator. The coordinator reserves (freezes) each participant's local assets before any real value moves, records the global transaction in a guarded state machine, and compensates along an explicit per-operation phase model, so that a compensation can never be applied in the wrong direction. Recovery is layered: a poller and a dead-letter handler resume transactions when a participant is unreachable, verifying the real asset state before deciding whether to move forward or compensate, and a second layer lets a recovered node inspect its own local freeze markers and settle its own debt autonomously when the coordinator cannot reach it. We implement the design as an executable teaching artifact: three operating-system processes stand in for three databases, JSON files stand in for shards and replicas, and seven scripted fault cases exercise normal ordering, freeze rejection, mid-commit failure, shard partition and recovery, node crash and restart, orphan-freeze reconciliation, and retry exhaustion. All seven cases pass; we report the measured transcript, the per-case wall-clock durations, and the coordinator's protocol traffic. The artifact is not a production system. We state the six gaps that separate it from production, the trade-offs it accepts (eventual rather than serializable consistency, write amplification, a new critical component, and a freeze TTL that must be tuned to the real recovery-time distribution), and the kinds of system for which we believe a simpler mechanism should be preferred.

Body

Imported entry paper (unverified hypothesis)

This paper was imported into jetessays as an entry paper from the author's local archive (dtxn-freeze). It is not an established result: under jetessays policy every item is an UNVERIFIED HYPOTHESIS unless explicitly verified. The original source files (LaTeX, figures, scripts, measurements) live in the author's local archive and are not hosted here.

Abstract (as submitted)

Cross-database split-brain is normally treated as a protocol problem: to stop two independently deployed databases from disagreeing about a shared outcome, one adds a consensus group, a quorum rule, or an external arbiter. We take the opposite route and eliminate the failure class instead of defending against it. The business-asset databases in our design never exchange a message with one another, each performs only single-node local transactions with its own local replication, and every cross-database decision is taken by a stateless business-layer coordinator. The coordinator reserves (freezes) each participant's local assets before any real value moves, records the global transaction in a guarded state machine, and compensates along an explicit per-operation phase model, so that a compensation can never be applied in the wrong direction. Recovery is layered: a poller and a dead-letter handler resume transactions when a participant is unreachable, verifying the real asset state before deciding whether to move forward or compensate, and a second layer lets a recovered node inspect its own local freeze markers and settle its own debt autonomously when the coordinator cannot reach it. We implement the design as an executable teaching artifact: three operating-system processes stand in for three databases, JSON files stand in for shards and replicas, and seven scripted fault cases exercise normal ordering, freeze rejection, mid-commit failure, shard partition and recovery, node crash and restart, orphan-freeze reconciliation, and retry exhaustion. All seven cases pass; we report the measured transcript, the per-case wall-clock durations, and the coordinator's protocol traffic. The artifact is not a production system. We state the six gaps that separate it from production, the trade-offs it accepts (eventual rather than serializable consistency, write amplification, a new critical component, and a freeze TTL that must be tuned to the real recovery-time distribution), and the kinds of system for which we believe a simpler mechanism should be preferred.

Note

Imported via the jetessays seed importer. The author chose not to keep an explicit upload record on this site; the work is listed as an entry paper so it can be discovered, discussed, endorsed and relayed.

Discussion

Log in to join the discussion

← back to browse