Joint membership: require both configurations' quorums
Trace the paper's joint-consensus transition and show why a majority of the union is not the required quorum predicate.
On this page
The question for today
What you’ll understand
- Compute separate old and new majority conditions.
- Explain the ordered joint-configuration then new-configuration transition.
- Distinguish voting membership from learner catch-up and from reachability-based replacement.
Adding a replica sounds like a capacity operation, but changing the voter set changes which groups can make decisions. An abrupt switch can let different replicas recognize disjoint majorities and acknowledge incompatible histories. This lesson studies the joint-consensus mechanism described in the Raft paper. Production libraries may implement a different, separately proved single-member transition or expose specific configuration APIs; do not mix their activation rules with this paper-level mechanism or edit membership files as an improvised recovery protocol.
A majority of the union answers the wrong question
Let the old and new configurations each define their own voters and majority thresholds. During a joint configuration, an election or commitment decision requires a qualifying majority in each set, not merely many voters from their union. A replica present in both sets contributes to both separate counts, while its duplicate messages still count only once within each set. The resulting quorum shape makes decisions intersect the histories recognized by both configurations under the complete protocol rules.
Even overlapping membership lists do not imply every old majority intersects every new majority. For example, old voters A,B,C,D,E and new voters C,D,E,F,G have a shared three-node intersection, yet old majority A,B,C and new majority E,F,G are disjoint. Without an ordered transition, both could act independently. The transition protocol, not the names common to the two configuration files, establishes when each quorum predicate may govern decisions.
Record the transition in the agreed history
In the paper's protocol, the leader first appends a joint old-plus-new configuration and uses its joint requirements to commit that configuration. Servers use their latest stored configuration for the decisions specified by that protocol, so transitions need not arrive everywhere simultaneously. Before the joint entry is committed, some servers may still use the old configuration, but the new configuration is not independently authorized. The log and election invariants prevent the two independent histories that an immediate replacement would allow.
After the joint configuration is committed, the leader may append the new-only configuration and commit it under the new configuration's requirements. Only after the transition is safely completed should removed voters be treated as permanently unnecessary to the live group. Serializing membership changes avoids overlapping transitions with ambiguous quorum rules. Because other implementations activate configurations at different integration points, follow their actual API and persistence contract end to end; borrowing only this lesson's threshold formula would not establish their correctness.
Catch up new members before demanding their votes
A newly started machine may have none of the current log or snapshot. Promoting it immediately can raise the required majority while adding a voter unable to participate usefully, reducing availability. A non-voting learner can receive the existing history before promotion under the supported membership protocol. Learners do not secretly count toward elections or commitment because their disks are busy. Monitor catch-up, identity, and recovery state, then change voting status through the agreed configuration mechanism.
The reliability lab can display only one threshold at a time. For independent runs choose Reset, explicitly set n=5 and k=2, predict, then Play or Step; Reset and explicitly set n=7 and k=3 for another count. It does not represent two membership sets or compute a joint predicate. Write the old and new voter names separately and count intersections by hand. Do not use the seven-node union's displayed majority as a substitute for the two five-node majorities in the worked example.
Work it through
Four union votes can fail both joint tests
The old configuration is {A,B,C,D,E}; the new one is {C,D,E,F,G}. A proposed joint decision has acknowledgements from {A,B,F,G}. Assume all counted acknowledgements satisfy the required term, storage, and eligibility checks. What changes if C also acknowledges?
Each five-voter configuration requires three. The union has seven identities, and four acknowledgements meet a majority-of-union count, but that is not the joint rule.
Initially the old-set intersection is {A,B}, count two, and the new-set intersection is {F,G}, also two. Both joint conditions fail, so these acknowledgements cannot establish the proposed joint decision.
Adding C produces old intersection {A,B,C} and new intersection {C,F,G}, each count three. C contributes to each set's condition because it belongs to both; the distinct acknowledgement set now has five identities.
The additional C acknowledgement satisfies both numerical joint predicates. Actual commitment still requires the log, term, persistence, and configuration-stage invariants of the chosen protocol.
The living notebook
Explore the model
Interactive lab · reliability
One majority display cannot express joint consensus
Use separate Reset → explicitly set n and k → predict → Play or Step runs for (5,2) and (7,3). The toy displays one configured majority only. It does not represent old/new identities, learners, configuration entries, or joint quorums; calculate the two intersections separately on paper.
- Available replicas
- 4 of 5
- Majority needed
- 3
- Majority available?
- Yes
A replica count and a majority threshold, without a consensus protocol. Playback highlights fixed replica states. Having a majority alone does not establish linearizability, durability or failure independence. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.
Look forA majority of a membership union is not generally a majority of each configuration. Joint decisions require the actual two-set predicate and its safe activation protocol.
Pause & reason
Check your understanding
Your turn
Try it yourself
Old voters are {A,B,C}, new voters are {C,D,E}, and a joint round receives distinct valid acknowledgements {A,C,D}. Does it meet both numerical quorum conditions? Why should an unprepared learner not simply be treated as another vote?
Take a moment to make a prediction or work it out on paper. Open a hint when you need one.
Give me a hint
Count A,C,D against each three-member set, and distinguish possession of a node identity from participation in the established voter configuration.
Compare with the solution
Both thresholds are two. The old-set intersection {A,C} has two and the new-set intersection {C,D} has two, so the numerical joint condition is met with three distinct voters. C legitimately appears in both separate counts. A learner remains non-voting until a supported configuration transition promotes it; it may also lack the durable log needed for safe participation. Counting it from reachability alone would alter the configured quorum system without the agreement that protects the transition.
Keep the idea
Take it with you
- A joint quorum requires an old majority and a new majority separately.
- Configuration activation and commitment must follow one complete membership protocol.
- Learner catch-up can protect availability but does not itself grant voting authority.
Read further
Original sources and deeper explanations to follow at your own pace.
Optional progress, saved in this browser when available. Revisit any lesson at any time.
Lesson not marked complete.