greatitself.
Continue
advanced25 min studyLesson 260 in Engineering

Conflict resolution: converge on behavior users can accept

Choose field-specific concurrency semantics and identify invariants that require coordination or preallocated rights.

Before you begin
On this page

The question for today

What you’ll understand

  • Match registers, counters, sets, and sequences to product intent.
  • Construct a convergent result that still violates a business invariant.
  • Specify user feedback, conflict recovery, and operational tests alongside merge algebra.

Two replicas agreeing is necessary for many products, but it is not a complete definition of correctness. They can agree on an unwanted lost edit, an overdrawn inventory balance, or a permission that should have been revoked. Conflict semantics are product behavior expressed mathematically. Start with the user’s intended action and invariant, then choose a replicated representation and decide where independent operation is safe and where synchronization or preallocated authority is required.

Choose semantics per field and operation

A counter represents accumulated contributions, a register selects or retains assignments, a set tracks membership, and a sequence preserves an algorithm-defined order. These types are not interchangeable JSON merging strategies. For an article draft, concurrent text edits may fit a sequence type while its publication approval requires an explicit workflow. For a profile, merging independently changed fields may preserve more intent than replacing the entire document. Nested containers also need rules for concurrent field deletion and child updates; composition is only correct when those rules are specified.

A multi-value register can retain incompatible assignments and expose them for resolution instead of silently choosing one. An LWW register can be appropriate where deterministic loss is acceptable and clock/tag policy is understood. An add-wins set retains a concurrent grant that a removal did not observe, which may be suitable for favorites and unsuitable for security revocation. Write examples in the user’s vocabulary: who added, who removed, what each saw, and what appears after reconnect. That exercise often reveals a mismatched datatype before implementation begins.

converge⁡(H)⇏invariant⁡(result⁡(H))\operatorname{converge}(H)\nRightarrow\operatorname{invariant}(\operatorname{result}(H))
H is an admissible update history. Deterministic agreement on its result does not imply an independently chosen application invariant. This logical statement separates convergence from business correctness; it is not a probability or timing claim.↔ Scroll wide equations horizontally.

Local validity can fail under concurrent composition

Suppose stock starts at five and two disconnected replicas each sell four after checking their local balance. Both local checks succeed, but combining accepted sales leaves minus three. An additive counter can faithfully converge to that unacceptable total. Stronger coordination can serialize the decision, while an escrow-style design can preallocate rights so each independent replica spends only its assigned share. The rights allocation, transfer, and recovery rules then become part of the correctness argument. Simply clamping the final negative result to zero loses accounting information.

Similar problems arise with uniqueness, credit limits, and exclusive reservations. A convergent list of competing reservations can preserve evidence, but it cannot make both customers’ exclusive ownership promises true. Decide whether the API accepts a tentative request, confirms a reservation, or rejects it; those are different user contracts. Compensation may repair some outcomes but cannot erase a previously delivered promise. Match acknowledgments and UI language to what the distributed protocol actually guarantees at that moment.

Rtotal=∑iRi,0≤si≤Ri  ⟹  ∑isi≤RtotalR_{\rm total}=\sum_i R_i,\qquad 0\leq s_i\leq R_i\implies\sum_i s_i\leq R_{\rm total}
R_i is a nonnegative preallocated spending right and s_i is the amount spent by actor i without exceeding its rights. Units are stock items in this example. The bound assumes rights are neither duplicated nor transferred with an unsafe protocol.↔ Scroll wide equations horizontally.

Make the conflict lifecycle observable

Document whether conflicts are hidden, automatically merged, retained as alternatives, or presented to the user. Retain enough provenance to explain an unexpected result and support a deliberate resolution operation with the right causal context. Define undo semantics for concurrent work instead of replaying an inverse command against an unrelated current state. Test replica restarts, dropped client context, duplicate delivery, equal tags, delayed deletes, and membership changes. Property checks for convergence complement scenario checks for product behavior; neither replaces the other.

The reliability lab helps expose a misleading shortcut in a design review. Reset, set n=3 and k=1, predict two available replicas and a majority of two, then Step. This says a quorum-sized group is reachable, not that an inventory invariant or revocation rule is enforced. The instrument has no requests, rights, consensus, or conflict policy. Explain which additional mechanism your product needs before interpreting availability as correctness, then return to explicit sales and rights counts in the example.

Work it through

Split spending rights instead of duplicating stock

There are five inventory items. Without coordination, replicas A and B each see five and each accepts a sale of four. Compare this with fixed rights A=3 and B=2.

  1. Under duplicated local availability, accepted sales total 4+4=8, leaving 5−8=−3. Every replica can converge on that arithmetic result while the nonnegative-stock invariant is violated.

  2. With rights split as three and two, A cannot independently confirm a sale of four and B cannot either. Each may accept only work within its own rights, or request a safe rights transfer before confirming a larger sale.

  3. If A sells three and B sells two under those bounds, total sales are five and remaining stock is zero. This preserves the count bound only if rights cannot be duplicated, restored twice, or transferred without the required protocol; availability of a larger single sale can still suffer.

The result

A type’s convergence and a product’s admission rule solve different problems. Preallocated rights trade some flexibility for a clear independent-spending bound.

The living notebook

Explore the model

Interactive lab

Interactive lab · reliability

Reachability does not choose a conflict policy

Reset, set n=3 and k=1, predict two up and majority two, then Step. The availability model has no inventory rights, consensus protocol, or revocation semantics; a reachable majority alone does not prove those properties.

Reachability does not choose a conflict policyA replica count and a majority threshold, without a consensus protocol. Playback highlights fixed replica states. Having a majority alone does not establish linearizability, durability or failure independence. Current readings: Available replicas: 4 of 5; Majority needed: 3; Majority available?: Yes. All parameters are adjustable with the labeled controls below.Majority available · need 3 of 5Playback highlights fixed statesR1 · upR2 · upR3 · upR4 · upR5 · downCyan mark: majority threshold
AvailableUnavailableMajority threshold
Available replicas
4 of 5
Majority needed
3
Majority available?
Yes
t = 0 s

A replica count and a majority threshold, without a consensus protocol. Playback highlights fixed replica states. Having a majority alone does not establish linearizability, durability or failure independence. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.

Look forChoose and verify the operation’s semantic mechanism separately from counting available replicas.

Pause & reason

Check your understanding

A CRDT inventory counter converges to minus three after concurrent accepted sales. What is the main conclusion?

Your turn

Try it yourself

Seven units are split into nonduplicated rights A=4 and B=3. A wants to sell five and B wants to sell two independently. Which can confirm immediately, and what must happen for A’s request?

Take a moment to make a prediction or work it out on paper. Open a hint when you need one.

Give me a hint

Check each actor’s own rights rather than the global total alone.

Compare with the solution

B can confirm two because two is at most three. A cannot confirm five using only four rights, even though total stock is seven. A needs a safe transfer of at least one unused right or coordinated admission. The transfer must preserve single ownership of rights and recovery safety; changing a displayed counter is insufficient.

Keep the idea

Take it with you

  • Convergence is a mathematical agreement property with chosen semantics.
  • Admission invariants can require coordination or safely allocated rights.
  • User feedback and recovery workflows must match what the protocol accepted.

Read further

Original sources and deeper explanations to follow at your own pace.

Optional progress, saved in this browser when available. Revisit any lesson at any time.

Lesson not marked complete.