Incident Management Platform  ·  View 23 of 34  ·  5 · Runtime

Partition — A Cell Without Quorum Still Pages

Sites A and B disappear from site C's point of view. The outpost's probes see the estate failing, its paging domain has no quorum, and it pages anyway.

Editable source SVG draw.io All views
Outpost synthetic probe Cell C engine Paging domain Cell C dispatcher Carrier B Responder Reconciler 1. estate checks failing 2. CAS open incident 3. no quorum · 1 of 3 4. minority mode · local log 5. page from last snapshot 6. SMS and voice · route B 7. rings 8. ack by SMS reply 9. quorum restored 10. replay minority log 11. mark duplicates · keep both Partition — A Cell Without Quorum Still Pages Quorum decides what the record says, never whether a human is paged. The cost is a possible duplicate page, which the reconciler labels rather than hides. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • Quorum decides what the record says. It does not decide whether a human is paged. A cell that cannot reach a majority switches to minority mode: it pages from its last coverage snapshot, keeps escalation state in a local log, and accepts acknowledgements it can receive (ADR-04).
  • Minority mode is visible in every message it sends and pages the platform rotation on carrier B, so nobody mistakes a partitioned cell for a healthy platform.
  • On reconnection the minority log is replayed through the reconciler. Duplicate incidents are linked and labelled as partition duplicates, not merged silently, so the review sees what actually happened.

Why this is safe

  • The worst outcome of two cells paging independently is two pages for one problem. The worst outcome of refusing to page without quorum is no page during the only event the outpost exists for.

Risks

  • An acknowledgement received by the majority side does not stop a minority-side escalation until the partition heals. Accepted: the responder may be called again, and the call says the platform is partitioned.
◀  Dependency Outages — What Still Works When Something Else Is Down All views A DST Boundary — Found Nine Days Early, Not at 02:30  ▶
Solution Architecture v1.0 · Reliability Architecture · 2026-09 · 34 views · open source, fully on-premises23-minority-cell-still-pages