Client behavior across availability modes

Availability mode changes when a mutation can be acknowledged. Content owners map the shared outcome to their client boundary.

The local and DC retry behavior below ships. Authority epochs and online transfer apply only to HA components. DC writer replacement uses offline promotion rather than an authority transfer.

Writes

Send mutations to a writer. A replica refuses them before the content owner creates authoritative state. A writer also refuses a mutation when it cannot meet the configured durability contract.

PyPI assigns each admitted mutation an idempotency identity. A retry after a lost response returns the committed result without applying another change. HA code also checks the authority epoch; DC has no ownership epoch.

Ingress retains bounded records and bytes for work awaiting finalization. It refuses new work when either bound is full.

Reads

The readable frontier bounds mutable reads. A replica withholds metadata until each required view has applied its serial. Content-addressed reads verify returned bytes against the requested digest.

Remote read-through can fetch missing local bytes from an eligible peer. Failed verification leaves no partial content in the local store.

HA component behavior

An authority transfer advances the epoch and fences its former owner. Retry the same mutation against the current writer. Do not change its identity between attempts.

The owning implementation defines the status, body, and retry signal. Availability code returns an owner-neutral operation result.

Configured none mode

With mode = "none", writes commit on the local node and reads use local state. Startup constructs no distributed coordinator, route, queue, timer, lifecycle handle, or persistence domain.