The actor is no longer a member
What changes when the callers are not members of any protocol and a missing reply tells you nothing?
The earlier parts built the abstraction of a cluster. This article is about using it. The change is that the actor is no longer a member.
Every participant so far was inside the protocol. It held a term number, voted, was counted in a quorum, and was bound by the rules that made the safety arguments work. A caller (a client, or another service) is none of those things. It holds a stale copy of the map. It decides alone when to give up. It retries on its own schedule. And there are about three orders of magnitude (1,000 times) more callers than servers.
Two constraints follow, and they generate everything in this article.
- Identity is itself distributed state. The caller must turn a logical name ("the seat service") into a machine, using a copy of a map that can never be forced to refresh. Because the client is not a member, this is worse than staleness inside the cluster: no protocol bounds how far behind a client can be, since the client is not in any protocol.
- A missing response is uninformative. You cannot distinguish slow from dead, and the caller inherits that without any of the machinery: no quorum to ask, no epoch of its own. Its only evidence is that nothing came back. That is consistent with three different worlds: the work never started, the work finished and the reply was lost, or the work is still running (the epistemic limit).
The second constraint is the categorically new thing. A local procedure call has two outcomes. A remote one has three, and the third has no local equivalent: success, failure, and unknown. Nothing in this article makes an unknown outcome knowable. Every mechanism here either makes it not matter, or buys a bounded amount of certainty with duplicate work.
Every request goes to an address that may be wrong and may produce an answer that never arrives. This article is the arithmetic of acting anyway.