Presumed Abort

TXN 4471 · BEGIN

My job title is resolver. Sorby Habitat has had one since before it had a school, and the post has been quiet for thirty-nine of its forty years, which is how everyone prefers it. I audit the ledgers, I countersign the quarter-day reconciliations, and once, long before my time, a resolver named Ivey spent a whole winter untangling a grain contract that had committed at one warehouse and aborted at the other. Her portrait hangs in the office. Nobody else’s does.

Here is what the office exists for. A habitat is a closed life-support economy. Every person on Sorby holds an entitlement — air, water, calories, a share of the thermal budget — and the sum of the entitlements is the habitat. There is no remainder. A ship is the same thing with a burn schedule attached. So when a person moves from a habitat to a ship, two ledgers must change together: Sorby surrenders one entitlement, the ship’s manifest gains one berth. Together is the entire law. If the ship gains her while Sorby keeps her entitlement, we are budgeting air for a ghost, and on a closed ledger a ghost is theft from everyone at once. If Sorby releases her and the ship never takes her, then somewhere between two hulls there is a woman with no right to air anywhere in the universe. Partial states do not kill quickly. They kill at the next audit, the next rationing review, the next bad harvest, when the books are consulted and found to describe a world that isn’t there.

So transfers are transactions, and transactions have a coordinator. Ours is — was — the Pallas Exchange, because berths are scarce and fourteen habitats contend for them, and contention needs a single place where claims arrive in some order and are decided in that order. Pallas’s other virtue was that it was nobody’s home. It had no stake. It was a log and a clock.

Ana Reyes had been on the transfer list for nine years. Her daughter is on Vesta; there is a grandchild she had met twice, both times by proxy link with a lag that made the child laugh in the wrong places. The Corvus makes the run once every twenty-six months. This time there were four berths and eleven claimants across the belt, and one of the four came up under her name.

PREPARED

On the ninth, Pallas opened the manifest round. The protocol is two-phase, and the first phase is the one people misunderstand. Pallas asked each of us — Sorby’s ration ledger on one side, the Corvus’s berth registry on the other — a single question: can you, and will you? Answering yes is not an opinion. Before a resource manager votes yes it writes a durable record of everything it has promised, locks the resources the promise touches, and only then replies. The receipt is written before the signature. From that moment the manager has surrendered the right to change its own mind. It can no longer commit alone, and it can no longer abort alone. It has promised to be bound by an answer it has not yet heard.

I wrote Sorby’s prepared record at 09:38 local. Her entitlement went into escrow — she kept eating, but the allocation could not be reassigned, not to the waitlist, not to a newborn, not to anyone. Nineteen light-minutes out, inbound and decelerating, the Corvus wrote its own record and locked berth three. Two yes votes, crawling towards Pallas at the speed of light.

At 09:41 Pallas time, the sun put out a proton flare that the forecasters later described, in the measured language of people whose instruments survived, as a once-in-a-century event. Pallas Exchange did not survive it, not the relay, not the hot spare, not the coordinator between them. The damage assessment arrived a day later from a neighbouring station: no signal, no telemetry, physical recovery in months. Perhaps.

Which left the question. Had Pallas received our votes and written commit to its log before it died? Or had it died in the seconds between hearing us and deciding? Because that is all a decision is, in this protocol: one record, in one log, in one place. Everything else — every message, every acknowledgment, every klaxon and stamp — is just the news getting out.

IN DOUBT

Ana came to the office on the third day of the silence. She is not a shouter. She sat where the light from the window crossed the desk and said, “Just tell me which it is. Am I on the ship or aren’t I?”

“You’re in doubt,” I said.

“That’s a place now, is it.”

“It’s the truthful answer. Sorby has promised to let you go if Pallas said yes. The Corvus has promised to take you if Pallas said yes. Pallas said something, or nothing, and the only copy is in a log we can’t reach.”

“Then un-promise. It’s your ledger. You wrote it, cross it out.”

I tried to explain what the promise was for. If prepared managers could change their minds when waiting became uncomfortable, then somewhere, someday, one side would commit while the other crossed itself out, and there would be a woman on a manifest whom no habitat had released, or a released woman no manifest had caught. The protocol blocks precisely because it refuses to be wrong. Its safety is purchased with its patience, and its patience is infinite, and people are not.

“There are cleverer protocols,” I told her, because she deserved the whole of it. “You can replicate the coordinator, put the decision in three logs and let them vote. Pallas quoted a price for that tier and the habitats voted it down, eleven to three, some years ago. Sorby voted no. Safety is a purchase like everything else here.”

“And which way did you vote?” she said, which I had earned.

The Corvus had its own problem and its own resolver, a man called Behrens whom I have still never seen. His problem was mass. A burn window is arithmetic: the ship could not so much as compute its departure without knowing whether berth three held eighty-one kilograms of Ana Reyes and effects or held nothing. And his registry, prepared, could no more release the berth than seize it. We had, both of us, the same authority in our commissions, the one nobody reads until they need it: the power to force a prepared transaction by hand. The manuals call the outcome heuristic, which is the politest word ever applied to guessing. The interface exists because the blocking is not a fault to be engineered away — it is the correct behaviour of a correct protocol — and so someone decided, long ago, that the escape from a machine’s impossibility should be a human’s liability. You force it, you sign it, and if the dead log ever speaks and disagrees with you, the variance is yours.

So Behrens and I tried to agree, at nineteen light-minutes, which way to jump. Thirty-eight minutes to exchange a sentence. I proposed commit; his answer, when it came, asked whether I would still commit if his confirmation were lost; I began composing an assurance and understood, halfway through it, that I was writing the second page of a correspondence with no last page. Every acknowledgment needed acknowledging. We had inherited more than Pallas’s transaction. We had inherited its silence, and were speaking into it.

Both managers had voted yes. Nobody in the system had ever wanted to refuse — the abort we feared existed nowhere as anyone’s intention, only as an artefact of the crash, a reading of a blank page. But ledgers do not run on intention. They run on records, and the record was under a dead relay, and the Corvus’s burn was fifty-one hours out.

RESOLVE

The fix for a dead coordinator is not courage. It is a new coordinator.

A coordinator does not negotiate and does not wait to be believed. It decides, durably, in its own log, before telling anyone — and then the telling can be lost, repeated, delayed, misheard, because the telling is not the decision. The decision is the record. Anyone who asks, now or in a century, gets the same answer, because the answer is written down.

At 14:02 on the fifth day I wrote into Sorby’s own log, under my own key: TXN 4471, decision COMMIT, coordinator of record M. Adeyemi, resolver, by heuristic authority, Pallas Exchange presumed lost. I signed quarter-day reconciliations for eleven years with less hesitation than that one line cost me. Then I transmitted the record itself to Behrens — not a proposal, not a question. A fact, travelling. If his reply was lost, the fact would still be true. He could discover it whenever he liked.

His answer came back in thirty-nine minutes: his registry forced to commit, berth three resolved, and one sentence in the clear — simpler when somebody goes first.

Ana crossed the docking span with a bag she’d packed nine years ago, near enough. Sorby’s ledger released her entitlement at the airlock seal, the waitlist moved up one, and the Corvus burned on schedule, its arithmetic whole.

PRESUMED ABORT

The salvage consortium raised the Pallas cores two years later. The log’s final durable record is timestamped 09:41:03 — a grain future for one of the Hygiean farms, prepared and pending. For transaction 4471 there is nothing. No commit, no abort. The flare came down in the seconds between our promises and the decision they were promised to.

The protocol has a rule for that page, and the rule is in the name it was given: a recovered coordinator that finds no record presumes abort. Ask the resurrected Pallas about 4471 and it answers, correctly, abort. In the world where Behrens and I keep faith with the protocol and merely wait, berth three flies to Vesta locked and empty, Ana’s escrow unwinds a month later, and she goes back onto a list with a twenty-six-month clock on it. That world contains no error. Every component behaves as specified. It is the correct execution of everybody’s promises, and of nobody’s wishes.

The audit board took most of a morning over me. Their finding is four lines in the annual reconciliation, and the last two read: Outcome at variance with presumption. Damage: none found.

I asked the salvage clerk for a facsimile of the log’s final page — the grain future, then blankness. It hangs in the office, under Ivey’s portrait. Behind the glass there is a small square of nothing, three seconds wide, and on the far side of it a message arrives from Vesta every few months: Ana, and a child who by now laughs in all the right places.