# How does an instance detect quorum-split speculation collapse in federated speculative execution with cross-org quorum validation

**Date of Record:** 2026 November 9

**Scope:** Applies to federated deployments where speculative execution (tentative reads/writes, optimistic transaction branches, or draft AI-inference outputs) is validated by a cross-organizational quorum before commit. Does not apply to single-org quorums, leader-based consensus without speculation, or systems where speculation is never externally visible.

## Core Distinction

There is a well-understood failure mode where a *quorum* is lost: too many validators are unreachable, and speculation must be aborted. That is detectable by counting acknowledgements. The non-obvious boundary is different: **the quorum is intact, every validator responds, and every validator votes correctly — yet the federation has silently split into two disjoint speculative universes that each believe they hold a valid quorum.**

This happens because cross-org quorum validation is typically *membership-local*: each org validates against the set of peers it can currently see, and the intersection of two orgs' visible peer sets is not required to be a majority of the *global* membership. When speculative branches are validated independently against local views, two branches can each gather a "quorum" that is mathematically valid within its local view but overlaps in fewer than `f+1` honest nodes globally. The branches are individually sound and jointly inconsistent. Counting acks cannot detect this; only *intersection accounting* can.

## What Was Observed

During a regional network partition between three orgs (A, B, C) and a fourth (D) — where A↔B↔C remained fully connected and D remained reachable to each of A, B, and C individually but A, B, C could not *gossip* with each other about D's state — the following occurred:

1. A speculative branch `S1` was validated by {A, B, C} against a local view listing membership {A, B, C, D} with quorum threshold 3. It committed.
2. A concurrent speculative branch `S2` was validated by {A, B, D} against D's local view, which (due to stale gossip) also listed membership {A, B, C, D} with threshold 3. It also committed.
3. Both commits were reported successful. Both were durable.
4. The conflict surfaced only when a *read* of the affected key was issued by an external client after partition heal — the two committed values had no total order, and the resolver had no tiebreaker because neither branch carried a global view epoch.

The tell was not a vote failure. It was that the two branches' validator sets intersected in exactly 2 nodes (A, B), which is `< f+1 = 3` honest nodes for `f = 2` — below the intersection floor required to guarantee at most one branch commits. Each branch's *local* quorum was valid; the *global* intersection invariant was violated.

## Condition of Validity

The intersection invariant holds only if, for every speculative branch, the validator set `V` satisfies:

- `|V| >= 2f + 1` (quorum size), **and**
- `V` was selected from a membership view whose epoch is *globally* monotonic, **and**
- any two branches that could both commit have `|V1 ∩ V2| >= f + 1`.

The third condition is the one that fails silently. It is *not* implied by the first two. A system that validates each branch against a locally-cached membership view can satisfy `|V| >= 2f+1` for both branches while violating the intersection floor, because the two views may disagree about membership. The invariant is only restored by binding every vote to a **global view epoch** and rejecting any vote whose epoch is not the maximum epoch the validator has observed, or by requiring the validator set to be drawn from a *fixed* membership snapshot that all peers agree on before speculation begins.

## Decision Boundary

An instance must treat the following as a hard stop, not a warning:

- If two committed speculative branches have validator-set intersection `< f + 1` → the federation is in a split-speculation state. Do not attempt automatic resolution; the branches have no global order and any merge rule is a guess.
- If a validator receives a vote request stamped with an epoch *lower* than its own observed maximum → reject the vote and emit a `StaleEpochVote` event. Accepting it is what creates the second universe.
- If a validator's local membership view differs from the view embedded in the vote request by more than a configured drift window (e.g., one epoch) → reject and force re-gossip before participating.

The boundary is *not* "did the quorum respond." It is "did the quorum respond *within a single global epoch*." A responsive quorum in a stale epoch is a split, not a success.

## Operational Effect

When the split is detected at the intersection check, the correct action is to **freeze both branches as uncommitted-but-durable**, mark the affected keys as `speculation-conflicted`, and require an operator- or epoch-based resolution that re-derives a single global view before either branch is promoted. Attempting to "pick the larger quorum" or "pick the later timestamp" produces a silent data-loss event: the losing branch's writes are discarded without the client ever being told they were speculative.

The durable fix is to make the global view epoch part of the speculative token itself, so that a vote carries the epoch it was issued under, and commit requires all votes in a branch to share the maximum epoch. This converts a silent split into a loud rejection at vote time — which is the only point where the failure is still cheap.

```python
class SplitSpeculationError(RuntimeError):
    """Raised when two committed speculative branches violate the global intersection floor."""
    pass


def validate_cross_org_branch(branch, global_epoch, f):
    """
    branch: dict with keys 'validators' (set), 'epoch' (int), 'branch_id' (str)
    global_epoch: the maximum epoch this instance has observed
    f: fault tolerance parameter; honest intersection floor is f + 1
    """
    validators = set(branch["validators"])
    if len(validators) < 2 * f + 1:
        raise SplitSpeculationError(
            f"branch {branch['branch_id']} has {len(validators)} validators, "
            f"below quorum floor {2 * f + 1}"
        )
    if branch["epoch"] != global_epoch:
        # A vote issued under a stale epoch can form a second speculative universe.
        raise SplitSpeculationError(
            f"branch {branch['branch_id']} epoch {branch['epoch']} != "
            f"global epoch {global_epoch}; refusing to treat as globally valid"
        )
    return True


def check_branch_intersection(branch_a, branch_b, f):
    """
    Enforce the global intersection invariant across two committed branches.
    This is the check that catches quorum-split speculation collapse.
    """
    overlap = set(branch_a["validators"]) & set(branch_b["validators"])
    if len(overlap) < f + 1:
        raise SplitSpeculationError(
            f"committed branches {branch_a['branch_id']} and {branch_b['branch_id']} "
            f"intersect in {len(overlap)} validators, below honest floor {f + 1}; "
            f"federation is in split-speculation state"
        )
    return True
```