Health-Triggered Quorum Adjustment: Dynamic Thresholds From Network Stability Signals

Mechanism

The mechanism is a closed-loop control system whose input is a continuously updated vector of peer health signals and whose output is the integer quorum size used by the consensus engine for the next decision window. Health signals are not opinion polls or reputation scores; they are derived from objectively measurable properties of each peer's recent participation: round-trip latency variance, dropped-message rate, lineage-commit success ratio, clock-skew bound observed during exchange, and the freshness of the peer's last validated heartbeat. Each signal is normalised to a unit interval and combined through a weighted reducer whose weights are themselves committed protocol parameters, ensuring that two honest evaluators presented with the same observation history produce the same scalar health value.

When the scalar health value crosses below a lower band, the quorum function transitions to a stricter regime. The transition is not a smooth interpolation across a continuous variable; it is a discrete step between named regimes, each with a specified integer quorum size and a specified eligibility predicate. Discrete regimes are required because the consensus engine must commit to a single quorum value for the duration of a decision window, and because every participant must agree on that value without further coordination. A continuous quorum would create ambiguity at boundaries and would multiply the number of distinct commit states the system must reason about; the discrete regime model collapses this to a small, enumerable set.

Each regime defines, in addition to the integer quorum, a participant-weighting rule. Under the nominal regime, weights are uniform: every eligible peer's vote counts equally toward the quorum. Under degraded regimes, weights become a function of recent health, with peers whose individual signals are below a per-peer floor either down-weighted or excluded entirely from the eligibility set. This dual response, expanding the quorum size while contracting the eligibility set, is what prevents a degraded network from compensating for missing votes by allowing marginal participants to swing decisions. The two adjustments are deliberately complementary: a decision made under stress requires both more votes and votes from peers with demonstrably stable participation.

Quorum increases are bounded by an upper ceiling that is itself a committed protocol parameter, not a dynamic value. The ceiling exists because an unbounded quorum function would permit pathological inputs to drive the required quorum above the available eligible population, producing unrecoverable deadlock. By committing the ceiling at protocol configuration time, the system guarantees that a non-empty solution always exists for the quorum equation, even under maximal degradation. When health signals would otherwise demand a quorum greater than the ceiling, the system clamps to the ceiling and emits a saturation marker into the lineage, signalling to operators and to downstream evaluators that the protocol is operating at the boundary of its committed safety envelope.

Restoration to a less strict regime is explicit rather than automatic. After health signals recover above the upper band of the current regime, the protocol does not immediately lower the quorum; instead, it requires a sustained recovery interval during which the scalar health must remain above the band, and it requires an explicit restoration commit that itself meets the stricter quorum currently in force. This asymmetry, fast tightening and deliberate loosening, is a deliberate hysteresis that prevents oscillation across a flapping signal. A network whose health is hovering near a regime boundary will not thrash between regimes once per heartbeat; it will tighten quickly when stress appears and will loosen only after stress has demonstrably subsided.

Operating Parameters

The protocol exposes a small set of committed parameters that govern the mechanism's behaviour. The lower band threshold determines when the system tightens; in typical deployments it sits in the upper portion of the unit interval, reflecting a posture in which mild degradation is enough to prompt a defensive response. The upper band threshold determines when restoration is permitted to proceed and is set strictly above the lower band by a margin sufficient to prevent boundary thrash. The recovery interval is a duration during which the scalar health must remain above the upper band before a restoration commit may be issued, and it is typically expressed in protocol rounds rather than wall-clock time so that the parameter is meaningful regardless of substrate speed.

The regime table is the parameter that defines, for each named regime, the integer quorum, the eligibility predicate, and the weighting rule. The table is committed as a single object, so a transition from one regime to another is not a multi-field update but a single discrete reference change. The ceiling is encoded as the largest quorum value present in the table; no dynamic value can exceed it. The signal-weighting vector that combines individual health observations into the scalar value is also committed and cannot be altered without a governance commit that itself meets the strictest quorum.

Per-peer health floors determine the threshold below which a peer is excluded from the eligibility set under degraded regimes. These floors are deliberately permissive under the nominal regime, becoming progressively stricter under tighter regimes, so that a peer with marginally degraded signals continues to participate during normal operation but is excluded once the network as a whole is operating under stress. This graduated exclusion is the second half of the dual response described in the mechanism section.

Saturation markers, recovery markers, and regime-transition markers are emitted into the lineage as committed events. They carry the timestamp range during which the relevant condition held, the peers whose signals contributed to the transition, and the resulting quorum value. These markers are not advisory annotations; they are the system's only record of regime history, and downstream evaluators rely on them to reconstruct the quorum used for any past decision.

Alternative Embodiments

The mechanism admits several alternative embodiments that preserve the structural property while varying implementation details. In one embodiment, the regime table is a fixed three-tier structure with nominal, elevated, and saturated levels; this minimises configuration surface and is appropriate for deployments where operators prefer simplicity over fine-grained control. In a second embodiment, the table is parameterised by deployment topology and may contain four or more regimes, with the additional regimes used to model partial-partition conditions in geographically distributed networks. The protocol does not constrain the number of regimes beyond the requirement that they be discrete and totally ordered.

In a further embodiment, the scalar health function is replaced by a vector-valued function whose components are individually compared against per-component bands. This embodiment is useful when operators wish to react differently to latency degradation than to message-loss degradation; for example, a network whose latency is rising but whose loss rate remains nominal may transition into a different regime than a network with the inverse profile. The protocol treats the vector embodiment as a generalisation of the scalar embodiment and accommodates both with the same regime-table machinery.

Another embodiment varies the weighting rule under degraded regimes. The default rule down-weights peers below the per-peer floor; an alternative rule excludes them outright. The choice between down-weighting and exclusion is itself a committed parameter, and the protocol enforces consistency across all evaluators within a deployment. A third variant permits time-decayed weights, in which a peer whose recent participation was unhealthy continues to be admitted but with a vote weight that recovers gradually as healthy participation accumulates.

A final embodiment couples health-triggered quorum adjustment with substrate-specific signals. On a deployment that spans cloud regions, region-availability signals may be incorporated into the scalar health function; on an edge deployment, link-quality signals from radio firmware may be incorporated. In each case, the additional signals enter through the same weighted reducer and produce a scalar that is consumed by the same regime-transition logic. The mechanism is, in this sense, substrate-agnostic at its core and substrate-aware at its periphery.

Composition

Health-triggered quorum adjustment composes with the other primitives of the memory-native protocol stack in well-defined ways. The append-only lineage receives every regime transition as a committed event, so the protocol's audit story is complete: any past commit can be evaluated in the context of the regime that was active at the time, and the regime's parameters can be reconstructed from the same lineage. Lineage and quorum are mutually reinforcing: lineage is the medium through which regime history is recorded, and quorum is the rule under which lineage entries are admitted.

Composition with policy evaluation is similarly tight. A policy that requires a decision to have been made under at least the nominal regime can be expressed as a structural predicate over the lineage, and the predicate can be checked offline by any party in possession of the lineage. Policies that require commits to have been made under stricter regimes during periods of declared sensitivity are likewise expressible. The mechanism does not require the policy layer to understand health signals directly; it only requires the policy layer to understand regime identifiers, which are stable, committed values.

Composition with cross-substrate migration is preserved because regime identifiers and the parameters that define them travel with the protocol object rather than residing in a substrate-local registry. A migration from one substrate to another carries the regime table, the saturation history, and the per-peer floors as part of the migrating object, so the destination substrate can reconstruct the quorum behaviour without any out-of-band coordination. Composition with partition tolerance follows the same pattern: a partitioned subgroup that retains a majority of its committed regime parameters can continue to operate, and a subgroup that does not is structurally prevented from making commits that would later conflict with the surviving partition.

Prior-Art Differentiation

Conventional consensus protocols treat the quorum size as a static parameter set at deployment time. Paxos and its derivatives, Raft, and the practical Byzantine fault-tolerant family all assume a fixed membership and a fixed quorum derived from that membership. When operators wish to adjust the quorum in response to changing network conditions, they typically do so out of band by reconfiguring the cluster, which is itself an expensive coordinated operation that may not be available under the stress conditions that motivated the adjustment.

Reputation-based extensions to consensus, in which peers accumulate reputation scores that influence their voting weight, address a related but distinct problem. Reputation systems weight individual participants based on their history; the present mechanism adjusts the threshold that the population as a whole must clear, and it does so based on observable transport-layer signals rather than on accumulated subjective scores. Reputation systems also typically require a trusted scoring authority or a separate consensus to maintain the scores, neither of which is required here. The two approaches are compatible but address orthogonal failure modes.

Dynamic membership protocols allow the participant set to change over time but typically retain a fixed quorum fraction of the current membership. The present mechanism is distinguished by its decoupling of quorum size from membership cardinality: the quorum increases under stress without the membership changing, and the membership may change without the quorum changing. The bounded ceiling and the explicit-restoration property are also absent from prior dynamic-membership work, in which restoration is typically implicit and unbounded.

The closest prior art is found in adaptive replication systems that vary write quorum based on read-write latency. These systems demonstrate that quorum can be a dynamic value, but they operate on data-store semantics rather than on consensus semantics, and they do not provide the lineage-committed regime transitions, the bounded ceiling, or the explicit-restoration property that the present mechanism makes structural.

Disclosure Scope

The disclosure encompasses the closed-loop control system described above, the discrete-regime model with bounded ceiling and explicit restoration, the dual response of expanding quorum and contracting eligibility, and the lineage-committed regime transitions. It encompasses the scalar and vector formulations of the health function, the down-weighting and exclusion variants of the participant-weighting rule, and the substrate-aware extensions in which additional signals enter through the weighted reducer.

The disclosure does not constrain the specific numerical values of the bands, the ceiling, the recovery interval, or the per-peer floors. These are deployment parameters whose appropriate values depend on the substrate and the application. The disclosure does constrain the structural properties: the bands must be ordered, the ceiling must exist and must be committed, the recovery interval must be non-zero, the per-peer floors must be ordered consistently with the regimes, and every transition must be recorded as a committed lineage event.

The disclosure is filed as Provisional 64/050,895 and is incorporated into the memory-native protocol stack disclosure as a structural primitive rather than as an optional feature. A protocol that omits health-triggered quorum adjustment is, by definition, not an embodiment of the present disclosure. A protocol that implements adjustment without the bounded ceiling, or without explicit restoration, or without lineage-committed transitions, is similarly outside the disclosure. The structural properties are jointly necessary; no proper subset is sufficient.