The Delta-Sync Engine
Two people edit the same record offline. Both edits survive. Deterministically.
The incident
A driver marked the package Delivered from a dead zone. Minutes earlier, dispatch had re-routed it. When the driver's phone reconnected, last-write-wins did what it always does: silently destroyed one version of the truth. The package was both delivered and en route, depending on who you asked.
Why the obvious approach fails
Last-write-wins isn't a merge strategy — it's a data-loss strategy with good marketing. Offline devices don't just delay writes; they fork state. When forks reconcile, wall-clock timestamps can't order them meaningfully (clocks skew, and 'later' isn't 'more correct'). Overwriting whole records loses the field-level truth that both sides may hold legitimate updates to different aspects of the same entity. Correct sync requires tracking causality, not time — and resolving true collisions with business rules, not coin flips.
The standard
- Clients journal actions (SET_STATUS, ADD_NOTE), not snapshots — the log of intent is the unit of sync.
- Every record carries a version vector; the server detects concurrent edits by causality, never by timestamp.
- Field-level merging is the default: non-conflicting changes to the same record both apply.
- True collisions resolve by declared semantic rules per entity ("field-reported status outranks HQ status") — deterministic, documented, and testable.
- Reconnection sync is atomic and batched; a sync that fails midway leaves no half-applied state.
How Cortex validates it
At plan time
Offline-capable blueprints must declare the action schema, version-vector strategy, and a collision-resolution rule per entity; "last-write-wins" as a stated strategy fails plan review for critical entities.
At validation
assert: concurrent_edits(same_field) → resolved_by(semantic_rule)assert: concurrent_edits(diff_fields) → both_appliedassert: interrupted_sync → no_partial_stateAssertion syntax is illustrative.
At review
The approver sees the fork-and-merge test matrix: device pairs edited offline, reconciled, with every outcome traced to its rule.