Quorum design over asymmetric topologies conflates two independent concerns: inter-tier obligation (which tiers must participate for cross-tier safety) and intra-tier replication (how each tier survives local failures). Flat quorums treat all nodes as interchangeable; when consensus fails, the structure does not reveal whether a tier was unreachable or a tier lost too many replicas. We show that mapping a crumbling-wall quorum construction to a physically tiered network separates these concerns and makes the protocol's failure modes legible: an operator can determine which tiers retain global consensus capability from the wall structure and connectivity state alone, without runtime probing. Using a 10-node Earth/LEO/Moon/Mars topology as a magnifying glass, we confirm that three of four tiers retain global liveness during Mars conjunction blackout; only the disconnected tier loses it. Consensus latency at each tier equals the speed-of-light round-trip to Earth: 183~ms (Earth), 131~ms (LEO), 5.1~s (Moon). The wall also imposes a leadership cost gradient on Multi-Paxos elections that symmetric grid quorums cannot express. A comparison between sparse and full-coverage topologies separates wall obligations from network reachability as independent liveness constraints. All results are design-level; quorum intersection is verified exhaustively in TLA+.
翻译:非对称拓扑上的法定群体设计混淆了两个独立关注点:层级间义务(哪些层级必须参与跨层级安全性)与层级内复制(每个层级如何应对本地故障)。扁平法定群体将所有节点视为可互换;当共识失败时,该结构无法揭示是某个层级不可达,还是某个层级丢失了过多副本。我们证明,将“碎墙式”法定群体构造映射到物理分层网络可分离这些关注点,并使协议的失效模式变得易读:操作员仅凭墙结构和连接状态即可判断哪些层级保持全局共识能力,而无需运行时探测。以包含地球、低地球轨道、月球、火星的10节点拓扑为显微镜,我们确认:在火星合日通信中断期间,四个层级中有三个保持全局活跃性,仅有断连层级丧失该能力。各层级的共识延迟等于至地球的光速往返时间:地球183毫秒、低地球轨道131毫秒、月球5.1秒。该碎墙结构还对Multi-Paxos选举施加了对称网格法定群体无法表达的领导权成本梯度。稀疏拓扑与全覆盖拓扑的对比将墙义务与网络可达性分离为独立的活跃性约束。所有结果均为设计级结论;法定群体相交性已通过TLA+进行穷举验证。