Partition tolerance is not negotiable for a fleet that operates beyond reliable connectivity. When an edge node loses contact with the coordinator, it must keep acting on the last world-state it trusted — and reconcile cleanly when the link returns. The model below treats divergence as the normal case.

§1 The convergence guarantee

Every node maintains a conflict-free replicated representation of shared state. Two nodes that observe the same set of operations — in any order — arrive at byte-identical state. This is the property we lean on hardest: order-independence lets a reconnecting node replay a backlog without coordination.

If two replicas have seen the same operations, they are in the same state. Order is an implementation detail, not a contract.

The practical consequence is that a node need never ask permission to act. It acts, records the operation, and trusts the merge. See the CRDT primer →

§2 Reconciliation after a split

When a partition heals, each side exchanges the operations the other has not yet seen. Because the merge is commutative, there is no leader election and no rollback. The sequence is deliberately boring:

• Exchange operation-set digests to find the delta.
• Stream missing operations in either direction.
• Apply locally; the merge function guarantees convergence.

§3 Operation log as source of truth

State is never stored directly — it is always a fold over the operation log. This gives us a complete audit trail for free: every change, by every principal, human or agent, is reconstructable from the log alone.

The genesis state is the namesake zero point — every fleet starts from the same empty world and diverges only through observed operations.