TRACE · INSPECT · CHALLENGE
Hinted handoff: a queue is not a guarantee
Watch missed writes queue, expire and replay only when the replica can receive them.
Your experiment
Play the default trace: four missed writes become hints; B reconnects at 6 and drains them. At 7 a newer k1 write arrives directly. With newest-first replay, the old k1 hint arrives at 9 and cannot overwrite that newer value. Switch queue order to compare. Reduce retention or capacity and inspect missing keys. Enable anti-entropy to repair gaps; keep B offline to confirm neither replay nor repair can claim success.
Play inspects 14 modeled ticks over 60 seconds at 1×. This is teaching time, not database runtime. Pause, scrub or step to the next event. Restart keeps your inputs; changing a parameter recalculates without autoplay.
What the model means
The generation window limits creation after the outage starts. The separate retention slider is an explicit toy expiry policy, not max_hint_window. Hints expire before delivery at the same tick. Replays retain original mutation timestamps. A/C remain online and accept writes to k1..k4 at ticks 1..4; k1 is updated again at 7. The fixture reports actual per-key differences, not just an empty queue.
State at this event
Exact event and state inspector
Scope and references
An in-memory queue with fixed writes, selectable delivery order, synchronous successful delivery while online and no coordinator crash. Capacity, retention and replay rate are illustrative policies, not Cassandra defaults or throughput estimates. No network acknowledgements, segment format, quorum failure, counter mutations, TTL or tombstones. Hints are best effort; an empty queue does not prove replica agreement.
Hints preserve missed writes, not certainty
Replica B misses writes while A and C accept keys one through four, followed by a newer update to key one. A coordinator may retain timestamped hints for B and replay them when it reconnects. Inspect the queue and replica table together: a hint can be created, refused, expired, replayed or ignored as stale. Replaying an old hint must not overwrite the newer value already stored for that key. The model preserves the original write timestamp rather than assigning a new timestamp at delivery.
Set outage and retention controls
B reconnects at tick controls recovery; Keep B offline prevents all delivery. Hint generation window limits the ticks in which new hints can be created. Hint TTL independently expires a retained hint when its age reaches the chosen limit. Queue capacity limits the number of retained hints. Replay rate chooses deliveries per tick after reconnection. Newest hints first reverses the queue order; it does not change timestamp conflict resolution. Repair at tick thirteen reconciles online replicas separately from hint replay and cannot repair a replica that remains offline.
Compare three failure boundaries
Use the starting scenario and inspect the ignored older hint for key one after a newer version has arrived. Disable newest-first delivery and compare the intermediate table, not just the converged result. Reduce queue capacity to one to refuse some missed writes, then compare the final missing keys with repair off and on. Finally keep B offline and enable repair: missing data remains because neither delivery nor this repair step can reach B. Shorten Hint TTL to make expiration distinct from queue-capacity refusal.
Read the scope honestly
Play runs a minute of inspection; Pause holds the view, Next event moves through modeled ticks, Restart rewinds, Speed changes teaching pace and the timeline allows direct comparison. Inputs reconstruct a deterministic experiment. The generation window and retention TTL are separate teaching policies, not a claim about exact Cassandra configuration semantics. There is no disk spool, coordinator failure, replica replacement, consistency-level acknowledgment, real networking or background repair scheduler. Use the evidence to explain why hints are a best-effort convergence aid and why an operator still needs a repair strategy, rather than treating a drained queue as proof that every write survived.