Reliability Requirements

...

Cluster Restart (durable resources)

The following data is are preserved if the entire cluster shuts down/crashes and is re-started: 

• Wiring Durable wiring (i.e. declarations of durable queues, exchanges and bindings.)
• Persistent messages on durable queues
• Prepared DTX transactions involving only persistent messages on durable queues.

Optionally (configuration) the following may be preserved:

• Non-persistent messages on durable queues.

Question: do dtx transactions need to survive cluster restart? do tx transactions?

...

• Prepared DTX transactions involving only messages on durable queues.

Note the following do not survive a restart:

• All session state is lost.
• All non-durable wiring (queues and exchanges) are lost.
• All TX transactions are aborted.
• DTX transactions involving any messages or queues that do not survive restart are aborted (are such transactions even allowed?)

Fail-over (session state)

A cluster member informs its clients of backup candidates for each session. It can update the list periodically.

After an unexpected disconnect the client can connect to one of the candidates and resume its session transparently. All session state is preserved including:

• Open referencesOpen transactions
• Active consumers
• Commands-in-flight
• Open transactions (question: Is there any value in fail-over that aborts TX and/or DTX transactions?)

Sessions do not survive

• multiple failures that include the current node and all back-up nodes for that session.
• shutdown/restart of the cluster.