Reliability Requirements

Cluster Restart (durable resources)

The following are preserved if the entire cluster shuts down/crashes and is re-started:

• Durable wiring (i.e. declarations of durable queues, exchanges and bindings.)
• Persistent messages on durable queues
• Prepared DTX transactions involving only persistent messages on durable queues.

Optionally (configuration) the following may be preserved:

• Non-persistent messages on durable queues.
• Prepared DTX transactions involving only messages on durable queues.

Note the following do not survive a restart:

• All session state is lost.
• All non-durable wiring (queues and exchanges) are lost.
• All TX transactions are aborted.
• DTX transactions involving any messages or queues that do not survive restart are aborted (are such transactions even allowed?)

Fail-over (session state)

A cluster member informs its clients of backup candidates for each session. It can update the list periodically.

After an unexpected disconnect the client can connect to one of the candidates and resume its session transparently. All session state is preserved including:

• Open references
• Active consumers
• Commands-in-flight
• Open transactions (question: Is there any value in fail-over that aborts TX and/or DTX transactions?)

Sessions do not survive

• multiple failures that include the current node and all back-up nodes for that session.
• shutdown/restart of the cluster.