Designing systems for disconnected operation

RESEARCH QUESTION

Most infrastructure assumes connectivity is the normal state and disconnection is the exception to handle gracefully. For systems that operate at the edge, or that need to keep functioning through unreliable links, that assumption is backwards — disconnection isn’t an edge case, it’s a routine operating condition the system has to be designed around from the start.

The open question is how much local decision-making authority a disconnected component should retain versus how much it should simply pause. Full local autonomy risks the component making decisions that conflict with what the rest of the system is doing elsewhere. No local autonomy means the component is effectively offline the moment the connection drops, which defeats the purpose of designing for disconnection at all.

We’re exploring where the line sits, and whether it’s even a single line — it may be workload-dependent, with some operations safe to continue locally and others that genuinely need to wait for reconnection and reconciliation. Nothing here is settled enough to present as a finding.