An institutional clearing engine has an unusual consistency requirement: it must never lose a write, and it must acknowledge one in under a millisecond. Those two demands pull in opposite directions, and Raft sits precisely in the middle.
Quorum size is a latency decision
A five-node cluster tolerates two failures and requires three acknowledgements per commit. Every additional node widens the tail, because commit latency is bounded by the slowest member of the quorum, not the average.
Batching without breaking the log
We amortise the cost of consensus by batching entries into a single append, then fsync once per batch rather than once per entry. The batch boundary is chosen adaptively: under light load it collapses to one entry, under heavy load it grows until the fsync cost is amortised across thousands.
- Pre-vote prevents a partitioned node from disrupting a healthy term.
- Leader leases remove a round trip from the read path.
- Separate the log disk from the state-machine disk — they have opposite access patterns.
The result
Ten million operations per second, sustained, with a p99 commit latency under 900 microseconds. The architecture is not novel; the discipline about what not to put in the commit path is.
