OneBarrier: What a Network Must Provide for Transparent Fault Tolerance to Be Free

Abstract

Transparent fault tolerance -- making an unmodified server binary survive crashes -- has been pursued for four decades without reaching production. Every attempt paid three costs on the critical path: recording message arrival order for replay, coordinating a consistent snapshot, and holding each reply until the state that produced it was durable. This paper argues the costs are not intrinsic: they are the price of a network that guarantees neither order nor delivery. We state four conditions under which all three vanish. Three concern the network: Order (messages are delivered in one global sequence), Barrier (delivery is confirmed by a commit barrier), and Durability (each message is replicated to backups before its barrier completes). The fourth, Determinism, falls to the host: a user-space shim closes it for unmodified binaries at 2-10% overhead -- virtual time, virtualized randomness, and share-nothing sharding in place of thread scheduling. OneBarrier realizes all four conditions over an in-network total-order fabric (1Pipe) with microsecond round trips. Fifteen unmodified applications -- including Redis, Memcached, Nginx, Node.js, and a multi-process PostgreSQL -- recover byte-identically, and crash injection confirms linearizable, exactly-once histories; the core protocols are machine-checked in TLA+. A durable write placed inside the barrier adds 4.6 microseconds to a request; the same write placed after it adds three milliseconds. On a network that meets the conditions, fault tolerance is a property, not a tax.