Message ordering and outages

When part of the network is down, Pigeon waits rather than giving up. A message it has accepted is never dropped, and never shown to you as failed because of an outage.

Each sender's messages arrive in order Built

Every message carries its sender's sequence number, and your app opens each person's messages in that order. If one is missing, the app holds that sender's later messages for up to 30 seconds while it looks for the gap; after that it shows them and counts the gap, so one lost envelope can't stall a chat.

There's no single order across different senders. Your history reads in the order your device sent or opened each message.

Group changes have one order Built

Adding or removing a member or a device is an MLS commit, and two members might try at once. Each group epoch has one sealed commit slot on its five replicas: a first round needs four of five to agree, and if that fails, a designated committer decides at three of five. If replicas ever disagree, apps raise a fork alarm instead of splitting silently.

The protocol is model-checked in TLA+: at most one commit per epoch is accepted, a fork is always flagged, and honest members' histories never diverge. The checks cover single epochs and up to three members; longer runs are untested. Details on group encryption and ordering.

During an outage Built

A message counts as sent once three of its mailbox's five replicas have it on disk. If fewer than three can be reached, the message stays in your outbox and is retried; it is never thrown away.

• On the message: Sending, then Waiting: will send when the connection recovers, then Sent. A quorum loss never ends as Failed; only an explicit refusal does.
• Above the text box in every chat, once per outage: Messages are taking longer than usual to send. They will go through when the connection recovers. It can be dismissed, and it clears itself.

The target

Pigeon chooses reliability over speed: no latency promise during an outage, only that the message goes through. In normal operation, the latest clean soak test delivered 0 lost of 25,629, with p50 0.74 s, p95 1.77 s and p99 4.76 s. These are test-swarm numbers, not a production network. More on reliability and delivery.

Sources: ADR-0006 (groups and ordering, decision 5 and amendments), ADR-0002 (replication), docs/specs/message-history-v1.md (order and delivery state), docs/OBSERVABILITY.md (delivery SLO v2), specs/GroupOrdering.tla.