RaftShift: Confidence-Aware Break-Even Control for Raft Leader Transfer

Abstract

Adaptive Raft systems can identify attractive leaders from network, workload, or resource measurements, but choosing a target and deciding to move are different problems. The incumbent is ready now; a candidate may require log replication, commit-frontier propagation, snapshot transfer, state-machine application, election, and a current-term readiness barrier. A transfer is worthwhile only if its expected service benefit persists long enough to repay that activation work. RaftShift makes this decision with an auditable activation ledger. It compares the product of conservative lower estimates for per-request advantage and advantage horizon with componentwise upper estimates of Raft-specific activation and disruption cost plus an operational margin. An incumbent-side adapter revalidates authoritative etcd/raft progress and invokes the native TransferLeader path; RaftShift does not modify terms, votes, logs, or commit rules. Evaluation combines a durable client-visible service, a one-RawNode-per-process runtime, 42,000 seeded paired policy outcomes, implementation-trace checking, and three bounded TLA+ model-checking configurations. Across 66 retained local workload runs, all 2,910 operations succeed, including snapshot recovery after restart and online calibration from reversible handoffs. In controlled policy scenarios, activation accounting prevents harmful short-pulse, apply-backlog, and snapshot moves that selected ablations make. The negative results are also material: confidence-aware abstention misses some beneficial transfers, and a biased horizon estimate makes every full-policy transfer harmful in the constructed bias scenario. TLC explores 214,253, 1,153,027, and 714,135 distinct states without invariant violation. The process experiments use one host and artificial delays, so the evidence supports the decision and protocol boundaries, not production or multi-region performance.