To achieve the simultaneous goals of low notification latency and resilience to delegate failures, our FUSE im- plementation distinguishes between different classes of failures. Failures of the steady-state liveness checking trigger a SoftNotification. This message is distributed throughout the liveness checking tree, which alerts the root that a repair is needed and prevents a storm of Soft- Notifications from being sent to the root by the rest of the tree. Members receiving a SoftNotification also initiate repair directly with the root.
Failures of group creation or group repair trigger a HardNotification. Because both create and repair use di- rect root-to-member communication, delegate failures do not incur false positives. Note that SoftNotifications do not cause failure notifications at the application layer.