Atomic operations and shared invariants: the transition boundary

Every access to a shared field can be atomic while the program still admits an invalid combined state. The protected unit is the individual operation. A rule involving observations, a decision and several changes needs a transition protocol covering that whole relationship.

For atomic operations and shared invariants, define the operation boundary the application promises. An atomic read cannot make a later decision remain eligible while another participant changes the state.

The examples assume sequentially consistent individual accesses so the failure does not depend on weak-memory visibility. They use abstract operations rather than recommending a language-specific atomic API.

Define compound state transitions for a one-place resource

Use two shared fields x and y, each either zero or one. They represent whether clients X and Y respectively hold the single available place. The invariant is x plus y no greater than one.

The admissible states are (0,0), (1,0) and (0,1). State (1,1) is forbidden because it grants two claims on one place. Each client's isolated acquisition checks that both fields are zero before setting its own field to one. Starting from (0,0), X alone reads the empty state and writes x equal to one. The result (1,0) is valid. Y alone can similarly produce (0,1). Each isolated path therefore appears to preserve the invariant.

The concurrent obligation covers every admitted interleaving of acquisition operations under the specified rule. Evidence from either isolated execution does not establish that property.

Specify the promised outcome as well. An acquisition may succeed only when its claim becomes the exclusive permitted holder. If a competing claim already occupies the place, the operation must fail or follow the contract's defined alternative.

Trace an inadmissible result with atomic accesses

Start at (0,0). X atomically reads x as zero and y as zero, so its local decision says the place is available. Before X writes its claim, Y atomically reads the same two zeros and reaches the same decision.

X then atomically stores one in x. Y then atomically stores one in y. The final state is (1,1). Both claims were admitted even though the capacity is one.

No read observed a torn field, and neither store was partly applied. The execution can be placed in one ordinary total order: X's reads, Y's reads, X's store and Y's store. Individual atomicity is entirely compatible with this failure.

The gap is between each observation and the transition it was supposed to authorize. A local variable retaining the earlier empty-state result does not reserve the resource. Another participant can act on the same earlier condition. The failed eligibility-and-claim relationship is a check-then-act admission error. The writes go to different fields, so protecting each field's store or preventing two stores from losing the same update would not resolve the failed relationship.

How concurrent lost updates differ from admission errors

Use a separate shared counter c initially zero. Each of two clients loads c, adds one locally, and stores the computed value. Make the load and store individually atomic.

X loads zero, Y loads zero, X stores one and Y stores one. Both increments complete under that procedure, but the counter ends at one instead of the intended two. One logical increment was lost when the later store replaced the earlier result.

An atomic read-modify-write increment can address this particular counter transition because observation and update belong to one operation. That fix does not automatically protect the two-field capacity check in the earlier example.

The lock ordering guide adds a revalidation comparison for concurrent lost updates. Its callback can consume the last available unit while the caller's lock is released, leaving a retained local count of one beside a current count of zero. Reacquiring exclusion does not restore that earlier eligibility. Our counter and capacity examples have their own transition models, but they share the need to connect a decision to the state actually protected when it is applied.

A diagnosis should therefore preserve the exact failed rule. Counter increments disappearing and two separate claims being admitted are different histories. Replacing every store with a stronger individual operation would leave the latter eligibility decision to coordinate.

A common critical section covers the relationship

One repair model uses a shared exclusion mechanism around the complete acquisition transition. The protected region includes reading x and y, testing the invariant's eligibility condition, and making the corresponding claim change.

If X enters first from (0,0), it checks and sets x before Y can execute that same protected transition. Y subsequently sees (1,0) and cannot admit its own claim under the rule. If Y enters first, the symmetric result is (0,1).

The argument depends on every operation that can violate the invariant using the same applicable protection. A separate path writing y without participating in the protocol would invalidate the proof. The exclusion mechanism also needs to protect the intended state consistently. Guarding only the write while leaving the eligibility reads outside would preserve the original stale-decision gap.

The application must define how invariant observations are made. A reader that needs a coherent two-field view should participate in the appropriate observation protocol rather than assume two unrelated reads constitute a snapshot.

The common critical section serializes the eligibility-and-claim operation under its stated assumptions. Progress and fairness need their own arguments.

A single-state conditional transition can express exclusivity

Another model represents the resource as one state s with values Free, HeldByX and HeldByY. The admissible ownership states are encoded directly rather than split across independently updated flags.

X uses one conditional operation that changes Free to HeldByX only if the current state is still Free. Y uses the corresponding Free-to-HeldByY operation. The condition and state change occur as one stipulated atomic transition.

Run both contenders from Free. If X's conditional transition occurs first, it produces HeldByX and reports success. Y's attempt still expects Free, but the current state is HeldByX, so it fails and leaves HeldByX unchanged. Reverse the order and only Y succeeds. The operation checks current state as part of the change; an earlier local observation that s was Free cannot substitute for that check.

The successful conditional operation supplies the logical point at which a claim takes effect in this model. A failed conditional operation must remain a failed acquisition unless the contract specifies another admissible step based on current state.

The linearizability guide places compound state transitions at the public-operation level. It asks whether completed overlapping calls have a legal sequential explanation respecting real-time constraints. That question is stronger than identifying atomic instructions somewhere inside each call.

This single-state repair is conditional on having a representation and operation that actually cover the required state. It cannot be assumed to work for arbitrary relationships merely by naming one instruction conditional.

Check failed attempts and release under the same contract

After a failed claim, a caller must not proceed as though the place was reserved. The return value and any local eligibility flag need to agree with the transition's actual result. Release also belongs to the ownership protocol. The application should identify which holder may release the place and what state the permitted release produces. An unrelated writer that sets Free can undermine exclusivity even if acquisition was correct.

For the two-field model, a release modifies the appropriate held flag under the same applicable protection. For the single-state model, the specified ownership transition governs release. These are state-contract statements, not language-specific API instructions.

The invariant proof covers all admitted state-changing paths. Testing acquisition alone while leaving cancellation, release or administrative changes unspecified would not establish the whole protocol.

External effects require another completion argument

Suppose a successful claim is followed by sending a confirmation to an external service. The ownership state can be correct while the confirmation fails or its outcome remains uncertain. The internal atomic transition does not include that external system merely because the call occurs afterward.

The application must define what success means and how an incomplete external effect is reconciled. If it releases the place while the external service may already have accepted the confirmation, another claim could conflict with that uncertain outcome.

Conversely, retaining a claim after a failed delivery can preserve the capacity invariant while preventing useful completion. Safety of the internal state and completion of the application's intended operation are separate observations. A common critical section does not automatically make the external effect transactional, and a single-state conditional update does not supply an external receipt. The declared completion protocol needs evidence suited to that boundary.

The external-effect example identifies assumptions beyond the local flag invariant. A complete booking or distributed-rights system would require another specification.

Verify the promised transition with an interleaving that can fail

Preserve the admissible states and the exact acquisition contract. Enumerate the overlapping observation-and-update history that produced (1,1), and separately preserve the counter history that ended at one after two attempted increments.

For a proposed repair, replay the relevant logical schedule against the specified transition model and inspect the accepted outcomes. The check must fail if two exclusive claims succeed, even when every internal field access remains atomic.

Review the release and failure paths, then identify which external effects remain outside the invariant proof. A passing isolated call cannot substitute for that concurrent history check.

Keep the six-event admission history in a separate column from the invariant when using the Lenovo IdeaPad 15.6-inch FHD touch laptop as a development workspace. The listed i5-1334U processor accompanies 16GB DDR4 memory and a 512GB PCIe SSD. The useful record marks X reading x and y, Y reading x and y, then the two stores. All six events can be individually atomic while the resulting (1,1) fails the capacity rule.

For comparing the repaired outcomes, the ASUS Vivobook 14 FHD laptop is described with 16GB DDR4 memory and a Core 5 120U processor. Keep an acquisition-result column beside each state change on that workspace. Under the conditional model, a failed Free-to-HeldByY attempt after X succeeds must leave HeldByX unchanged and report failure. This result account catches callers that proceed on an old eligibility flag despite losing the conditional transition.