Each tile is one regime: one kind of system, given by its shape and its delivery guarantee. Find yours, and the tile says what to check for its copies to agree.
When do copies that repair their own state still converge? This map answers it for every regime it covers: a condition that is both necessary and sufficient, a proof that no efficient one exists unless P = NP, or an open problem listed in the audit. Every answer machine-checked: 4,797 axiom-free theorems in Coq, a program that checks mathematical proofs. Questions (a), (b) and (c) are the three questions of the engineer's guide.
New here? The tour takes a few minutes. Or go straight to your row: if you run one service, start with row 01 (and row 02 for your delivery guarantee); if several services copy data one way, row 04; if they copy in a loop, rows 05 and 07.
Two parts that each settle on their own can disagree once one feeds the other.
A converges. B converges at every fixed input. Together they reach two final states: y = 2 or y = 1, decided by whether B moves before or after A.
A change can reach the next service before it has been repaired.
An event on 1 propagates to 2 before 1 is repaired. Collapsed into one block J = {1, 2}, the network converges. Distributed, it does not.
A brief alarm can leave two flags holding each other on for good.
A transient alarm feeds a monotone flag cycle. The flags hold each other up: a fixed point no clean run reaches, so two normal forms.
Changing the rules while updates are in flight can break agreement.
Each configuration converges, and so does a switch at a barrier. Switch live with adds in flight and A's repair is not absorbed: it diverges.