Three-phase commit (3PC) adds a 'pre-commit' phase between the initial prepare vote and the final commit, specifically to let surviving participants recover without waiting indefinitely for a crashed coordinator. Explain how that extra phase helps under a simple crash-stop failure model, and why 3PC still doesn't solve the blocking problem once you allow network partitions.

## Why 2PC blocks Two-phase commit blocks because a participant that has voted COMMIT has no way to distinguish 'the coordinator decided COMMIT and crashed before telling me' from 'the coordinator decided ABORT and crashed before telling me' — both are consistent with everything the participant has observed, and guessing wrong breaks atomicity. Three-phase commit's fix is to insert an intermediate phase, **pre-commit**, whose entire purpose is to make that ambiguity structurally impossible under the failure model 3PC assumes. ## The three phases The protocol now runs: | # | Phase | What happens | |---|---|---| | 1 | **CanCommit** | the coordinator asks for votes, like 2PC's prepare | | 2 | **PreCommit** | if every vote was YES, the coordinator sends PRE-COMMIT to all participants and waits for acknowledgments, and a participant receiving PRE-COMMIT knows for certain every other participant also voted YES, because the coordinator would not have sent it otherwise | | 3 | **DoCommit** | once the coordinator has all pre-commit acks, it sends the final COMMIT | ## What pre-commit guarantees The invariant 3PC engineers in is: - no participant ever reaches pre-commit unless every participant is guaranteed to eventually commit, and - no participant commits unless it (or, transitively, some participant it can learn from) reached pre-commit. So if the coordinator dies, surviving participants can look at their own local state — did I reach pre-commit? — and, by talking to each other, agree on a safe action without needing the coordinator: - if any survivor reached pre-commit, it's always safe for everyone to proceed to commit; - if none did, it's always safe to abort, since nothing has been promised yet. A timeout-based election lets survivors pick a new coordinator, poll each other's states, and resolve the transaction — bounded by the timeout rather than by waiting for the original coordinator to return. This is the sense in which 3PC is 'non-blocking': under the failure model it assumes. ## Where partitions break it That failure model is the crucial caveat: **crash-stop**, with reliable, non-partitioned message delivery — a process either works correctly or halts completely, and every message sent between live processes eventually arrives. Real networks don't behave that way; they partition. Once you allow partitions, 3PC's non-blocking guarantee unravels. Consider a coordinator that sends PRE-COMMIT to participant A, A acknowledges, and then a partition isolates A from the rest of the cluster (coordinator and participant B) before the coordinator hears back from B. On A's side, A has reached pre-commit — it will eventually time out, elect itself or a peer as leader, see it's in pre-commit, and safely commit. Meanwhile, on the other side, B and the coordinator never received a pre-commit acknowledgment from A and can't confirm the state; B's side may time out and decide to abort, believing pre-commit was never reached everywhere. The result: A commits, B aborts — **split-brain**, the exact outcome the protocol exists to prevent. The root cause is that 3PC's safety argument relies on 'a participant hears from enough others to know the true global state,' and a partition can make that assumption false on both sides simultaneously — each side can look locally consistent while the two sides disagree. ## The broader impossibility This reflects the broader impossibility that you cannot get both non-blocking termination and safety in an asynchronous network where partitions (not just process crashes) are possible, without additional machinery like a quorum-based consensus protocol (Paxos, Raft) underneath the coordinator itself. In practice this is why 3PC, despite being the standard textbook answer to '2PC blocks, how do you fix it,' essentially never appears in production distributed databases — real infrastructure either: - accepts 2PC's blocking risk and invests in fast coordinator recovery, - replaces the coordinator with a replicated, consensus-backed log (so partitions are resolved by quorum majority rather than participant guesswork), or - sidesteps the whole problem by using compensable, eventually-consistent Sagas instead of atomic distributed commit.