Why Caches Disagree: GDS vs Airline Host Availability

7. Married Segments & O&D Interplay

Availability for a connecting itinerary (A–B–C) might be open only as a bundle. A cache lacking the marriage token may incorrectly infer each leg open individually. When a traveler later tries to drop B–C, host denies or reprices. Provide explicit marriageGroupId plus scope=JOINT attribute to caches. Include integrity hash of constituent leg keys so tampering or partial ingestion is detectable.

marriageGroup {
  id: "MG-AB123-BC456-20240710-01",
  legs:["AB123|2024-07-10|A-B","BC456|2024-07-10|B-C"],
  scope:"JOINT",
  version:7,
  createdAt:"2024-07-01T11:05:12Z"
}

8. Price vs Availability Mismatch

Even when seat count matches, pricing divergence fuels perception of availability mismatch.

• Filed vs Dynamic: Cache priced on filed fare ladder; host offered dynamic anchor.
• Tax/Fee Drift: Changed tax table version not yet applied in cache’s aggregated total.
• Brand Bundle Decomposition: Cache shows base class; host only sells brand with ancillaries included.

Mitigation: Pair each availability answer with pricingContextVersion; at commit, require equivalence or initiate repricing handshake (pre-confirm pop to user or agent).

9. Detection & Instrumentation

Log every search and commit with immutable provenance.

AvailabilityProvenance {
  requestId,
  inventoryVersion,
  controlVersion,
  mappingVersion,
  marriageVersion,
  pricedAt,
  servedFrom: HOST | GDS_CACHE | EDGE
}

Create aggregated mismatch events:

MismatchEvent {
  discrepancyType: "FALSE_OPEN",
  flightLegKey,
  class:"R",
  cacheVersion:"inv=982300 ctl=4510",
  hostVersion:"inv=982344 ctl=4512",
  latencySec: 420
}

Trigger anomaly if rate of mismatches > baseline (e.g. False Open > 0.5% of queries per hour for a leg bucket).

10. Reconciliation Strategies

11. Engineering Patterns

11.1 Version Fencing

if (response.controlVersion != host.currentControlVersion) {
   re-evaluate availability before commit
}

11.2 Sequence Gap Detector

expectedSeq = lastSeq + 1
if (incomingSeq > expectedSeq) {
   emit GAP event
   pull snapshot
}

11.3 Conflict Classifier

function classify(host, cache):
  if cache.open && host.closed -> FALSE_OPEN
  else if cache.closed && host.open -> FALSE_CLOSED
  else if cache.count != host.count -> COUNT_DRIFT
  else return CONSISTENT

11.4 Read Repair

On commit failure due to stale availability:
  1. Fetch authoritative state
  2. Update local cache segment
  3. Return corrected offer (with new token)

11.5 Event Prioritization

PriorityQueue:
  1: Closures & decreases
  2: Marriage changes
  3: Opens
  4: Price-only updates

11.6 Staleness Budgeting

classPolicy['R'] = maxStalenessSec 120
classPolicy['Y'] = 300
if (now - invTimestamp > classPolicy[class]) -> force refresh

12. Observability & KPIs

• Divergence Window p95: Time from host update to cache adoption.
• False Open Rate: (False Open responses) / (Total availability responses).
• Commit Failure Attribution: % failures caused by stale availability vs payment vs price change.
• Gap Frequency: Gaps per 10k event sequences.
• Propagation Latency Histogram: For closures vs opens (separate—closures require tighter SLA).
• Edge Stale Serve Count: Edge served objects beyond staleness budget.
• Marriage Integrity Error Rate: Broken marriage validations per 1k multi-leg bookings.

13. Triage Runbook

1. Identify Flight Scope: Gather leg key, RBD, time window from incident sample.
2. Pull Provenance Logs: Compare host vs cache controlVersion & inventoryVersion.
3. Sequence Audit: Check gap detector dashboard for missing sequence IDs.
4. Diff Control Artifacts: Did controlVersion increment without associated push? If yes, feed failure.
5. Check Prioritization Queue Lag: Queue depth metrics > threshold?
6. Edge TTL Audit: Stale-if-error triggered? Inspect error logs around timestamp.
7. Apply Quick Mitigation: Force refresh bundle; temporarily route flight to real-time path.
8. Root Cause Classification: Tag incident record with one of taxonomy categories.
9. Post-Incident Improvement: Adjust SLA guardrails / add missing alert if gap unalerted.

14. Preventive Design Moves

• Carry provenance object in every availability response; make it visible (hidden param) to ops consoles.
• Separate channels for closures vs low-impact updates; closures bypass batch aggregator.
• Bidirectional health checks: caches periodically assert latest sequence they hold; host flags lagging nodes.
• Dual-publish period when changing mappingVersion; reject mixed mapping combos at commit.
• SLA tiering: high-demand departure buckets (< 7 days) force sub-60s closure propagation; long-haul far-future relaxed.
• Rolling canary for feed parser updates with shadow validation before live adoption.
• Edge hint header: X-Inv-Stale-After: 120 guiding CDN to treat data as expired, not extended.

15. Modernization (NDC & Offers)

As distribution shifts to Offer & Order based models:

• Tokenized Offers: Each offer includes availabilityToken encoding inventoryVersion & controlVersion hash; commit validates token.
• Granular Feature Availability: Instead of RBD counts, decision service returns product feature eligibility; caches must store feature-level TTLs.
• Unified Diff Channels: Single event bus carries both inventory and ancillary capacity changes to keep offer caches coherent.
• Interline Coordination: Downstream partner still EDIFACT? Wrap authoritative segments with digital signature to deter manipulation across formats.

16. Implementation Checklist

• Define canonical LegKey + O&D key; document.
• Attach inventoryVersion & controlVersion to all outward availability responses.
• Implement sequence gap detection + automatic snapshot pull.
• Prioritize closure events; monitor closure propagation p95.
• Married segment explicit distribution (groupId, version, hash).
• MappingVersion for marketing ↔ operating RBD conversions.
• Availability token validation at commit (reject stale).
• Observability dashboards: divergence window, false open/closed rates.
• Runbook in repo with taxonomy and decision tree.
• Chaos test: drop 1% of event messages → expect gap recovery, zero silent drift.
• Edge caching policy differentiates harmful vs benign staleness.

17. Mini Glossary

• False Open: Cache shows class open while authoritative host is closed.
• ControlVersion: Identifier of current RM control set (bid prices / protections).
• InventoryVersion: Monotonic sequence of leg seat state changes.
• Marriage Group: Binding list of segments required to be handled jointly.
• Sequence Gap: Missing event number indicating potential state loss.
• Divergence Window: Time span between authoritative update and global cache convergence.
• Read Repair: On demand correction of stale cache during client interaction.

18. References & Reading

• Public airline RM conference talks (AGIFORS, PODS) on network control propagation.
• Open industry papers describing O&D vs leg control implications for distribution.
• Architectural blogs on cache invalidation, eventual consistency, and sequence-based replication.
• NDC implementation guides on offer/availability tokenization.

Proprietary internal feed formats and vendor-specific algorithms intentionally excluded.

19. Disclaimer

Back to all blogs