When a Borrowed Slice Splits Replicas: Deterministic Resource Metering in a Replicated State Machine

In replicated state machines, resource accounting is part of the replicated protocol: a command's admission or refusal must be deterministic across replicas, regardless of hardware, memory residency, or implementation details. This paper reports a latent consensus defect in a production Rust-based system using Raft, where a storage read was charged differently depending on whether its payload was borrowed from memory or copied after eviction. We present a deterministic resource metering design based on portable integer prices over logical operations, charged before their effects, with admission rechecked during replicated apply before state mutation. Resource prices are treated as versioned protocol data, protected by known-answer tests and compatibility rules. Physical memory usage is validated separately against an empirical envelope rather than used to determine replicated outcomes. Experimental results demonstrate the elimination of residency-dependent admission differences, substantial reductions in memory allocated before refusal, and consistent accounting across tested execution targets. We discuss the assurance levels, limitations, and remaining engineering challenges of this approach.