A Software Engineer at the Commonwealth Of Massachusetts plays a critical role in building, maintaining, and modernizing the digital infrastructure that serves millions of residents, businesses, and visitors across the state. Unlike the private sector, where engineering efforts are driven primarily by profit margins, software development within state government is focused entirely on public impact, accessibility, security, and equity. Engineers here work on high-stakes systems ranging from health and human services portals to transportation, environmental tracking, and public safety applications. In this role, you will contribute to the digital transformation of state agencies, helping to transition legacy mainframe systems into modern, cloud-native architectures. Whether you are placed within the Executive Office of Technology Services and Security (EOTSS) or embedded directly within a specific state department in locations like Boston, Chelsea, or Quincy, your work will directly affect how citizens interact with their government. The scale of the user base and the diversity of the technology stack make this a highly challenging and rewarding environment for civic-minded technologists. You will face unique engineering constraints, such as ensuring strict compliance with accessibility standards (WCAG) and managing complex integrations across diverse state databases.
Recruiter Outreach
reportedInitial outreach from a recruiter to guide you through application paperwork.
What to demonstrate
- Initial outreach from a recruiter to guide you through application paperwork
- Depth in Network Engineering (General)
How to prepare
- Be able to walk your CV end to end in two minutes, and say why this company specifically.
- Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
Casual Phone Conversation
reportedA discussion with the hiring manager about your background and interest in the agency.
What to demonstrate
- A discussion with the hiring manager about your background and interest in the agency
- Depth in Network Engineering (General)
How to prepare
- Answer aloud and timed: How do you approach debugging a slow-running database query or API endpoint?
- Answer aloud and timed: Describe your experience with version control systems like Git and how you manage merge conflicts in a team environment.
Formal Technical Interview
reportedIn-depth discussions about past projects, scenario-based troubleshooting, and behavioral questions.
What to demonstrate
- In-depth discussions about past projects, scenario-based troubleshooting, and behavioral questions
- Depth in Network Engineering (General)
How to prepare
- Answer aloud and timed: What is the purpose of a subnet mask, and how does routing work across different networks?
- Answer aloud and timed: Why do you want to work as a Software Engineer for the Commonwealth Of Massachusetts?
Final HR Call
reportedA final call with the hiring manager to discuss logistics, team integration, and civil service expectations.
What to demonstrate
- A final call with the hiring manager to discuss logistics, team integration, and civil service expectations
- Depth in Network Engineering (General)
How to prepare
- Answer aloud and timed: Describe a time when you had to explain a complex technical concept to a non-technical stakeholder or agency partner.
- Answer aloud and timed: How do you handle a situation where project requirements change mid-development due to policy or regulatory updates?
PracHub editorial advice for the preparation topics above.
Emphasize Accessibility and Security
The state must serve all residents, including those with disabilities. Mentioning your awareness of WCAG accessibility guidelines and secure data-handling practices will immediately signal that you understand the unique responsibilities of public sector engineering.
Be Patient and Professional
The state hiring process involves structured steps and formal documentation. Respond to recruiter requests promptly, keep your application documents organized, and maintain a professional, collaborative tone throughout.
Prepare Practical Project Examples
Be ready to discuss real-world projects you have worked on. Focus on how you solved specific technical challenges, how you collaborated with others, and the ultimate impact of the project.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Identify the heaviest tenants in a five-minute window under memory pressure
The edge service handles about 3,000 requests per second across roughly 50,000 tenants, peaking near 9,000. Expose the 50 heaviest tenants by request count over the trailing five minutes so limits can be tightened before one tenant's backfill starves the fleet. You may not retain five minutes of raw records. Give the exact solution and its memory, then the bounded-memory approximation with its error stated as a formula, and say which you would ship and at what tenant cardinality that choice changes.
Approach
- Do the exact version first, because it is affordable at this cardinality: a ring of 300 one-second counters per tenant, advanced lazily, is 1,200 bytes of counters per tenant and roughly 60 to 90 MB for 50,000 tenants with overhead. Carry a running total and subtract the bucket you overwrite so a window read is O(1) rather than 300 adds.
- Extract the top 50 with a size-k min-heap over the tenant sums: O(d log k) for d tenants, against O(d log d) to sort them all. Maintaining the heap continuously instead of on query requires a tenant-to-heap-index map, because incrementing a count already inside the heap means sifting from a known position, and without that map you rebuild the heap on every request.
- State the approximation precisely rather than gesturing at sketches. Misra-Gries with m counters retains every item whose true count exceeds N/(m+1), and each retained count underestimates the truth by at most N/(m+1). With m = 1,000 and N = 900,000 requests in the window the error is roughly 900 requests, which is fine for spotting a tenant sending 50,000 and useless for ranking two tenants 200 apart.
- Say what breaks when the window slides: Misra-Gries and Space-Saving are insert-only and cannot be decremented as records age out. The workable construction is one summary per sub-window, say ten seconds, with 30 summaries merged at query time, and the merged error is the sum of the per-summary errors, so the bound degrades linearly in the number of sub-windows.
Follow-up
- The heaviest tenant is heavy because of one export job rather than user traffic. Should the limiter treat those as the same tenant?
- Two tenants sit tied at the boundary of the top 50. Does your answer flap, and does the flapping matter?
Canonicalise a request body into a stable idempotency fingerprint
idempotency_key.request_fingerprint is a SHA-256 over the method, path and canonicalised body, and a retry whose fingerprint differs must be rejected with 422 rather than served the stored response. Write the canonicaliser. Bodies are JSON up to 256 KB nested at most 32 levels; clients vary key order, whitespace and unicode escaping, and some send 64-bit ids as JSON numbers. Produce a deterministic byte string such that semantically identical bodies match and any semantic difference does not. State your complexity and name two normalisations you refuse to perform.
Approach
- Parse once into a tree, then re-serialise under fixed rules: object keys sorted, array order preserved, one escaping convention, no insignificant whitespace. Parsing is O(n) and sorting keys is O(k log k) per object, so O(n log n) overall with O(depth) stack, and the 32-level cap is enforced during parsing because hostile nesting is how a canonicaliser becomes a stack overflow.
- Sort keys by their UTF-8 bytes and say why the obvious implementation is wrong in some runtimes: a default string comparison that orders by UTF-16 code units places surrogate pairs, meaning code points from U+10000 up, below U+E000 to U+FFFF, which is not UTF-8 byte order, so two services written in different languages disagree on the same document.
- Do not re-encode numbers through a double. IEEE-754 binary64 represents integers exactly only up to 2^53, so normalising a 19-digit id through a float changes it, and 1 against 1.0 cannot be reconciled without deciding whether they are the same value. Preserve the literal token, and require ids as strings at the API boundary if you want them comparable.
- Reject duplicate keys rather than picking one. JSON permits them and parsers disagree, most keeping the last, so any choice you make ties the fingerprint to a parser detail that the code handling the request does not necessarily share.
Follow-up
- A client sends the same logical request with an extra field your API ignores. Same key, different fingerprint, so you return 422. Is that the right answer?
- Where does the fingerprint get computed relative to request decompression and the body-size limit?
Archive a resource graph without breaking live references or recursing
Resources reference other resources within a tenant; for the largest tenant the reference table holds up to 2,000,000 nodes and 8,000,000 edges. Archiving a resource must archive everything reachable from it that nothing outside the set still references, refuse when a live external referrer exists, and terminate when references form cycles, which they legitimately do. Produce the archive order and the refusal list, targeting O(V+E). Say what stops the traversal crossing a tenant boundary, and why recursion is the wrong control structure at this size.
Approach
- Load the subgraph with the tenant predicate on both endpoints of the edge, not only on the side you started from. Scoping the left table alone is the classic cross-tenant leak: one mis-entered edge then pulls another tenant's resources into the traversal and, worse, into the archive.
- Traverse iteratively with an explicit stack. A 2,000,000-node graph can hold a chain deep enough to exhaust a native stack in the low tens of thousands of frames, and that failure is a process crash rather than an error you can return.
- Treat cycles as data rather than corruption: compute strongly connected components with Tarjan in O(V+E) using its own explicit stack, then condense. The condensation is a DAG, so a topological order over it gives the archive order, and every member of a component archives in one transaction because no order within a cycle is valid.
- Decide refusals with reverse edges. A candidate is archivable only if every in-edge originates inside the candidate set, so build the transpose or count in-degrees restricted to the visited set, and emit each blocked resource with the id of the external referrer, which is the only part of the answer an operator can act on.
Follow-up
- The graph is read in one query and the archive writes a minute later. What can change in between, and how do you make the write safe?
- The candidate set is 400,000 resources. Is that one transaction, and if not, what does a half-finished archive look like to a reader?
Hold a per-tenant active cap against concurrent creates
A tenant on the standard plan may hold at most 50 resources with status='active'. The create handler runs SELECT count(*) FROM resource WHERE tenant_id = $1 AND status = 'active', compares to 50, then inserts. Two creates arrive 3 ms apart on different instances and the tenant lands at 51. Name the anomaly, say whether PostgreSQL 16 READ COMMITTED or REPEATABLE READ prevents it and why, then give an implementation that holds the cap at READ COMMITTED with the exact statements. Finally, say what changes when the cap is 'at most one running export per tenant' on job_run.
Approach
- Name it: write skew. The two transactions read an overlapping set and write disjoint rows, so there is no row-level conflict for the engine to detect and each commit is individually legal.
- Rule out the levels precisely. READ COMMITTED takes a fresh snapshot per statement and takes no lock on the counted rows, so both see 49. PostgreSQL's REPEATABLE READ is snapshot isolation: it removes non-repeatable reads and phantoms within the snapshot but still admits write skew, because the anomaly is not a re-read of a changed row, it is a read of a set that a concurrent transaction invalidates. Only SERIALIZABLE closes it, by tracking the read dependency and aborting one transaction with SQLSTATE 40001 — a guarantee that exists only if the application re-runs the whole transaction from the read.
- Convert the set predicate into a single-row conflict: keep tenant.active_resource_count and run UPDATE tenant SET active_resource_count = active_resource_count + 1 WHERE tenant_id = $1 AND active_resource_count < 50 in the same transaction as the INSERT. Zero affected rows is the cap, returned as 409. The row lock serialises the decision at any isolation level, and contention is bounded to one tenant's row — which is also the fair-scheduling unit, unlike a global counter that would convoy every tenant behind one row.
- State the cost you just took on: a counter is a second source of truth that can drift, so every path that changes status must adjust it inside the same transaction, and a periodic reconciliation has to exist, with resource_revision as the authority for what the count should have been.
Follow-up
- A resource moves from archived back to active. Which statements change, and what breaks if the counter update and the status change land in different transactions?
- The cap becomes plan-dependent and a plan can change mid-month. Where does the number 50 live, and who reads it?
Write the update path that detects a concurrent edit
resource carries version INT NOT NULL DEFAULT 1. resource_revision holds revision_id, resource_id, version, actor_user_id, change_kind, patch JSONB, request_id, created_at with UNIQUE (resource_id, version). outbox_event holds aggregate_type, aggregate_id, aggregate_version, event_type, payload, status. A PUT carries the version the client read. Write the exact statements for the single transaction that applies the edit, records the revision and enqueues 'resource.updated', and give the handler's branch on zero affected rows. Then say what PostgreSQL 16 does under READ COMMITTED when two of these updates hit one row at once.
Approach
- One transaction, three writes, no network call inside it: UPDATE resource SET title = $3, version = version + 1, updated_at = now() WHERE resource_id = $1 AND tenant_id = $4 AND version = $2; then INSERT the resource_revision row at version $2 + 1; then INSERT the outbox_event row at the same aggregate_version. The event goes to a table rather than a broker because no transaction spans both.
- Branch on the affected-row count before doing anything else. Zero has three causes — stale version, wrong tenant, row gone — so re-read once and map to 409 carrying the current version, or 404 for an id outside the caller's tenant, which also stops the endpoint confirming that another tenant's id exists.
- State the engine behaviour instead of assuming it. Under READ COMMITTED the second UPDATE blocks on the row lock, and when the first commits PostgreSQL re-evaluates the WHERE clause against the newly committed row, so the version predicate now fails and the statement reports zero rows. Under REPEATABLE READ the identical collision raises SQLSTATE 40001 instead, so the handler must fold both shapes into one conflict response.
- Keep UNIQUE (resource_id, version) even though the predicate already serialises writers. It is what makes a lost update unwritable if any other path ever reaches the revision table, and it converts a logic bug into 23505 rather than into a silently missing history row.
Follow-up
- A client sends the version it read ten minutes ago and the resource has moved three versions. What is in your 409 so it can resolve the conflict without a full re-fetch?
- Two editors, two disjoint fields, no overlap. Does your answer still refuse the second write, and should it?
Explain the difference between a relational and non-relational database, and when you would choose one over th
Explain the difference between a relational and non-relational database, and when you would choose one over the other.
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
What are the core components of a secure web application architecture?
What are the core components of a secure web application architecture?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
How do you approach debugging a slow-running database query or API endpoint?
How do you approach debugging a slow-running database query or API endpoint?
Approach
- Say who the caller is and what they do when the call fails halfway.
- Define the identity of a request so a retry cannot double-apply it.
- Separate accepted, pending, failed and confirmed; they are different facts.
- Design the error taxonomy before the success shape; callers branch on it.
Follow-up
- What happens if the caller retries after a timeout?
- How does a client discover it is on an old version of this contract?
What is the purpose of a subnet mask, and how does routing work across different networks?
What is the purpose of a subnet mask, and how does routing work across different networks?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
How would you design a simple, scalable system to handle high-traffic spikes on a state portal during a public
How would you design a simple, scalable system to handle high-traffic spikes on a state portal during a public registration event?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
An application suddenly goes down, and users are reporting 504 Gateway Timeout errors. Walk me through your st
An application suddenly goes down, and users are reporting 504 Gateway Timeout errors. Walk me through your step-by-step troubleshooting process.
Approach
- Establish what changed and when, before forming any theory.
- Pick a bisection that eliminates candidates whichever way it turns out.
- Check the instrumentation before believing the symptom.
- Separate the trigger from the cause; the deploy is rarely the bug.
Follow-up
- What would you look at first, and what would it rule out?
- How would you tell a cause from a coincidence here?
If you inherit a legacy codebase with minimal documentation, what is your strategy for understanding and updat
If you inherit a legacy codebase with minimal documentation, what is your strategy for understanding and updating the system?
Approach
- Establish what changed and when, before forming any theory.
- Pick a bisection that eliminates candidates whichever way it turns out.
- Check the instrumentation before believing the symptom.
- Separate the trigger from the cause; the deploy is rarely the bug.
Follow-up
- What would you look at first, and what would it rule out?
- How would you tell a cause from a coincidence here?
Built from the rounds and topics Commonwealth Of Massachusetts candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Commonwealth Of Massachusetts loop
- Write out the reported sequence: Recruiter Outreach, Casual Phone Conversation, Formal Technical Interview, Final HR Call.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.
02Work Network Engineering (General)
- Spend the session on Network Engineering (General), which Commonwealth Of Massachusetts candidates report being tested on.
- Write one worked example in Network Engineering (General) and time yourself on it.
Deliverable: One timed worked example in Network Engineering (General).
03Work Networking Fundamentals
- Spend the session on Networking Fundamentals, which Commonwealth Of Massachusetts candidates report being tested on.
- Write one worked example in Networking Fundamentals and time yourself on it.
Deliverable: One timed worked example in Networking Fundamentals.
04Work Routing and Switching Concepts
- Spend the session on Routing and Switching Concepts, which Commonwealth Of Massachusetts candidates report being tested on.
- Write one worked example in Routing and Switching Concepts and time yourself on it.
Deliverable: One timed worked example in Routing and Switching Concepts.
05Answer out loud: Technical & Domain Knowledge
- Answer aloud, timed: Explain the difference between a relational and non-relational database, and when you would choose one over the other.
- Answer aloud, timed: What are the core components of a secure web application architecture?
Deliverable: Spoken answers to 2 reported Technical & Domain Knowledge question(s), under time.
06Answer out loud: Behavioral & Public Service Alignment
- Answer aloud, timed: Why do you want to work as a Software Engineer for the Commonwealth Of Massachusetts?
- Answer aloud, timed: Describe a time when you had to explain a complex technical concept to a non-technical stakeholder or agency partner.
Deliverable: Spoken answers to 2 reported Behavioral & Public Service Alignment question(s), under time.
07Answer out loud: Scenario-Based Troubleshooting
- Answer aloud, timed: An application suddenly goes down, and users are reporting 504 Gateway Timeout errors. Walk me through your step-by-step troubleshooting process.
- Answer aloud, timed: How would you design a simple, scalable system to handle high-traffic spikes on a state portal during a public registration event?
Deliverable: Spoken answers to 2 reported Scenario-Based Troubleshooting question(s), under time.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
Describe your experience with version control systems like Git and how you manage merge conflicts in a team en
Describe your experience with version control systems like Git and how you manage merge conflicts in a team environment.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Why do you want to work as a Software Engineer for the Commonwealth Of Massachusetts?
Why do you want to work as a Software Engineer for the Commonwealth Of Massachusetts?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a time when you had to explain a complex technical concept to a non-technical stakeholder or agency p
Describe a time when you had to explain a complex technical concept to a non-technical stakeholder or agency partner.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle a situation where project requirements change mid-development due to policy or regulatory up
How do you handle a situation where project requirements change mid-development due to policy or regulatory updates?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Tell me about a time you disagreed with a teammate on a technical implementation and how you resolved it.
Tell me about a time you disagreed with a teammate on a technical implementation and how you resolved it.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Give an example of a project where you had to prioritize accessibility or security constraints over speed of d
Give an example of a project where you had to prioritize accessibility or security constraints over speed of delivery.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
Describe your experience with version control systems like Git and how you manage merge conflicts in a team environment.
- 02
Why do you want to work as a Software Engineer for the Commonwealth Of Massachusetts?
- 03
Describe a time when you had to explain a complex technical concept to a non-technical stakeholder or agency partner.
- 04
How do you handle a situation where project requirements change mid-development due to policy or regulatory updates?
How difficult is the Software Engineer interview process at the Commonwealth Of Massachusetts?
Candidates generally report the interview process to be easy to average in difficulty. The focus is less on highly theoretical algorithmic puzzles (like LeetCode hard questions) and more on practical software engineering, systems troubleshooting, collaboration, and situational problem-solving.
Commonwealth Of Massachusetts Software Engineer candidate reports ↗Where are the primary technology hubs located for these roles?
While some roles offer hybrid flexibility, the primary physical offices for state technology teams are located in Boston, Chelsea, and Quincy. These locations house major data centers, agency headquarters, and collaborative spaces for engineering teams.
Commonwealth Of Massachusetts Software Engineer candidate reports ↗What is the typical timeline from the initial application to a formal job offer?
Because state hiring involves formal background checks, civil service documentation, and administrative approvals, the timeline can be slower than in the private sector. It typically takes anywhere from four to eight weeks to progress from the initial recruiter screen to a final offer.
Commonwealth Of Massachusetts Software Engineer candidate reports ↗What makes a candidate successful in this role?
Successful engineers are those who combine strong technical fundamentals with a high degree of empathy and patience. Being able to collaborate across diverse teams, respect established compliance guidelines, and focus on the end-user experience of Massachusetts residents are the keys to long-term success.
Commonwealth Of Massachusetts Software Engineer candidate reports ↗Are there opportunities for junior engineers or interns?
Yes, the Commonwealth frequently hires for junior positions and specialized internships, such as Network Engineering Intern roles. These positions offer competitive hourly rates (typically around $22 USD per hour) and provide an excellent entry point into public sector technology careers.
Commonwealth Of Massachusetts Software Engineer candidate reports ↗What topics does Commonwealth Of Massachusetts test in interviews?
Commonwealth Of Massachusetts interviews most often cover Behavioral Interviewing, Communication Skills, Project Management, Market Research, and Network Engineering (General). The exact emphasis depends on the specific role you apply for.
Commonwealth Of Massachusetts Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Commonwealth Of Massachusetts Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Vercel Software Engineer Interview Guide
Debugging practice for Vercel software engineer prep built on a reproduction you trust, narrowing to the smallest failing input, and changing one variable per run so the result stays attributable.
Spotify Software Engineer Interview Guide
Timed practice for Spotify software engineer candidates who lose time to the clock: short problems taken end to end, then reviewed against a written rubric rather than a passing test run.
Scale Ai Software Engineer Interview Guide
Data structures and algorithms practice for Scale Ai candidates, where stating a bound means stating its precondition: constant-time hash lookup is an average case over keys that spread.
Ramp Software Engineer Interview Guide
Systems practice for Ramp software engineer candidates, weighted toward payments and lending work: the load that actually arrives, the failure modes that matter there, and the invariants a partial outage must not break.