When we run flush during a merge (say between

{A,B} and {C,D}), then the flush protocol is run only when installing the new merge view {A,B,C,D} in both subgroups individually, e.g. flush is run for {A,B}

and for

{C,D}. If the flush in {C,D}

completes sooner than the one in

{A,B}, C and D will be able to send messages during {A,B}

's flush phase, thus violating the properties of flush.

The change should be as follows:

• A merge between the 2 subgroups is detected
• If flush is enabled, run the flush protocol in {A,B}

  and

  {C,D}

  , before the new view V2=

  {A,B,C,D}

  is installed

• Install V2
• When the view installation is complete, ie. A and C have acked it, only then complete the flush and allow members to resume message sending