What distributed consistency forbids

What this group forbids

Local reads and local writes under any model at or above sequential consistency (r + w ≥ d).
Linearizable operations cheaper than the delay uncertainty. This is permanent, not an engineering gap.
Causal consistency capturing causality that left the system.
Convergence without either arbitration (which loses writes) or an algebra (which restricts operations).
Falsifying an "eventually" claim in finite time, and so monitoring or alarming on one.
Composition: of sequential consistency, of per-request quorum levels, of session guarantees across components that do not carry the token.
Tombstone collection without global knowledge.
Recency from R + W > N alone.
A CRDT enforcing an invariant that is not preserved under merge.
Noticing any of the above from inside a single node.

Escapes and what each costs

Escape	Buys	Pays
Route all reads to the leader	Linearizability, simply	One vantage point: geography, availability, a failover story
Lease-based local reads	Local linearizable reads	An unverifiable clock bound; silent failure past it
Read-index / quorum read	Linearizability without leases	One to two round trips, a write on the read path
Bounded staleness	A guarantee you can alarm on	An explicit, negotiated staleness number
Causal+	Availability with sane ordering	Metadata that grows with writers; blindness to out-of-band causality
Session tokens	Per-client sanity, cheaply	A token every component must carry, and one that will not be carried
Sticky routing	Session guarantees without tokens	A load-balancing constraint that fights failover and scaling
LWW	Convergence with no metadata	A silently discarded write, arbitrated by clock skew
CRDT	Local reads and writes, convergent	An algebra you must fit into, tombstones, and a collector needing consensus
Escrow / bounded counter	A bounded invariant without per-operation coordination	Coordination at reservation exhaustion; unusable reserved quota
Per-request tuning	The split chosen where it is known	Non-composable guarantees; the weakest pairing governs

Case, resolvedConstructed case · Anika at Pebble

The old name comes back after a refresh

A saved display name flipped back to the old one after a new load balancer arrived, reward points vanished when two phones added at once, and an N = 3, R = 2, W = 2 'strong' store let a read go backwards. Where it started: Sessions, convergence and quorums →

The name that flipped back. The new load balancer sent the second request to a replica that had not yet applied the write, and the client held no token. Fix: the write returns a log position; the app sends it with every read; the router chooses a replica whose replay position is at least that value, or falls back to the primary. Read-your-writes and monotonic reads are restored. She rejects sticky routing because it would fight Tomás's autoscaling. She also writes down who owns the token: the mobile client library, not the load balancer team.
Lost points and dropped profile edits. The points counter becomes a PN-counter (per-replica slots merged with max), so concurrent additions merge instead of overwriting. The profile object keeps LWW, because a display name is an idempotent snapshot, but Anika knows device clocks decide the winner and accepts it for this one field. For "points must never go negative" she uses a bounded counter, with quota per region, because a plain counter cannot enforce a bound. She schedules the tombstone collector and adds an alarm for "oldest uncollected tombstone", since one offline replica blocks causal stability.
"Strong" at R=2, W=2, N=3. The setting gives overlap, not recency. Without a write-back round and version arbitration, a read can go backwards, and a failed write may reappear. The wiki line is replaced by: "overlap only; monotonic reads need the session token." For the notes feed she adds consistent prefix (replies must not precede their messages) and states a staleness bound in the SLO.