What consistency forbids
What can no consistency design give, and what does each escape cost?
What this mechanism forbids
Physical and permanent (no engineering removes these):
- Local reads and local writes under any model at or above sequential consistency (
r + w ≥ d). - Linearizable operations cheaper than the delay uncertainty (
u/4,u/2). - Linearizability with total availability under a partition.
- Snapshot isolation, repeatable read, serializability, global uniqueness, or bounded-value invariants under total availability.
- A coordination-free implementation of any non-monotone computation.
Structural (follow from definitions):
- A total order over the standard isolation level names.
- Serializability implying recency, or linearizability implying multi-object atomicity.
- Composition of serializability, of sequential consistency, of per-request quorum levels, or of session guarantees across a component that drops the token.
- An isolation level that prevents write skew without tracking reads.
- Phantom prevention without a snapshot or predicate locks.
- Convergence without either arbitration (losing writes) or an algebra (restricting operations).
- Tombstone collection without global knowledge.
- Causal consistency capturing causality that left the system.
- Recency from
R + W > Nalone.
Epistemic (about what can be known):
- Falsifying "eventually" in finite time.
- Detecting any violation from inside a single node.
- Cheap verification of linearizability.
- A level name meaning the same thing in two engines.
Escapes and what each costs
| Escape | Buys | Pays |
|---|---|---|
| Commute the operation | Level-independence; coordination becomes optional | Only exists where an algebra does; CALM bounds it |
| Single-row constraint | Free enforcement at any level | The invariant must fit in one row |
| Shrink the read-to-write window | up to 10^4 times (typically 10^3) fewer lost updates | Logic must move into the engine |
| Cursor stability / version check | Lost-update immunity | Blocking, or a retry loop with an owner |
| Snapshot isolation | Non-blocking readers, no read tracking | Write skew, and non-compositional analysis |
| Materialize the conflict | Write-skew immunity under SI | False conflicts; it rots as code is added |
| Serializable (SSI) | Compositional correctness | False aborts, read-tracking memory |
| Route reads to the leader | Linearizability, simply | One vantage point: geography and availability |
| Lease-based local reads | Local linearizable reads | An unverifiable clock bound; silent failure past it |
| Bounded staleness | A guarantee you can alarm on | A negotiated number, stated in public |
| Causal+ | Availability with sane ordering | Metadata growing in writers; blindness to out-of-band edges |
| Session tokens | Per-client sanity, cheaply | A token every component must carry, and one eventually will not |
| CRDT | Local reads and writes, convergent | An algebra you must fit; tombstones; a collector needing consensus |
| Partition the slack (escrow) | A bounded invariant without per-operation coordination | Stranded slack; coordination at rate consumption/slack |
| Buy tighter clocks | Shorter commit wait, external consistency | Money, the only axis in a different unit |
| Weaken the level | Throughput and availability | Application code nobody knows they own |
Notice that every row is the conserved-cost rule at work: each "buys" is paid for in the next column, and the payer is often someone who was not in the meeting.
(Why up to 10^4? Moving a read-modify-write from application code, where the gap between read and write is about 1 to 100 ms, into one statement inside the engine, where the gap is about 10 to 100 µs, shrinks the window by a factor of 10 to 10^4, typically about 10^3. By Little's rule, anomalies shrink by the same factor.)