What communication forbids

What this article forbids

Resolving the third outcome. An ambiguous non-answer cannot be made definite by any mechanism here. It can only be made harmless by idempotency.
A bound on client staleness. Clients are not members of any protocol, so nothing limits how far behind their map can be. Correctness must live at the receiver.
Greedy load balancing on a stale load signal without herding.
Tail improvement from hedging when slowness is request-local. The hedge is perfectly correlated and buys nothing for double the cost.
Bounded retry amplification from per-request retry limits under correlated failure; the escape is a fleet-wide retry budget.
Escaping E[max of N] by restructuring the gather. Trees fix fan-in, never the tail.
Partial results over a non-tolerant aggregation. The algebra decides, not the engineering.
A synchronous control-plane dependency with data-plane availability.

Escapes and what each costs

Escape	Buys	Costs	Paid by
Idempotency keys + dedup window	the unknown outcome stops mattering	server-side state with a retention parameter	the callee, and a janitor
Absolute propagated deadline	bounded `W`, therefore bounded `L`; no wasted leaf work	requires unbroken context across every hop	anyone with an async boundary
In-band context	coordination at zero round trips	only for facts interpretable without shared state	nothing: the cheapest escape here
Reject-and-correct at the receiver	clients need never be current	every receiver must check	the server, on every request
Power-of-two-choices	near-optimal balance, no herding	worse than a perfect oracle, which does not exist	nothing real
Subsetting	bounds O(clients × servers) connections	worse balance; reassignment storms	the fleet, at deploy time
Hedging	minimum of k latency draws	k× work on the hedged fraction; useless under correlation	utilization, at the worst moment
Partial results	tail and availability, with no extra work	exactness	the answer's precision
Fail-static data plane	a control-plane outage stops being an outage	operating on stale config, so fences are required	correctness, if the fence is missing

Case, resolvedConstructed case · Ingrid at Tixora

A 2-second page from 50 ms partitions

A seat-map page that waited for 40 partitions had a 2-second p99, and during a brownout the storage nodes kept working on lookups for pages fans had already closed. Where it started: Communication →

Ingrid fixes the seat-map page with four changes.

Hedging, with a budget. She hedges each of the 40 partition requests at the partition's p95 (about 40 ms) to another replica, cancels the loser, and caps hedging at 5% of requests. She first checks the hedge rate. It is 4.6%, close to the configured 5%, so the slowness really is attempt-local (GC pauses and busy disks, not heavy requests). A request that would have crossed the p95 line (5% of requests) now stays slow only if the second attempt is slow too, so the fraction that stays slow falls from 1-in-20 to about 0.05 × 0.05 = 0.0025, or 1-in-400. The page's fraction of slow loads falls well below 33%.
Partial results for the cheap parts. The "seats left" counter and the price heat-map are approximate-tolerant, so the page answers after 38 of 40 partitions and marks the counter as "about". The seat grid itself, which must be exact for the seats you can click, still waits for its partitions. (This is her choice among the three currencies: waiting for the part that must be exact, weakened semantics for the part that may be approximate, wasted work for the slow tail.)
Absolute propagated deadlines. The page sets one deadline, and every hop computes its remaining budget from it. A storage node that receives a lookup whose deadline has passed drops it instead of serving it, so during the next brownout the nodes spend their capacity only on pages someone is still waiting for, and they recover instead of collapsing. (How many times the gateway may retry is a separate policy: retry budgets.)
Reject and correct. The decommissioned node now answers "I no longer own this partition; the owner is node 9, map version 412". Clients refresh their cached map from the rejection, so the error path is the refresh path. She sets a max-connection-age of 5 minutes so that long-lived connections cannot pin clients to old nodes forever. The metadata cluster stays off the request path: SeatKV nodes cache the partition map and keep serving on the last known map when the metadata cluster is unreachable (fail-static), and the epoch fence protects the seats in the meantime.

Carmen asks again whether the network could simply be made reliable. Ingrid answers with one line from this article: a missing reply never tells you whether the work happened, so the system has to make that question not matter.