What distributing data forbids
What this article forbids
- Write throughput from replication. R multiplies write work; only P divides it. Any plan to fix write capacity by adding replicas is arithmetic-illiterate.
- Splitting a single hot key. The same impossibility as above: no partition function separates a key from itself.
- Load balance from balancing bytes. The measurable proxy and the binding resource are different quantities, and the gap is systematic.
- A rebalancer that converges faster than bytes ÷ throttle, and therefore any rebalancer that can track fast-moving load.
- Unambiguous ownership without a fenced, versioned map. Clients will hold stale maps; the only sound design rejects on arrival instead of trying to refresh in advance.
- Independent replica failure inside one failure domain, a limit of durability's (placement across failure domains).
- Local-latency writes with a single global serialization point at intercontinental distance. Speed of light, permanent.
Escapes and what each costs
| Escape | Buys | Costs | Paid by |
|---|---|---|---|
| Partitioning | capacity, throughput, quadratic recovery | metadata, fixed per-partition cost, a count you must choose before you know | the operator, later |
| Replication | availability, durability, read capacity | R× writes and R× storage | every writer, always |
| Split the replica roles (witness, learner) | intersection without storage, or storage without votes | more configuration surface; one more thing to get wrong | the operator |
| Flexible quorums | tune write cost against election cost | election availability, or write latency: pick | whichever you shrank |
| Fixed partition count | resharding becomes pure reassignment | a number chosen against unknown growth | future you |
| Throttled copy-then-cutover | reversibility and unambiguous ownership | hours of convergence, peak footprint above steady state | the disks you were trying to relieve |
| Follower reads at a timestamp | read scale without unbounded staleness | a wait instead, plus a closed-timestamp mechanism | the reader, visibly |
| Geographic ownership partitioning | local-latency writes and a single order per key | cross-region access for anything spanning homes | the rare global query |
| Give up single ownership | local writes everywhere | conflicts you must now define away | exactness |
The two escapes with the best ratios, splitting the replica roles and converting staleness into a wait, are both cases of refusing to let one number stand for several independent things. That is the practical signature of this article: replication factor, quorum size, vote count and read eligibility are collapsed into a single knob by default, and most of the available headroom is in separating them.