One missing present

Ingrid's post-mortem

After the football on-sale, Tixora holds a review. Carmen asks a fair question: "You have told me about timeouts, replicas, leases, fences, hedges and budgets. Is that six different problems, or one?" Jide adds: "And which parts of this will still be true in ten years?"

Ingrid prepares one page. It has to explain why her four problems (the stalled sale, the 28-hour move, the twelve seats sold twice, and the slow seat map) were really one problem, name what cannot be fixed, and mark what is only current practice. This is what she writes.

What this mechanism actually was

The three subjects here looked different: moving bytes (Distribution of data), agreeing on facts (Deciding without observing), and addressing requests (Communication). Underneath all three there is one constraint.

Distribution of data could not move state without a window in which two nodes hold it.
Deciding without observing could not observe liveness, membership or simultaneity at all.
Communication could not tell a lost request from a slow one, and could not bound how stale its callers were.

In every case the missing thing is the same: there is no observable present shared by two machines. Every fact one node holds about another is at least one one-way delay old, and the age is unbounded because the delay is unbounded.

What this mechanism does about it is a single move, carried out three times in three forms. It stops trying to observe the property and defines a checkable substitute, then declares that the substitute is what counts.

Not "leader in fact" but "holder of the votes in term 7".
Not "owner in fact" but "holder of epoch 4 in the shard map".
Not "a global instant" but "a cut no participant can tell from one".
Not "committed in fact" but "acknowledged by a quorum".

Each substitute can be checked locally, on arrival, with no clock and no round trip. And each can be checked precisely because it is an ordering claim and not a timing claim.

That is the whole engineering content of this mechanism. It also explains a curious fact: one data structure appears under eight names. It is a monotonically increasing integer, agreed once by a quorum and then stamped on everything. It is called term, epoch, generation, ballot, view, map version, fencing token and attempt ID. Eight names, one mechanism, because order is the only thing distributed machines can agree on cheaply, so every safety argument is rewritten until it is about order.

Nothing here knows anything about now. It works by replacing every question about time with a question about order, and then paying for liveness with timeouts that are never allowed to touch safety.

What this mechanism forbids

This is the consolidated list. The three parts' lists are collapsed to the items that are actually independent.

Distinguishing slow from dead. This is the generating constraint. Everything below is a consequence.
Deterministic consensus under asynchrony with one crash fault (FLP). It is escaped only by assuming eventual synchrony or by randomizing.
Simultaneity, in any form. There is no global instant, so there is no atomic multi-node action. That is why "one designated event means n" appears everywhere. Only a consistent cut exists, which is observational equivalence and nothing more.
Mutual exclusion over a resource that does not check a token. Leases leak at the boundary by construction. The gap is the holder's own scheduling delay, not the network's.
A safe quorum over a membership set that participants disagree about, and majority availability inside two symmetric failure domains. Both are pigeonhole facts (counting facts about overlapping sets), not implementation limits.
Write throughput from replication, and balance from balancing bytes. R replicas multiply the write work, and only P partitions divide it. And the balancer's proxy (bytes) diverges systematically from the binding resource (often request rate).
Splitting one hot key. No partition function can split a single key. This is the same impossibility described in Partitioning, wearing different clothes.
Escaping E[max of N] by restructuring a gather, or improving a tail by hedging when the slowness belongs to the request.
Bounding client staleness. Non-members are in no protocol, so correctness must live at the receiver.
Coordination-free implementation of a non-monotonic invariant (CALM). This is the one genuine theorem stating when all of the above can be skipped.

The honest ranking. Items 1, 3, 5 and 10 are permanent. Item 2 is permanent but routinely escaped in practice. The rest are permanent given the others.

What will still be true in ten years

The claims of this mechanism age differently, so it helps to sort them into three boxes.

Permanent

FLP.
Quorum intersection and the N ≥ 2f+1 derivation.
E[max of N] for any wait-for-all fan-out, and the fact that percentiles do not combine.
The lease boundary gap, which is caused by the holder's own scheduling delay and so cannot be closed by better clocks.
The impossibility of splitting a single key.
CALM.
The two-symmetric-sites result.
The speed of light: about 10 µs per kilometre of round trip.

Current engineering reality, with direction of travel

Clock error bounds as a usable safety primitive. They are improving fast, and folklore has not caught up.
Partition-count defaults. Cassandra's move from 256 virtual nodes to 16 is the public correction.
EPaxos-class commutativity-aware consensus. It is contested and rarely deployed. It is honest to say it has not won, and wrong to present it as the future.
Parallel replication apply. It is narrowing the lag asymmetry but has not removed it.
Phi-accrual's normal-distribution fit. It is a tunable defect, not a property of the method.

Economic contingency

Cross-AZ per-GB transfer prices. They turn replica placement from a topology decision into a metered one. This is why the cloud answer (two replicas in one AZ plus a witness) differs from the datacentre answer (one local replica, two on one remote rack).
Data residency rules. They behave as a hard placement constraint, and are the first constraint across the platform that engineering cannot trade against at any price.
The economics of witness replicas. Witnesses exist because a vote is free and a copy is not.