The four escapes and the three currencies

The consolidated escape table

Every escape here is one of four moves. This table is the compression worth keeping.

Move	Instances	What it buys	What it costs
Replace a timing claim with an ordering claim	terms, epochs, fencing tokens, map versions, attempt IDs, version vectors	safety under arbitrary delay	a counter that must be agreed once, and a receiver that must check it
Designate one event to mean n	quorum-committed log entry, ownership cutover, output commit, manifest swap	atomicity without simultaneity	a single point that must itself be atomic, and it breaks when the substrate stops offering one
Batch the coordination	leadership, leases, in-band context, closed timestamps	round trips amortized to near zero	a failover window, or a clock-drift assumption, or both
Restate the problem so coordination is unnecessary	CALM, escrow, UUIDs, commuting commands, semilattice gossip payloads, partial results, geographic ownership partitioning	the round trip disappears	available only when the semantics permit

(Escrow means pre-allocating a share of a budget to each node, so only transfers between nodes need coordination. Closed timestamps are timestamps below which a replica promises no new writes will appear, so a follower can serve reads at them.)

The fourth row has no engineering cost and is used last. This has now been true in three different areas of the platform: declare your intent and reformulate the operation; use immutability and algebra; and here, CALM. It is no longer only an observation about how practitioners behave. It is a structural fact about where the cheap wins sit: all of them are at the interface between the mechanism and the semantics, which is exactly the boundary that no single engineer owns.

The three-currency structure runs through everything above: waiting, wasted work, or weakened semantics. Examples:

Situation	Waiting	Wasted work	Weakened semantics
Tail over a fan-out	quorum wait	hedge	partial result
Read freshness	lease wait	ReadIndex round trip	stale follower read
Snapshot	aligned snapshot	unaligned snapshot	dropped state
Geo-replication	synchronous replication	two writers with conflicts	an RPO (acceptable data loss) accepted at design time

All the casesConstructed case · Ingrid at Tixora

The post-mortem: four problems side by side

After the on-sale, Carmen asked why timeouts, replicas, leases, fences, hedges and budgets were all needed, and Ingrid had one page to show that four problems were one.

Ingrid's page answers Carmen and Jide in five lines.

One problem, not six. Nobody on two machines can see the same "now". The stalled sale, the 28-hour move, the double sale and the slow seat map are four faces of that.
One move. Replace "who is the leader or owner now?" with "who holds the highest epoch?", and make every receiver check it. That is why the twelve seats cannot be sold twice again, whatever the timeout is.
Four kinds of fix. Ordering instead of timing (epochs, fences). One designated event instead of simultaneity (the ownership cutover, the output commit). Batching (leader, lease, in-band deadline). And restating the problem so no one needs to agree (UUIDs for order IDs, escrow for ticket allotments per region, partial results on the seat counter). She ranks the last kind first for the next design, because it is cheapest, and uses it last in practice only because it needs a product conversation with Carmen.
Three currencies. Every time the team wanted to remove a cost, they were choosing among waiting, wasted work and weaker answers. She writes next to each feature which one it pays in, and asks, for any design that seems to pay none, which one is hidden.
What stays unverified. She lists the things nobody can prove from inside the system: that every node holds the same membership, that the seat store checks the fence on every write path, that failures are as independent as the replica count assumes, that hedges are attempt-local, and that "eventually" arrives. Each gets a test, an alarm or a drill. For Jide's question about ten years, she marks FLP, quorum intersection, E[max of N], CALM and the speed of light as permanent, clock bounds and partition defaults as current practice, and cross-AZ pricing as the economics that will change.

Carmen keeps one sentence from the page: the cheapest round trip is the one your data model made unnecessary. The next feature, selling the same tour in Mumbai in 20 ms, starts from that sentence, not from a faster protocol.