Consistency Model Spectrum

## What a consistency model promises A consistency model is a contract: given a system that replicates the same piece of data onto multiple nodes (for availability, geographic locality, or throughput), the model tells you what values a read is allowed to return relative to the writes that have happened. Because writes are hard to apply to every replica in zero time, every real distributed system has to pick a point on a spectrum that runs from the strongest model to the weakest: - **Linearizability** — the strongest: every read reflects the most recently completed write, as if there were only one copy of the data anywhere. - Down through **sequential consistency**, **causal consistency**, and a family of client-centric guarantees (read-your-writes, monotonic reads). - And finally **eventual consistency** — the weakest: no ordering guarantee at all, only a promise that replicas will eventually agree once writes stop arriving. ## How the writes actually travel Mechanically, an eventually consistent system typically accepts a write at whichever replica (or partition leader) the client happens to reach, acknowledges it immediately, and then propagates that write to the other replicas asynchronously — via a replication log, a gossip protocol, or a periodic anti-entropy repair process running in the background. Because propagation isn't instantaneous, there is a window, often milliseconds but sometimes much longer under load or partition, during which different replicas hold different values for the same key. If two replicas each accept a concurrent write to the same key (for instance during a network partition, when neither side can see the other), the system needs a conflict-resolution strategy once they reconnect: - **last-write-wins** — keep whichever write has the higher timestamp, discarding the other; - **version vectors** that detect the conflict and hand it to the application to merge; - or **CRDTs** (conflict-free replicated data types) whose merge function is mathematically guaranteed to produce the same result regardless of the order updates are applied. Whatever the strategy, the property the model promises is **convergence**: if no new writes arrive, every replica eventually reaches the same state. Convergence does NOT promise how long the staleness window lasts, and it says nothing about what any individual read sees while replicas are still catching up. ## Why the design exists This design exists because of a fundamental tension formalized by the **CAP theorem** (and its more nuanced successor, **PACELC**): during a network partition, a system must choose between staying available for reads and writes on every side of the partition, or refusing operations to preserve one consistent view. Even without a partition, coordinating every operation through a quorum or a single leader to guarantee linearizability adds a network round-trip's worth of latency to every request — expensive when replicas are spread across continents. Eventual consistency sidesteps this: any replica can accept writes independently and serve reads locally, so latency stays low and the system stays available even when parts of the network can't talk to each other. ## The trade-off, in both directions The trade-off is symmetric, and both sides carry a real cost. | Model | What it buys | What it costs | |---|---|---| | **Eventual consistency** | buys low latency and continued availability during partitions | but it pushes complexity onto the application: developers must design for the possibility that a read returns stale or superseded data, that concurrent writes can silently conflict, and that a naive last-write-wins policy can lose an update nobody meant to lose | | **Strong consistency** | buys predictable, easy-to-reason-about behavior | but pays for it in coordination latency and reduced availability, since a replica that can't confirm it's up to date may have to refuse a read or write rather than risk answering incorrectly | ## Failure signatures in production - In production, the classic failure signature of eventual consistency is a user-visible 'flicker': a user updates something, immediately re-reads it, and briefly sees the old value because their read landed on a replica that hasn't caught up yet — support tickets often describe this as 'my change didn't save' even though it did. - A second failure mode is a genuinely lost update: two concurrent writes to the same key, resolved by last-write-wins based on wall-clock timestamps, where clock skew between nodes causes the 'wrong' write to survive from the user's perspective. ## Systems you already know - A well-known real-world example is **Amazon's original Dynamo** system (the 2007 paper that inspired DynamoDB, Cassandra, and Riak): it is eventually consistent by default, favoring availability, and offers strongly consistent reads as an explicit opt-in for callers willing to pay the latency cost. - **DNS** is another classic eventually consistent system — updates to a domain's records propagate to resolvers worldwide over the record's TTL, and during that window different users legitimately see different answers for the same query.