Harden and measure.

A stampede — the thundering herd — happens when a popular key expires and every concurrent reader misses in the same instant. Each miss would read the source, so the loader is hit once per reader at once. EchoStore closes that by construction, not by a lock. Misses route through the table’s owner, and concurrent misses on one id coalesce onto a single flight: the first caller’s miss launches launch_flight/2; a concurrent miss on the same id finds the flight already in the flights map and joins its waiter list (put_in(state.flights[id], {ref, [from | waiters]}), bumping the coalesced counter). The flight checks L2, falls through to the loader, writes both layers, and the owner replies to every waiter with the one answer.

The moduledoc states the law: “Concurrent misses on a key coalesce onto a single in-flight load … every waiter reads the one answer.” The committed gate proves it: two hundred concurrent cold readers, the loader runs once, one hundred ninety-nine waiters coalesced, every reader holding the one answer. There is no SET NX PX lock here and none is needed — the herd is absorbed by the owner’s single-flight bookkeeping, not by a distributed mutex.

Rows filled together must not expire together, or the TTL itself schedules the next herd. expires_at/1 draws each row’s expiry from ttl ± ttl·jitter: base + :rand.uniform(2 * spread + 1) - spread - 1, where spread = trunc(ttl * jitter). A cohort filled in the same instant spreads its expiries across a band, so the re-fill is a trickle, not a herd. The committed gate shows it: four hundred rows filled in twenty-four milliseconds expire one hundred thirty-eight milliseconds apart at jitter 0.2 — no synchronized re-herd. The sweeper then reclaims dead rows on a fixed tick, so memory is bounded by the declaration, not by luck.

Set the jitter to the herd a surface fears: 0.1–0.2 spreads a cohort across a fifth of its TTL, enough to turn a synchronized re-fill into a trickle. This is the honest mechanism EchoStore implements — expiry jitter plus single-flight — not a probabilistic early-expiration scheme; the early-refresh variant of stampede prevention is the R1.05 module’s territory, and EchoStore’s real answer is the jittered clock.

A cache you cannot measure is a cache you cannot tune. EchoStore.Table.stats/1 returns the counter snapshot plus the live size: hits, misses, fills, l2_hits, coalesced, swept, full_skips, sweeps, coh_applied, coh_stale, and size. Every counter is a :counters slot bumped on the hot path — atomic, lock-free, never a GenServer.call, which is why a hit stays 762 ns. The hit rate is a division: hits / (hits + misses) — the share of reads served without touching the loader.

Run a read load below and watch the counters fill. The readout reports the hits and misses tallies, the hit rate they compute, and the coalesced count under a herd. A hot emoji set kept warm drives the rate up; a short TTL that expires the row mid-load drives it down with extra misses; a herd shows up as coalesced waiters that cost no extra loader run.

Take one read of the hottest emoji set under load: many guesses hit the most-played set as its row expires. The owner receives a herd of misses on one id, coalesces them onto a single flight, and replies to every waiter with the one answer — the loader ran once. Every read, hot or not, bumps hits or misses, so the cache reports its own hit rate through stats/1. Codemojex.Guesses.submit/3 receives the emoji set or {:error, :bad_guess} for a code the round’s keyboard does not expose; the single-flight and the counters live in the cache.

The single-flight confines a hot regeneration to one loader run; the jittered TTL stops the cohort from re-herding; the counters make the cache’s effect a measured number. How the owner monitors a flight and replies to a crashed one is /elixir, not repeated here. With this stage the catalog cache is cached, consistent, hardened, and measured — the workshop’s read path is complete.

The workshop’s four layers are in place. Stage 1 cached the catalog with EchoStore.Table.fetch/3; stage 2 kept it consistent with Coherence.broadcast/enqueue and newer?; this stage hardened the hot emoji set with the single-flight flights map and the jittered TTL, and measured the cache with EchoStore.Table.stats/1. The emoji-set cache now reads through EchoStore, tracks changes, survives a herd on its busiest set by construction, and reports its own hit rate — built entirely from patterns taught in R1.01–R1.06.