Keep it consistent.

EchoStore’s coherence message carries exactly two identities and nothing else: the cached name and the writer’s mint-time version — twenty-nine bytes, id <> ":" <> version (Coherence.payload/2). Everything else falls out of the order theorem: a branded id’s eleven payload bytes sort in mint order, so newer wins is a comparison of two names — Coherence.newer?/2 compares the eleven-byte snowflake payloads, ignoring the namespace — with no coordinator, no lock, and no clock but the one already inside every id.

The dangerous case is not the fresh invalidation; it is the stale one arriving late — a slow lane, a retry, a replay. Newer-wins handles it by construction. On the L1 side, apply_coherence/4 drops the row only when the incoming version is newer than the row’s framed version; on the L2 side, the conditional Lua Coherence.drop_l2/4 reads the framed version, compares payloads, and deletes only if newer — one transition, one script, so a late stale invalidation can never erase a newer row. The same comparison is the idempotence story: applying a version twice answers :stale the second time, with no dedup table anywhere.

Two lanes carry the same twenty-nine bytes, and the cache’s surfaces do not all need the same one. The choice is a trade between latency and durability. The broadcast lane — Coherence.broadcast/4 — is a PUBLISH on the table’s channel (ecc:{<table>}:coh): fire-and-forget, one wire hop, at-most-once. A lost message costs one TTL of staleness — the stage-1 bound. The job lane — Coherence.enqueue/5 — is an enqueue on the table’s coherence queue (ecc.coh.<table>) over EchoMQ’s fair lanes: at-least-once, crash-surviving. The committed gate prices them side by side: the broadcast lane at 72 us, the job lane at 148 us — the guarantee costs 2.1 times the latency.

Pick a surface and a lane below, and the readout reports the delivery guarantee and the staleness exposure each lane gives that surface. A round’s close (its :closed status) or a guess fee needs the durable lane — a stale read here is real-money play, so the job lane earns its cost. A room’s display name tolerates one TTL of lag for a cheaper hop. The right answer is per surface, not per cache, and the table’s declared coherence mode records the choice.

Take one change: a room is re-templated with a new emoji set, and the writer has placed the new value in L2 with a fresh mint-time version. Its one obligation after the store write is one coherence call carrying that version: Coherence.broadcast/4 on the fast lane, or Coherence.enqueue/5 on the durable lane. Every node’s table applies the message newer-wins: the broadcast lane lands on a RESP3 push subscription that drops the L1 row; the job lane lands on a consumer running Table.coherence_handler/1 that calls apply_coherence/4. The next read of that set re-fills from the already-updated L2.

A re-applied version is harmless because application is a comparison, not a log: redelivery on the job lane answers :stale the second time. The provenance machinery is not needed here — the version is the provenance. How the writer commits the store and which surfaces declare which lane is /elixir, not repeated here.

A change reaches the cache. The writer places the newer value in L2, carries the version on a lane, and every node drops its L1 row newer-wins — so the next read re-fills fresh and a late stale message bounces off both layers. Surfaces that cannot tolerate a lost message ride the durable job lane. The cache is now correct under changes — but the one emoji set every guess touches can still send a herd at the loader on expiry. The next dive shows how the single-flight and jittered TTL absorb that herd by construction, and reads the hit rate off the counters.