M1 · Doing the Impossible

The theorem made rigorous.

CAP is not a slogan about picking two of three. It is one instance of a deeper impossibility — you cannot guarantee both safety and liveness in an unreliable system — and reading it that way explains both why the wall is real and how engineers have always walked through doors in it.

This landing states the whole argument once: the two properties, the proof in brief and its harder consensus sibling, and the menu that replaces “two of three” with a design question asked surface by surface. The theory is settled and external (Gilbert & Lynch, Fischer–Lynch–Paterson, Brewer); echd's response is what this course proposes. The heart of the course — segmentation — arrives at M5.

The 2002 proof, made visual · a network split into two groups, a write in p1, a read in p2 — hover a step to walk the argument to its forced choice (the formal proof of Gilbert & Lynch 2002)

step · hover to walk the proof A write completes in p1, the network splits, a read arrives at p2 — and p2 must return a stale answer or never return. Hover a step below to take it one move at a time.

Step 1 · a write completes in p1. A client writes a new value to the first group and the group acknowledges. The two groups still share a link, but the proof needs only the smallest interesting case to follow.

Step 2 · the network splits. Every message between the two non-empty groups is lost. The acknowledged write in p1 cannot propagate; p2 still holds the prior value and has no way to learn of the new one.

Step 3 · a read arrives at p2. A client now reads from the second group. p2 has heard nothing from the writer — and a server has no bound on message delay, so it cannot distinguish a dropped message from a slow one.

Step 4 · the forced choice. p2 must either return the stale prior value — violating consistency — or never return, violating availability. The corollary sharpens it: delay alone suffices, and delivering the held messages after the read still leaves the execution inconsistent.

Hover or focus a step to walk it; click to pin. Without scripting, all four read in sequence and the figure shows every marker at once.

§1

The two properties

mesh.1.md · Gilbert & Lynch 2012

The result is cleanest when its two halves are named for what they are. CAP is then one instance of a general fact about unreliable systems — which is what lets it transfer to settings far from a web register.

Consistency

A safety property

Nothing bad ever happens: every response is correct with respect to the writes that preceded it. A safety property is violated by a single wrong answer.

stale answers are the failure · correctness

Availability

A liveness property

Something good eventually happens: every request eventually receives a response. A liveness property is violated by an answer that never comes.

silence is the failure · termination

The edge

Asynchrony

A server has no bound on message delay, so it cannot distinguish a partition from a slow link — and so cannot promise to be correct only during partitions and responsive the rest of the time.

no message-delay bound · one instance of safety vs liveness

Why this framing carries the course: stating CAP as safety against liveness makes the trade legible. A surface that must never give a wrong answer is choosing safety; a surface that must always answer is choosing liveness; and under a partition, no surface can hold both. The first dive, M1.1, makes both properties precise and shows where the asynchronous model bites hardest.

§2

The proof, briefly

mesh.1.md · Gilbert & Lynch 2002

The 2002 proof fixes the smallest interesting case. Split the network into two non-empty groups and lose every message between them; let a write complete in the first group, then read in the second. The reader has heard nothing from the writer, so it must either return the stale prior value — violating consistency — or never return, violating availability. The emulator above walks exactly this execution.

A corollary sharpens it to the asynchronous model. Since the reader cannot distinguish a dropped message from a delayed one, delay alone suffices: delivering the outstanding messages after the read still leaves the execution inconsistent — the wall stands even when no message is ultimately lost.

§3

The harder sibling — consensus

mesh.1.md · Fischer–Lynch–Paterson 1985

The register impossibility has a steeper sibling. Fischer, Lynch, and Paterson proved that consensus — every process agreeing on one value — is unsolvable by any deterministic protocol in an asynchronous system where even one process may crash; there is always an execution, with no actual failure, in which the protocol never decides.

The consequence for design is direct: agreeing is strictly harder than reading a register, so reaching for a quorum vote does not escape the trade — it relocates it. echd's consistency-first surfaces answer by avoiding the vote entirely, with a single owning writer per instrument, which M2 builds. The common case then pays no quorum, and the trade is segmented rather than defeated. The full proof and the register argument are the second dive, M1.2.

§4

The menu, not the wall

mesh.1.md · Brewer 2012

The popular gloss — keep two of the three — was misleading from the start, because it oversimplifies tensions that are continuous and local rather than binary and global. Partitions are rare, so a system has no reason to forfeit consistency or availability when the network is healthy; and the choice between them can be made many times over, differing by subsystem, by operation, even by the specific data or user.

The useful frame is operational, in three moves. The operations a surface permits during a partition are set by the invariants it is willing to sacrifice — and that is the menu the four coping strategies fill in.

Detect the partition. A surface first recognizes that communication has been lost — the entry condition. Until then it runs as normal, because partitions are rare and there is no reason to pay for one that is not happening.

Enter a partition mode. The surface either limits operations to protect consistency, or proceeds while logging enough to repair afterward. Which it does is set by the invariants it is willing to sacrifice for the duration.

Recover once communication resumes. The surface reconciles divergent state and restores its invariants. The cost of recovery is part of the design, not an afterthought — it is paid against what was logged in the partition mode.

Segment the trade across surfaces. Because the C/A choice is per-subsystem, the dominant strategy is to assign each surface its own trade rather than choose once for the whole. That is the architecture echd is built on — the heart of the course, M5.

Hover or focus a move to read it; click to pin. Without scripting, all four read in sequence.

The third dive, M1.3, walks the four coping strategies as the practitioner's menu, and the design question they pose: not which two of three to keep, but what each surface should do under a partition.

§5

The three dives

M1.1 · M1.2 · M1.3

This landing states the argument end to end; each dive takes one movement to the depth a comprehensive treatment needs.

M1.1

Safety and Liveness

Consistency as a safety property, availability as a liveness property, the asynchronous model, and the general trade CAP is one instance of.

diveread M1.2

The Proof, Briefly

The two-group partition argument and its corollary, then the consensus impossibility (FLP) as the harder sibling.

diveread M1.3

The Menu, Not the Wall

The four coping strategies as the practitioner's menu, and why the real decision is per-subsystem behavior under partition.

diveread

§6

The doors

course-to-course references

/bcs

The Branded Component System

The law in three clauses and the 14-byte branded-snowflake identity contract, proven by frozen transcripts across five runtimes.

this course rests on the contract for the seam that holds a segmented system together across surfaces that chose different trades.

/echomq

EchoMQ — the protocol, in depth

The Valkey-native bus and stream tier, rung by rung: the keyspace, the Lua inventory, the conformance suite.

the availability-first delivery and log surfaces of the mesh door here — M3 and M6.

§7

References

sources · related

Sources

Gilbert & Lynch (2012) — Perspectives on the CAP TheoremCAP as one instance of the safety-versus-liveness impossibility — consistency a safety property, availability a liveness property — and the four coping strategies
Gilbert & Lynch (2002) — Brewer's Conjecture and the Feasibility of CAPthe formal proof: split the network, lose messages, and a write then a read force a choice between a stale answer and no answer; the corollary extends it to delay alone
Fischer, Lynch & Paterson (1985) — Impossibility of Distributed Consensus with One Faulty Processdeterministic consensus is unsolvable in an asynchronous system with a single crash failure; every protocol admits an execution that never terminates
Brewer (2012) — CAP Twelve Years Later: How the “Rules” Have Changedcalls “2 of 3” misleading, notes partitions are rare and the C/A choice fine-grained, and frames partition handling as detect, enter a partition mode, and recover

Echd, In Depth — the coursethe landing: the thesis, the four-strategies signature, the stack, and the chapter map
The Branded Component Systemthe law and the 14-byte identity contract the seam rests on
EchoMQ — the protocol, in depththe Valkey-native bus and stream tier the availability-first surfaces use
Echo Persistence — Durable statethe durable floor beneath the bus