The full picture
| Model | Promise | Cost | Where you meet it |
|---|---|---|---|
| Linearizable | single-copy illusion, real-time ordered | quorum/leader round-trip per op | etcd, ZK, SELECT … FOR UPDATE, compare-and-swap |
| Sequential | same total order everywhere, not real-time | consensus without read coordination | classic replicated state machines |
| Causal | happens-before respected; concurrent = unordered | metadata (vector clocks), no coordination | COPS, MongoDB causal sessions, most chat apps |
| Eventual | convergence if writes stop | none — async replication | DNS, S3 (historically), Cassandra ONE, CDNs |
- The real-time clause is what makes linearizability expensive: if a write completes and then my read starts, I must see it — even from a different client on a different node. That forbids serving reads from a lagging follower without checking, which is why 'read from replicas' is a correctness change, not a performance tweak.
- Causal consistency is the sweet spot most people want: it kills the anomalies users actually notice — a reply appearing before the message it answers, a delete appearing to un-delete. And crucially it is achievable while remaining available under partition, which linearizability provably is not.
- Eventual is a floor, not a design: 'eventually consistent' with no bound is untestable. What makes it usable in production is a stated convergence window (replica lag p99 < 200ms), monitoring on it, and a conflict-resolution rule you chose deliberately.
- Watch the trap of 'strong consistency' — a marketing word, not a model. Ask which one is meant: DynamoDB's 'strongly consistent read' is linearizable per key, not across keys; Cassandra's QUORUM is linearizable only when paired with QUORUM writes and no concurrent conflicts.