Master-Only Reads

consistency

Definition

Serve every production read from the primary; replicas exist for failover, backups, and offline export, never for traffic. The rule buys read-your-writes determinism by construction: replica lag cannot corrupt application logic if no application logic ever observes a replica. Adopters state it as law learned two ways — as a policy against a whole class of intermittent, cache-entangled lag bugs, or as the fix for a specific correctness hole where stale reads of coordination state (idempotency records, locks, leases) re-create the very failure the state exists to prevent.

Boundary against read-replica scaling: that pattern spends consistency to buy read throughput and accepts lag as a managed quantity; this one refuses the trade, and recovers throughput elsewhere — typically by sharding the primary, which is why the two patterns travel together. The strongest applications are correctness-critical reads: state whose staleness changes a decision, not just a display.

When it applies

  • Coordination and correctness state — idempotency keys, leases, dedupe records — where a stale read causes a wrong action, not a stale page
  • Sharded fleets where per-primary load is already bounded, making replica read offload unnecessary
  • Systems whose lag bugs have proven intermittent and expensive to diagnose, and whose owners prefer paying in hardware

Tradeoffs

  • Read capacity equals primary capacity: scaling reads means splitting shards or upgrading machines, not adding replicas
  • The replica fleet becomes pure insurance — real hardware serving zero requests on the average day
  • Reads that could genuinely tolerate staleness (analytics, feeds) pay full price unless carved out through a separate path

Seen in

  • Airbnb EngineeringApr 16, 2019

    At Most Once: Orpheus and the Idempotent Payments Library at Airbnb

    Canonical two-company mint with Pinterest as the classmate. Orpheus derives the rule from the sharpest possible wound: idempotency tables on a lagged replica turn a correct idempotent retry into a double charge — 'a few seconds of replica lag equals a double charge.' The response is the pattern in its most literal form: read and write on master only, and recover throughput by sharding the idempotency key itself. Same conclusion Pinterest reaches from a different direction — replicas are for disaster, not for reads.

  • Pinterest Engineering BlogAug 17, 2015

    Shard or Do Not Shard: Pinterest's Hand-Built MySQL Fleet

    Second company, minted here with Airbnb's Orpheus as the classmate. Pinterest states it as operational law — slaves lag, lag breeds strange caching bugs, production never touches a slave; Airbnb derives the same rule from a sharper wound, where a lagged replica read turns a correct idempotent retry into a double charge. Same conclusion from two directions: replicas are for disaster, not for reads.