Decide What May Disappear, What Must Survive, and How to Reconstruct Ephemeral State

1. “Ephemeral” is a business classification, not a database product label

AtlasMart can lose a page cache and rebuild it. It cannot lose a captured payment and declare that acceptable because the storage engine was “just Redis.” The architecture must classify each fact by what loss means.

Authoritative state is the source of truth for an invariant or business fact. Reconstructable derived state is a copy that can be deterministically rebuilt from authoritative sources, perhaps with temporary degraded performance. Intentionally ephemeral state may disappear by design, with an explicit user/system consequence such as requiring re-authentication or resetting a rate-limit estimate.

2. Build a disappearance contract

3. Rebuildability requires evidence, not hope

For every derived store, document the source, projection algorithm/version, maximum acceptable lag, rebuild throughput, dependency order, and validation check. A cache that takes six hours to warm while the service SLO allows five minutes is not operationally “disposable” even if the data is theoretically reconstructable.

Plan degraded behavior: bypass cache with strict source rate limits, serve stale-but-safe data, disable expensive features, or warm a prioritized hot set. Test the plan by deleting only isolated disposable lab state—not production data—and proving the rebuild against counts, versions, checksums, or sampled records.

4. Deliberately wrong approach: store coupon redemption only in an evictable cache

AtlasMart wants fast “redeemed?” checks and puts coupon:WELCOME:alice=true only in the cache. Eviction removes it. The next checkout sees no record and grants the discount again. The cache did exactly what an evictable store is allowed to do; the architecture violated the business invariant.

The fix is to make redemption authoritative in durable order/promotion state and optionally cache the decision. Cache loss then changes latency, not truth.

5. AtlasMart lab: total cache loss and controlled reconstruction

authoritative = {
    "order:o-9": {"status":"PAID", "version":7},
    "inventory:sku-7": {"available":4, "version":22},
    "payment:p-9": {"captured":True, "version":3},
}
derived_cache = {
    "product-page:sku-7": {"price":120, "inventory_hint":4, "source_version":22},
    "search:sku-7": {"title":"Atlas Lamp", "source_version":12},
}
ephemeral = {
    "session:s-4": {"user":"alice"},
    "rate:ip-1": {"tokens":2},
}

print("BEFORE CACHE LOSS")
print("authoritative keys:", sorted(authoritative))
print("derived keys:", sorted(derived_cache))
print("ephemeral keys:", sorted(ephemeral))

derived_cache.clear(); ephemeral.clear()
print("\nAFTER TOTAL EPHEMERAL-STORE LOSS")
print("orders/payments/inventory survive:", sorted(authoritative))
print("derived cache size:", len(derived_cache), "ephemeral size:", len(ephemeral))

# Rebuild a product page from authoritative facts; losing a session is accepted degraded behavior.
derived_cache["product-page:sku-7"] = {
    "price":120,
    "inventory_hint": authoritative["inventory:sku-7"]["available"],
    "source_version": authoritative["inventory:sku-7"]["version"],
}
print("rebuilt product page:", derived_cache["product-page:sku-7"])
print("session consequence: user must authenticate again")

print("\nDELIBERATELY WRONG BOUNDARY")
cache_only_coupon_redemptions={"coupon:WELCOME:alice": True}
print("redemption recorded only in evictable cache:", cache_only_coupon_redemptions)
cache_only_coupon_redemptions.clear()
print("after eviction, business fact survives:", bool(cache_only_coupon_redemptions))
print("unsafe outcome: coupon could be redeemed twice")
print("lesson: if loss changes money, ownership, inventory, entitlement, or audit truth, cache-only storage is not an acceptable authority")

6. Production readiness checklist

Record authority owner, durability/replication expectations, backup requirement, RPO/RTO, TTL/eviction policy, rebuild source, warm-up SLO, degraded behavior, security classification, tenant boundary, and observability for every cache namespace. Track cache-loss drills, rebuild duration, source load during warm-up, derived-version lag, and the number of business decisions made from stale data.

Redis Open Source 8.10.0 (July 2026) is an optional implementation reference in this chapter. Redis 8+ can be used under RSALv2, SSPLv1, or AGPLv3. The mandatory labs remain vendor-neutral and do not depend on Redis or its license.

7. Chapter synthesis and bridge to events/CDC

TTL says when data should become logically invalid; eviction says what may be removed under pressure; cache patterns define ownership and update ordering; stampede controls limit correlated miss load; and the disappearance contract says what loss is allowed to mean. These are correctness boundaries before they are performance tricks.

Chapter 20 turns reconstruction and synchronization into explicit data pipelines: change data capture (CDC), application events, outbox patterns, replay, consumer groups, and reconciliation. Those mechanisms are how derived caches/search/read models can stay rebuildable instead of becoming undocumented second sources of truth.