Coalescing misses without stale leaders

A process-local single-flight group suppresses duplicate work within that group, not across all processes or regions. Its key must preserve the same tenant and authorization boundaries as the cached result. Joining unrelated requests because their URL looks similar can repeat a cache-key leak before anything is stored. A follower's cancellation also need not imply that every other waiter should lose the shared computation; choose separate waiter and producer lifetime rules deliberately.

Waiters consume memory, connections, and deadline budget. A slow leader can collect a large crowd even when origin QPS falls. Bound waiting and offer a documented outcome such as a permitted stale response, a retryable error, or independent fallback only when capacity permits. If every timed-out follower immediately starts a new origin operation, duplicate suppression can collapse into periodic waves. Measure concurrent producers and waiters, not merely the number of successful cache fills.

A distributed lease can let one refresher proceed temporarily, but the process may pause beyond its lease and later resume. A new leader might already have fetched and published a newer value. Expiry of the old lease does not prevent that old process from issuing a write. Publication needs a condition checked atomically at the storage boundary, such as a current generation token and source-version guard. Releasing a lease must also verify ownership rather than deleting a successor's lock.

Distinguish fencing the refresh generation from proving data freshness. A newer lease holder can still read a lagging origin replica, so a larger lease token does not necessarily mean a newer source value. If freshness requires source ordering, carry a trustworthy source version or validate against authoritative state. On cache eviction or restart, preserve or reconstruct the guard needed to reject stale publication; forgetting the guard can allow a delayed result to become current again.

Decide how a failed refresh ends the shared call and how retries are scheduled. Jitter and backoff reduce synchronized retries but do not create origin capacity. Cache a permitted failure outcome only under an explicit short negative policy; do not accidentally turn a transient permission or transport error into authoritative nonexistence. Exercise leader crash, delayed success, lease takeover, canceled followers, and a cache reconnect with a cold key. Verify both returned values and origin work during those transitions.

The queue lab models only aggregate work pressure. Reset and set both λ=4, μ=2, predict backlog growth from four and Step. Reset and re-set λ=2, μ=3, predict decline, then Step. It has no keys, leases, leaders, or waiters, so it cannot demonstrate single-flight correctness. Interpret reduced arrivals as a hypothetical result of successful coalescing, then state how real producer and waiter metrics would verify that reduction without assuming duplicates vanished across process boundaries.