Cache Races, Stampedes, And Fencing

Caches introduce races when many misses rebuild together or an older slow writer restores stale data after a newer update.

Why This Matters

TTL alone limits staleness but does not define write ordering, rebuild ownership, or multi-layer invalidation.

Working Model

Caches introduce races when many misses rebuild together or an older slow writer restores stale data after a newer update. Correctness comes from preserving an explicit invariant across every permitted ordering, not from expecting one observed timing.

Practical Rules

  • Update the source of truth before invalidation.
  • Use bounded single-flight or lease-based rebuilds.
  • Attach versions to cache values.
  • Reject stale writers.
  • Keep a TTL as a recovery bound.

Failure Modes

  • Deleting cache before a failed database commit.
  • Using an unbounded lock without expiry.
  • Letting a lease holder write after its lease expired.
  • Purging one layer while another remains stale.

Verification

  • Force simultaneous misses.
  • Delay an older rebuild past a new write.
  • Fail invalidation.
  • Observe hit, miss, age, and rebuild metrics.

What You Should Be Able To Do

After this lesson, you should be able to explain cache stampedes, stale writers, leases, versioned values, and fencing tokens, choose a suitable approach for a real PHP project, and verify the result instead of relying on assumptions.

Practice

Practice: Stop A Stampede

A popular product cache expires under high traffic.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Allow one bounded rebuild owner, serve an acceptable stale value or back off for others, set jittered TTLs, and ensure lock failure cannot block indefinitely.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Reject An Old Rebuild

An old rebuild finishes after a product update.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Carry a source version or fencing token into the rebuild and write only if it is not older than the current cached or authoritative version.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Coordinate Cache Layers

A response passes through APCu, Redis, a reverse proxy, and a CDN.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Map ownership and keys at each layer, update the database first, invalidate affected layers, keep bounded TTLs, and test authenticated variation.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.