A read replica can cache a new Git object yet still return an older state when resolving the current branch. Object content and the reference that selects it are separate kinds of state. A cache hit establishes data availability; reference freshness determines which state the request is entitled to receive.

GitHub’s October 21 architecture disclosure also describes virtual read replicas warming from object storage. Unlike the morning article about write coordination, this investigation concerns the read path: which state a background-synchronized replica has reached and which reading contract that state satisfies. 中文版.

The read path has its own constraint

The original engineering article, discovered through Google News, describes virtual readers warming from object storage and reconciling in the background, initially fitting some reading workloads rather than all. Independent read scaling should not obscure that boundary.

Instead of guessing an unpublished GitHub protocol, define a weaker teaching contract. A request supplies the minimum acceptable version of one reference. A replica must return a state meeting that bound, obtain sufficient state, or fail explicitly. This is not an actual GitHub or Git-command parameter.

The model uses local dictionaries. It implements neither distributed agreement nor a proof of global linearizability. Its purpose is to test object presence separately from reference-state requirements. The guarantees of a real service require its protocol and end-to-end evidence.

Content stays identified while a pointer changes

The Git object model stores objects identified by content. Historical content can remain in the object database without being the content selected by a current reference. Reading an old object intentionally differs from incorrectly treating it as the current branch.

Suppose labels old and new are both cached, but reference A still records version 1→old. The authoritative state is version 2→new. Reading new by its object identity can succeed while resolving A through the stale local mapping returns old. Both requests use the same object cache; whether the result is acceptable depends on the question asked.

Versions 1 and 2 are artificial per-reference order labels, and old/new are not real object hashes. Comparing Git hashes numerically cannot establish freshness. A single repository-wide counter also should not silently replace the distinct state of every reference.

State what a minimum-version check can establish

If a caller knows A must have reached at least version 2 but is routed to a version 1 replica, the model requires refreshing reference metadata. If even its authoritative input supplies only version 1, it returns Unavailable instead of presenting a cache hit as a satisfied request.

Conversely, minimum version 0 allows the model to return cached version 1 even while the authoritative input is at 2. This makes the limitation concrete: it is a conditional lower-bound contract, not a complete guarantee that every client always observes the latest acknowledged write.

Suppose a writer has acknowledged version 2, but another reader never received that information and still requests bound 0. Returning version 1 passes this model while failing a stronger promise that reads beginning after acknowledgement cannot return an older state. The lower-bound test is one acceptance layer, not proof of global reading guarantees.

A caller’s known bound, a service-wide freshness promise and session-monotonic reads are different requirements. A real integration cannot substitute one for another. When a strong read is required, use a path that actually supports it rather than setting a local bound to zero so a test passes.

The selected reference must point to available content

Metadata can tell the replica that A selects a new object before that object enters its local cache. The reader may obtain it from an allowed source. If the required object is unavailable, it must not silently return old while reporting a successful version 2 read.

An authoritative source is an input assumption in this model, not a property established by the function. If a production fallback itself reads lagging metadata, changing the source’s name does not automatically provide a freshness guarantee.

The example advances its local reference only after finding the selected object in either its cache or authoritative object set. Its failure case therefore does not leave a newly accepted cache state that the model treats as fully readable while lacking its content. This is a local update-order convention, not a crash-recovery protocol.

A production read may require multiple objects: trees, parents and contents have dependencies. Their availability requires the concrete protocol’s guarantees. The program does not model that graph and does not claim that finding one object label establishes a complete readable repository.

Twelve checks exercise failure paths

The program checks an old value permitted by a weak bound, refresh under a stronger bound, independent filling of another reference, an unavailable requested version, a missing reference and a missing selected object. After the object failure it verifies that local reference state was not incorrectly advanced. All labels and dictionaries are fictional.

# A per-reference lower-bound teaching contract, not GitHub consistency.
from copy import deepcopy
class Unavailable(Exception): pass

def read(ref,minimum,cache,store):
    if type(minimum) is not int or minimum<0:
        raise ValueError('nonnegative integer version required')
    candidate=cache['refs'].get(ref)
    if candidate is None or candidate[0]<minimum:
        candidate=store['refs'].get(ref)
    if candidate is None or candidate[0]<minimum:
        raise Unavailable('reference state below requested bound')
    epoch,oid=candidate
    if oid not in cache['objects']:
        if oid not in store['objects']:
            raise Unavailable('required object unavailable')
        cache['objects'].add(oid)
    cache['refs'][ref]=candidate
    return epoch,oid

store={'refs':{'A':(2,'new'),'B':(1,'other')},'objects':{'old','new','other'}}
initial={'refs':{'A':(1,'old')},'objects':{'old','new'}}
c=deepcopy(initial)
assert read('A',0,c,store)==(1,'old')  # Allowed by this weak bound only.
assert read('A',2,c,store)==(2,'new')
assert c['refs']['A']==(2,'new')
assert 'old' in c['objects']  # Old immutable content may remain cached.
assert read('B',1,c,store)==(1,'other')
assert 'other' in c['objects']
assert read('A',1,c,store)==(2,'new')
for ref,bound in [('A',3),('missing',1)]:
    try: read(ref,bound,deepcopy(initial),store)
    except Unavailable: pass
    else: raise AssertionError('unsatisfied bound accepted')
broken={'refs':{'A':(2,'absent')},'objects':set()}
c=deepcopy(initial)
try: read('A',2,c,broken)
except Unavailable: pass
else: raise AssertionError('missing object accepted')
assert c['refs']['A']==(1,'old')
assert 'new' in initial['objects'] and initial['refs']['A']==(1,'old')
print('12 read-contract checks passed')

No network request or Git operation runs, and no cache latency is measured. Unavailable is a teaching exception. The input supplies version order; the function does not implement the authoritative system that produces it. Untrusted inputs cannot be turned into correct history by this reader alone.

Observe more than object-cache hits

Record object hits, reference-metadata refreshes, waits for sufficient state, unsatisfied conditions and the version actually returned as separate outcomes. An object-hit rate can conceal reference lag. A successful-response counter can likewise conceal whether the caller’s bound was honored.

For replay tests, read the same reference after an acknowledged update under the application’s contract, then deliberately vary the replica and cold or warm cache. Testing only unchanging historical objects cannot establish the behavior of a changing branch mapping.

Timing metrics also need clear boundaries. Faster warming, quicker object retrieval and shorter metadata waits are different improvements. Additional replicas can accelerate object lookup while adding reference-synchronization waiting. Measure the complete request instead of extrapolating from one favorable stage.

Deletion, force updates and recovery need further tests

This example omits tombstones, leadership epochs and concurrent failures. Whether an old replica can mistakenly resurrect a deleted reference is a separate essential test. A happy path in which a reference only moves forward cannot establish correct deletion behavior.

Force updates cannot be reduced to commit ancestry either. A new reference state can point into a different history. Acknowledgement order and Git-history topology are not the same ordering. The artificial sequence labels record accepted state order, not larger content or longer history.

A consistent view across references requires a defined snapshot or transaction scope. Individually satisfying several lower bounds does not establish that those references came from one instant. This complements the morning analysis of per-reference write coordination: useful independent parallelism does not imply a unified snapshot for every combined operation.

Ordinary backends can reuse the distinction between immutable cached content and a mutable index. Make each test say whether it reads historical content or the current named state. Establish that contract before selecting caching, synchronization or fallback strategies.

If these reference/object failure cases help diagnose cached-but-stale results, voluntary support through the section below is welcome. The reusable method checks both the requested state and the content needed to serve it.

Sources and article date

GitHub architecture disclosure October 21 · Git objects

Discovered through Google News and checked against the original announcement, published before the planned slot. Examples and diagrams are original teaching material, not a product benchmark or real account operation. The planned article date is 2026-10-22 at 22:00 Beijing time. Scheduling or actual public release is verified separately; a backfilled date does not imply earlier publication.