Dual Write

Two writes pretending to be one is the default failure mode of dual-write architectures, and there's a structural fix that makes the drift impossible instead of just rarer.