The allowance stranded
at another service.

A service can refuse a valid customer while the system still has unused allowance. The missing quantity may be authority at the point of use, rather than stock, money or computing capacity.

Consider a hypothetical business that buys 100 standardised computations, redeemable at two processing centres. The provider allocates authority for 70 jobs to the first centre and 30 to the second. Communication between them fails. Twenty requests arrive at the first centre and eighty at the second. Assume both centres have enough machines, each request consumes one unit, there is no other demand, and requests cannot be rerouted between centres during the partition.

If each centre honours only its allocation, 50 requests can be accepted. Another 50 are refused or delayed at the second centre while 50 unused units remain at the first. The provider has protected the quantity sold. It has not made the whole remaining quantity available wherever the customer needs it.

The Digital Scarcity programme asks how a defined entitlement becomes effective control. The second redemption examined competing uses, and the delegation article distinguished a restricted credential from a separate allowance. This article examines a further consequence: distributing authority can make local use dependable while stranding part of the customer's purchase elsewhere.

Allocate the authority before the request arrives

A shared balance is a statement about the whole arrangement. An accepting service also needs authority to reduce it. If two disconnected centres each treat the entire displayed balance as available to them, combining their decisions can reveal more consumption than the purchase permits.

Balegas and colleagues' 2015 SRDS paper develops a bounded counter using ideas from escrow transactions. Replicas hold rights to decrement a counter without violating its lower bound. Operations with sufficient local rights need no cross-data-centre coordination; rights can be transferred through asynchronous communication. The paper describes a Riak-based prototype and evaluates it against strongly consistent alternatives.

The scope matters. The design assumes an asynchronous network and crash failures with persistent memory intact, rather than malicious replicas. Local operations are serialised through conditional writes. It does not make every update everywhere coordination-free. Across a partition, a centre can continue within the rights it already holds but cannot obtain rights across the broken connection. The published evaluation is evidence about that prototype and workload, not a BSV benchmark.

For our proposed service, the allocation is therefore part of what makes the limited purchase enforceable. The customer can copy a credential without creating another unit of admission authority. The provider places the scarce decision in state that an accepting centre must preserve and update correctly.

Distinguish unused allowance from usable allowance

The opening example has three different quantities. One hundred jobs were purchased. Fifty have been admitted under the allocations. Fifty units remain, but none is available at the centre facing the remaining demand. A global account display that says “50 remaining” can be accurate and still be insufficient guidance for the next request.

Under these simplified assumptions, local admissions are the smaller of each centre's allocation and its demand. With allocations 70 and 30 and demands 20 and 80, the total is 20 + 30 = 50. If the provider can safely move 50 unused units from the first centre to the second, the same purchase and the same machines can support all 100 requests. These are illustrative calculations, not measured service results.

The two allocations might have matched yesterday's demand. That does not make them appropriate today. A more even split would improve some demand patterns and worsen others. Keeping a central reserve can help rebalance connected centres but leaves that reserve unusable through a disconnected route. No allocation eliminates the need to specify what happens when demand moves.

This is economically relevant to prepaid computation, multi-site admission and metered services. A provider selling a globally usable allowance should disclose whether temporary restrictions are attached to a location, operator or device. A customer may accept a narrower promise in exchange for reliable local operation. The price comparison should use the promise actually supplied.

Transfer a unit without briefly creating two

A safe reallocation must prevent the sending and receiving centres from spending the same unit. To make that requirement concrete, consider a deliberately simplified transfer model. Before a transfer is deliverable, the sender durably removes the units from its available balance and records a uniquely identified transfer. Until the receiver durably credits that transfer, those units are in transit and neither side may use them.

For a fixed purchase with no new issuance, refunds or cancellations, the accounting condition is: available units at both centres, plus units in transit, plus units already consumed, equal the original purchase. Each quantity must also remain non-negative. This is our explanatory model, not a reimplementation or proof of the published bounded-counter algorithm.

A duplicate delivery of the same transfer must not credit it twice. A lost acknowledgement must not cause the sender to restore its balance while the receiver may already have credited the transfer. Repeating an instruction to create a new transfer is different from redelivering the record of an existing one.

The paper's merge procedure combines cumulative entries by taking their maximum, so repeated state delivery does not multiply rights. Re-executing a transfer operation is a different matter. An application still needs to define how it recognises repeated customer instructions.

A small downloadable executable model checks consumption, transfer creation, delayed delivery and duplicate delivery for a two-centre, three-unit example with at most two transfer instructions. It checks the stated conservation condition across the reachable states of that model. It does not test a network, durable storage, hostile operators or a production implementation. Those boundaries are where engineering verification must continue.

A missing centre has not surrendered its authority

Suppose the first centre becomes unreachable while holding 50 unused units. Declaring those units available elsewhere may restore service quickly. It may also let the old centre accept requests against the same units when it returns. Silence is not evidence that its authority has been extinguished.

Recovery therefore needs a rule that excludes the old authority before replacement authority becomes effective. Depending on the design, that could involve a verified state handover, an enforced expiry or a new authority version that every relevant accepting path checks. Merely labelling a replacement “new” does not stop the previous service from working against its old state.

The programme uses BSV as its chosen common reference for ordering and timing. A proposed allocation transfer can refer to an identified transaction and a declared confirmation policy. The service must still connect that evidence to which local authority is usable. A chain record cannot, on its own, stop an isolated machine from honouring an old permission.

The timing analysis and recovery analysis explain the relevant boundaries. Here their economic consequence is particularly visible: preserving the limit can require leaving some customer allowance temporarily unusable. No deployed BSV quota system is claimed in this article.

Count denial as well as excess use

A service that never overspends can still be commercially poor if it repeatedly refuses legitimate work. Evaluation should count excess admissions, valid requests refused for lack of local authority, time waiting for reallocation and allowance left idle elsewhere. It should also distinguish a missing quota from a missing machine. Moving permission does not create physical capacity.

The cost of stranded allowance depends on demand and timing. If no customer wanted to use the remaining units during the outage, no lost sale follows from the unused balance alone. If a time-sensitive job misses its deadline, restoring the units tomorrow may not restore the lost opportunity. A useful comparison records the customer outcome rather than treating every unused unit as an equal loss.

There are also choices about responsibility. Does the provider guarantee rerouting, compensate a refused request or sell a lower-priced location-bound product? Who pays for the reserve and the work of reallocating it? These are proposed commercial questions, not estimated welfare effects or a claim that one design is always preferable.

My published research on governance and rule change separates open admission from authority over the rules and examines commitment after system-specific investment. Applied here, the question is who may change allocation priorities, reclaim idle rights or alter recovery conditions after a customer has purchased an allowance. This is an application of that institutional argument, not a result demonstrated for quota markets.

Test the demand that moves

A proposed service trial would compare the same total purchase under balanced demand, concentrated demand and demand that shifts during a partition. It would delay a transfer, duplicate its delivery, lose its acknowledgement, restart a sender after a durable debit and attempt recovery while the old centre remains capable of operating. Refunds and additional purchases would require separate authorised transitions rather than unexplained increases in the counter.

The article's contribution is to make the location of authority part of the economic specification of a scarce digital right. Distributed allocation can preserve a numerical promise without consulting a distant service on every use. Its value depends on how often the allocated authority is where demand arrives, and how safely it can move. Making that trade-off observable gives customers a firmer basis for buying dependable access, and providers a clearer target for engineering it.