The second
redemption.

A digital entitlement can be genuine and still be presented twice. Scarcity becomes operational when the services honouring it can agree which use counts, what remains available and who bears the cost when that agreement fails.

Consider a hypothetical customer who buys one computation of a defined size. The provider issues a signed entitlement accepted at two processing centres. The customer sends the same entitlement to both. Each centre verifies the signature and begins the job. The document was authentic on both occasions, but one purchased job has produced two accepted claims.

The example puts a practical question inside the Digital Scarcity research programme: where does a limited entitlement become a limited service? Published distributed-systems research, Internet standards and institutional economics illuminate different parts of the answer. The argument here connects those sources to redemption, recovery and the economics of digital commerce.

Specify the unit that can be used up

A one-use voucher, a transferable account balance and a subscription are different promises. A subscription may deliberately permit repeated access. A voucher may permit one admission. A computing balance may permit many jobs provided their total authorised consumption stays within the purchased amount. Calling each object a token does not specify the constraint.

For the opening example, suppose the promise is one completed job of a defined size. The relevant invariant, meaning a condition that must remain true, is that one entitlement cannot authorise two distinct completed jobs. Copying its representation should not enlarge that allowance. This concerns the provider’s service boundary; it says nothing about making an already delivered output impossible to copy.

A familiar public specification shows how precisely a one-use rule can be stated. RFC 6749, Section 4.1.2, requires an OAuth authorisation code to be short-lived and rejects its reuse. That requirement applies to authorisation codes, rather than making ordinary access tokens single-use. A specification defines the intended behaviour; implementation evidence must establish how a service handles competing requests.

Authenticity, current authority and consumption

These are three separate checks. Authenticity asks whether the credential passes the issuer’s verification rules. Current authority asks whether the represented permission is still valid. Consumption asks whether accepting this request leaves enough of the entitlement for another request. Passing the first check does not complete the other two.

The Bitcoin white paper makes the corresponding distinction for payments. Section 2 explains why signatures alone do not tell a payee whether an earlier owner has double-spent. Sections 4 and 5 describe proof of work and network rules for accepting a transaction history in which previously spent inputs cannot be spent again. The security analysis is conditional on the stated computational assumptions.

Applied to a service entitlement, the inference is narrower than a claim that a ledger solves every delivery problem. Evidence that a transaction was included in a history does not, by itself, establish that a separate provider delivered the promised service once. The provider needs an explicit connection between the recognised entitlement, the consumption decision and its own execution record.

A fresh check can still leave a race

OAuth token introspection lets a protected resource ask about a token’s active status. The standard’s security discussion identifies a trade-off: caching responses reduces traffic and server load, while stale responses can allow use after revocation.

Even without a cache, a status query is not a consume operation. In the hypothetical computing service, both centres might ask whether the entitlement is unused before either records acceptance. Both answers can be accurate when issued. The error lies in allowing each answer to authorise a separate, later consumption.

For this design, accepting a job and claiming its allowance must form one protected decision, or occur under authority allocated exclusively beforehand. An atomic claim means competing requests cannot each succeed against the same remaining allowance. The service must also define how a repeated request is recognised as the same job, rather than a new purchase or a second fulfilment.

Coordination has a boundary and a cost

Bailis and colleagues’ Coordination Avoidance in Database Systems analyses which operations can preserve specified invariants without coordination. The answer depends on the operations, permitted states and method of combining independently produced results. Some combinations permit independent progress; others do not. Coordination can impose latency and availability costs.

The two-centre example makes the relevant conflict visible. Each isolated centre begins with one available entitlement and accepts one distinct job. Each local record looks admissible. Combining the accepted-job records reveals two uses of the same allowance. Changing the arrangement can change that result: assigning the entitlement exclusively to one centre removes the other centre’s authority to redeem it.

Exclusive allocation has a commercial consequence in this example. A customer at the other centre may have to wait, be redirected or obtain an authorised reassignment. The provider has exchanged unrestricted routing flexibility for a narrower coordination problem. That is a design choice to evaluate, rather than evidence that every scarce digital object requires global consensus for every action.

Gilbert and Lynch’s Perspectives on the CAP Theorem explains the underlying tension for partition-prone systems: atomic read/write behaviour and a response to every request cannot both be guaranteed under its model. This does not prevent useful disconnected work. It requires care about which decisions remain final while communication is unavailable.

Revocation needs to reach the service

A transfer or cancellation can change who should be able to redeem an entitlement. RFC 7009 contrasts self-contained credentials with references to server-held authorisation data. It discusses backend interaction and short-lived tokens as different ways of managing revocation. Section 2.1 also recognises propagation delay.

The commercial implication is to specify the delay between a change of authority and its effective enforcement at every accepting service. Short validity can limit the life of an old credential, subject to clock and validation assumptions. It does not prevent two uses inside that life. Likewise, a record of cancellation is incomplete operational evidence if a disconnected service continues to honour the cancelled permission.

Recording use and delivering value have different failure modes

Suppose the computing centre records the entitlement as spent and then fails before completing the job. The consumption register may remain internally consistent while the customer receives nothing. Reverse the order and a failure after delivery but before recording can leave an apparently unused entitlement available for another job.

This hypothetical failure sequence calls for a recoverable fulfilment process. A durable job identifier, recorded progress, a way to retrieve a completed result and explicit refund or reissue rules can help organise recovery. Their adequacy depends on the actual execution system. Naming an operation idempotent, meaning that repeating it preserves its intended effect, does not make a separate physical or computational action automatically repeat-safe.

The acceptance criteria therefore need both sides of the promise: prevent an extra benefit from a duplicate request, and avoid permanently consuming a valid customer’s entitlement without the promised benefit or a defined remedy. Reconciliation can expose two admissions already granted at disconnected gates; it cannot retrospectively withdraw the service people have consumed.

The economic product includes the enforcement arrangement

Potential applications include prepaid computation, event admission, metered data services and transferable rights to a defined service. Their scarcity has different economic purposes. A ticket allocates limited venue capacity. A computing allowance assigns a budget against costly execution. Charging for another copy of a digital file raises a different question about pricing and access. These examples require separate assessments.

For a commercial comparison, I would count the cost of verification and communication alongside waiting, rejected legitimate requests, recovery work, duplicate delivery and dispute handling. The comparison should identify who bears each loss. A provider’s lower processing expense is not necessarily a lower total cost if customers absorb more failures or administrators perform the missing reconciliation.

My published research on governance and rule change adds an institutional question: who can revise the rules after participants invest in a system? That article distinguishes open admission from authority over rule changes. Applying the distinction here suggests examining who can change redemption limits, override a consumed balance or replace the operator. This application is an interpretation, not a measured result about voucher markets.

Test the second request and the interrupted first one

A useful evaluation would submit the same entitlement concurrently to multiple accepting services, repeat requests after uncertain responses, interrupt execution between recording and delivery, and test transfers or revocations while a service is disconnected. It should record the final customer outcome as well as the state of the register.

The measurements should include distinct benefits delivered per entitlement, unresolved valid claims, time to effective revocation, recovery time, response-time distributions and the cost borne by each participant. Designs should be compared under the same promised service and failure conditions. A fast system that silently changes what a purchase guarantees is answering a different question.

This is an analytical synthesis and a proposed evaluation, not a report of a newly deployed system or new experimental results. The central contribution is to connect the scarcity claim to an observable event: what happens when the entitlement reaches the point of use twice? Following that event through authorisation, consumption, delivery and recovery makes the economics of the promise examinable.