WorldSeat — Proof

1 · The headline, measured

Same naive read-then-write code on both backends; the only variable is the database.

Aurora DSQLproduct

oversold · 60 simultaneous buyers, one seat

every single run · Linearizable ✓

same code
only the database
changed

DynamoDB GTfoil

oversold · 60 simultaneous buyers, one seat

this run · eventual consistency, always > 0 · Violated ✗

2 · Falsifiable invariant test (live)

node scripts/stress.mjs hammers the live deployment at concurrency 8/24/48/60 and asserts oversold === 0 on DSQL at every level, and oversold > 0 on the foil. Captured 2026-06-21:

WorldSeat stress test → https://worldseat.vercel.app

Aurora DSQL (strong / serializable OCC) — expect oversold = 0 at every level:
  PASS  c= 8  confirmed= 1  oversold= 0  maxRetries= 0  1235ms
  PASS  c=24  confirmed= 1  oversold= 0  maxRetries= 1  753ms
  PASS  c=48  confirmed= 1  oversold= 0  maxRetries= 1  1194ms
  PASS  c=60  confirmed= 1  oversold= 0  maxRetries= 1  851ms

DynamoDB Global Tables (eventual / LWW) — expect oversold > 0 (the foil):
  OVERSOLD  c= 8  confirmed= 8  oversold= 7  maxRetries= 0  1357ms
  OVERSOLD  c=24  confirmed=25  oversold=24  maxRetries= 0  634ms
  OVERSOLD  c=48  confirmed=44  oversold=43  maxRetries= 0  1008ms
  OVERSOLD  c=60  confirmed=49  oversold=48  maxRetries= 0  1800ms

DSQL max OCC retries observed under load: 1  (OCC aborted-and-retried a real conflict)

RESULT: PASS — invariant held on DSQL at every concurrency level; foil reproduced oversell.

The maxRetries = 1 on DSQL is the proof that two commits genuinely interleaved and the loser was aborted by serializability — not that the app got lucky. The foil's oversold count is genuinely run-to-run variable under last-writer-wins (48 captured · 41 on an independent recheck); what never varies is the pair DSQL = 0 / foil > 0.

3 · Why it can't be rigged in DSQL's favor

Identical app code on both backends — read-then-write with no app-level lock and no conditional update (app/lib/dsql.ts, app/lib/ddb.ts). Only the database executing it differs.
oversold counted from committed ground truth, never app return values — the DSQL op_log and the append-only DynamoDB sales_naive ledger (app/app/api/breakit/route.ts).
Three independent sources shown in the UI: app-believed / ledger-committed / seats-table-shows. Last-writer-wins converges the seats table to one owner and hides the damage; the ledger remembers that N people were each told “you got it.” The gap is the corruption.

4 · AWS console proof account ID masked

Aurora DSQL cluster ACTIVE in us-east-1, peered to us-east-2, witness us-west-2 — Aurora DSQL cluster **ACTIVE** in us-east-1, peered to us-east-2, witness region us-west-2.

DynamoDB seats_naive Global Table with two ACTIVE regional replicas — DynamoDB `seats_naive` Global Table with two ACTIVE regional replicas (the foil).

System diagram: Vercel frontend to backend toggle to Aurora DSQL or DynamoDB GT — Architecture — Vercel (one public URL) → backend toggle → Aurora DSQL (product) / DynamoDB GT (foil).

5 · Everything in one place

▶ Live app (no login)▶ Demo video — 2:57 ▶ Public source repo ▶ EVIDENCE.md (this page, in repo)▶ stress.mjs (the invariant test)