Why synchronous global reads turn cloud admission control into a fleet-wide failure domain, and how signed snapshots and cell-local ledgers fix it.