How does Spanner guarantee external consistency across regions?

Cross-region external consistency relies on the fact that TrueTime's uncertainty bound is a physical property of the clock infrastructure, not something tied to any one data center, so every region can independently agree on "has this timestamp definitely passed" without talking to each other for that specific check.

When a transaction commits, Spanner assigns it a timestamp s and then performs commit wait, delaying the acknowledgment until TrueTime's current interval guarantees the real time is past s everywhere, no matter which region a subsequent transaction starts in. Because every region's TrueTime interval brackets the same real time within the same bounded uncertainty (typically single-digit milliseconds), a transaction that begins in Region B after a commit in Region A is mathematically guaranteed to receive a later timestamp, even if B never directly communicated with A's replicas for that write.

Multi-region instance configurations add a further piece: reads can be served from regional replicas using bounded staleness, but any read that must reflect the very latest state still ultimately depends on the leader region's Paxos group, since that's where the authoritative commit for a given split occurs.