Promises versus assumptions in database fault tolerance