Multi-region price invalidation

An e-commerce catalog service caches product price + availability in a multi-region cache (one cache cluster per region, 5 regions). A price change must propagate everywhere within ~10 seconds, and you must never serve a stale-cheaper price after the change is acknowledged. Writes happen in one primary region. Design the invalidation pipeline and explain how you handle out-of-order invalidation messages and a region whose invalidation bus is temporarily down.