Flashcard deck

Two to five cards are written per completed topic, in front,back,chapter format. The deck lives at output/flashcards.csv in this directory and is reproduced below so it is readable without leaving the book.

How to use it

Import into Anki as a CSV with a comma field separator and three fields mapped to Front, Back and a tag. Or use it as a written self-test: cover the right column, answer out loud, and only then look. Reading a card and thinking "yes, I know that" is recognition, not recall, and recognition is not what an interview measures.

The cards are deliberately verbose on the back. A three-word answer is easy to recall and useless in a room; the backs are written at roughly the length you would actually speak.

The deck

front,back,chapter
"What does Kafka exactly-once actually guarantee?","At-least-once delivery plus deduplication plus atomic visibility, scoped to Kafka. Idempotent producer dedupes retries by PID and sequence number; transactions make output writes and the offset commit atomic; read_committed consumers respect the last stable offset. Anything outside Kafka needs its own idempotency key.",04-streaming-apis
"Why must max.in.flight.requests.per.connection be <= 5 with an idempotent producer?","The broker only remembers the last five sequence numbers per producer per partition. With more in flight, a retry can arrive after the window has moved and the broker cannot tell a duplicate from a gap.",04-streaming-apis
"Consumer lag is climbing but the processor is healthy and error-free. What do you check?","The last stable offset. An upstream transactional producer with an open transaction blocks read_committed consumers past it, so lag climbs while errors stay flat.",04-streaming-apis
"What is the default concurrency of Reactor's flatMap, and why is that a problem?","256, which is the Queues.SMALL_BUFFER_SIZE constant rather than a considered limit. Against a downstream sized for 20 concurrent calls it is a self-inflicted load test. Always pass an explicit concurrency derived from the downstream's capacity via Little's Law.",04-streaming-apis
"flatMap vs concatMap vs flatMapSequential","flatMap: concurrent, output in completion order. concatMap: one inner at a time, source order, no concurrency. flatMapSequential: concurrent like flatMap, output buffered into source order.",04-streaming-apis
"Why does an L4 load balancer break gRPC?","gRPC multiplexes RPCs over one long-lived HTTP/2 connection, and an L4 balancer picks a backend once per connection. All of a client's RPCs pin to one backend and newly scaled pods receive nothing.",04-streaming-apis
"Four fixes for gRPC load balancing","Client-side round_robin over a headless service; an L7 proxy or mesh that balances per stream; xDS lookaside balancing; or MaxConnectionAge on the server so connections recycle.",04-streaming-apis
"Why is prefill compute bound and decode memory bandwidth bound?","Prefill does O(sequence length) FLOPs per byte of weight read; decode does O(batch size). The H100 ridge point is around 300 FLOPs per byte, so prefill sits right of it and decode far left.",05-ai-llm
"KV cache size formula","2 x layers x kv_heads x head_dim x seq_len x batch x bytes_per_element. Llama 3 70B fp16 is 320 KiB per token, so 2.5 GiB for an 8k context.",05-ai-llm
"What limits concurrency in LLM serving?","KV cache memory, not weights and not compute. Weights are a fixed cost paid once; cache is the per-user cost and scales with context length.",05-ai-llm
"The one test that splits a RAG failure in five minutes","Manually place the known-correct passage in the context and re-run. Answer becomes right: retrieval bug. Answer stays wrong: grounding bug.",05-ai-llm
"Why is a reranker the wrong fix for low recall?","A reranker reorders what retrieval returned. If recall@50 is 0.6, the ceiling after reranking is 0.6. Fix the first-stage retriever, then rerank for precision at small k.",05-ai-llm
"Three biases of LLM-as-judge, and their mitigations","Position bias (randomise order), verbosity bias (normalise or instruct against length), self-preference bias (use a different model as judge).",05-ai-llm
"Why can a container using 35 percent of its CPU limit still be throttled?","Throttling is a function of instantaneous parallelism against a 100 ms quota window, not of average utilisation. A 1 CPU limit with 16 runnable threads burns the quota in 6.25 ms and freezes for 93.75 ms.",08-compute-kernel
"Why might removing CPU limits improve p99 latency?","CFS freezes every thread in the cgroup once the quota is consumed within a period. Removing the limit removes the freeze; requests still guarantee a proportional share under contention.",08-compute-kernel
"First metric to check for a slow-but-healthy pod","container_cpu_cfs_throttled_periods_total divided by container_cpu_cfs_periods_total, then throttled_seconds correlated against p99 latency.",08-compute-kernel
"Three ways to prevent a cache stampede","Request coalescing (singleflight or a lock) so one caller recomputes; probabilistic early expiration (XFetch) so clients desynchronise; stale-while-revalidate so the stale value serves while one background refresh runs.",09-caching-edge
"Why does jittering TTLs not fix a hot-key stampede?","Jitter desynchronises different keys populated at the same time. On one key every client reads the same stored expiry and misses together.",09-caching-edge
"Why is a cache stampede self-amplifying?","The herd slows the origin, which lengthens the miss window, which lets more requests arrive and miss, which enlarges the herd.",09-caching-edge
"SSE or WebSocket for LLM token streaming, and why?","SSE. The traffic is unidirectional, so WebSocket's advantage is unused, and SSE stays inside HTTP so load balancers, auth, tracing and compression keep working. It also gives reconnection and Last-Event-ID resumption for free.",09-caching-edge
"Three infrastructure gotchas that break SSE","Proxy buffering (disable with X-Accel-Buffering: no or proxy_buffering off), load balancer idle timeouts (send heartbeat comments), and the HTTP/1.1 six-connections-per-origin limit (fixed by HTTP/2).",09-caching-edge
"How do you cancel a generation over SSE?","AbortController on the fetch closes the connection, the server observes the disconnect and stops generating. Durable cancellation across a partition needs an explicit POST /cancel with the request ID.",09-caching-edge
"Why does PKCE apply to confidential clients that already have a secret?","The secret authenticates the client application; it does not bind the code to the specific authorization request. PKCE closes authorization code injection, which is why RFC 9700 and OAuth 2.1 require it universally.",10-security
"PKCE vs state vs nonce","PKCE binds the code to the client. State binds the callback to the browser session (CSRF). Nonce binds the ID token to the authorization request. You want all three.",10-security
"What does PKCE not protect?","The access token. A stolen bearer token is fully usable until it expires. Sender-constrained tokens (DPoP, RFC 9449, or mTLS binding, RFC 8705) are the control for that.",10-security
"Burn rate, defined","Observed error ratio divided by (1 minus the SLO target). Burn rate 1 exhausts the budget exactly at the end of the window; 14.4 exhausts a 30-day budget in about two days.",12-sre-observability
"The standard multi-window burn-rate alert set","Page at 14.4x over 1h with a 5m short window (2 percent of budget); page at 6x over 6h with a 30m short window (5 percent); ticket at 1x over 3d with a 6h short window (10 percent).",12-sre-observability
"Why two windows in a burn-rate alert?","The long window establishes significance; the short window confirms it is still happening, so the alert clears when the incident does instead of firing for hours afterwards.",12-sre-observability
"Error budget minutes per 30 days at 99.9 and 99.99 percent","99.9 percent is 43 minutes 12 seconds. 99.99 percent is 4 minutes 19 seconds.",12-sre-observability
"Three 99.9 percent dependencies called in series give what availability?","0.999 cubed, about 99.7 percent, which is 2h 10m a month rather than 43m. You cannot be more available than the product of your hard dependencies.",12-sre-observability
"Canary vs A/B test","Canary asks whether the version is safe: operational metrics, minutes to hours, asymmetric decision, automatic rollback, owned by the deploy system. A/B asks whether the change is better: product metrics, days to weeks, pre-registered hypothesis and power analysis, owned by the experimentation platform.",13-deployment-delivery
"Why compare a canary against a contemporaneous baseline cohort?","The whole fleet has a different scale so percentiles are not comparable, and last week has a different traffic mix. The baseline must be a freshly deployed cohort of the old version, at the same size, running at the same time.",13-deployment-delivery
"What can a canary not catch?","Slow-burn data corruption, scale-dependent failures such as pool exhaustion at full traffic, coordination bugs needing both versions to interact, and anything with a period longer than the bake time.",13-deployment-delivery
"Minimum detectable effect for a payments canary at 200 QPS","Detecting 0.1 to 0.2 percent error rate needs about 23,500 requests per arm. A 1 percent canary is 2 QPS, so 3.3 hours. A 30-minute 1 percent canary cannot detect a doubling.",13-deployment-delivery
"Why does a Cassandra delete write a tombstone instead of removing data?","Replicas reconcile by last-write-wins with no coordinator. Silently removing a row would let anti-entropy repair copy it back from a replica that missed the delete, resurrecting it permanently.",03-storage
"What is gc_grace_seconds for, and what breaks if you lower it?","It keeps tombstones alive long enough for repair to carry them to every replica. Default 10 days. Lower it below your verified full-repair cycle and deleted rows resurrect silently.",03-storage
"Why did a Cassandra range query start timing out?","Tombstone accumulation in the scanned range. The reader must merge every tombstone in memory. The WARN log prints live rows and tombstone cells for the exact query.",03-storage
"Two silent sources of Cassandra tombstones","TTL expiry, which generates one tombstone per expired cell, and writing null in an UPDATE, which writes a cell tombstone. Both are far more common than explicit DELETE.",03-storage
"Structure for any leadership role-play question","First move, information I would gather, line I would not cross.",16-leadership
"Comment taxonomy for code review","blocking: / suggestion: / nit: / question: / praise:. Most review harm comes from ambiguity rather than tone; an author who cannot tell a nit from a blocker treats everything as blocking.",16-leadership
"Review order to state out loud","Correctness, then design and boundaries, then tests, then readability, then nits.",16-leadership
"SCOR, and why not STAR","Situation, Complication, Options, Result and reflection. The Options slot is what makes a story sound like judgment rather than a resume bullet; STAR has no slot for it.",16-leadership
"Little's Law, and the two ways to use it","L = lambda x W: concurrency = throughput x latency. Sizing: 3000 QPS at 50 ms needs 150 in flight. Inverted, finding the ceiling: a pool of 50 at 50 ms caps you at 1000 QPS no matter how many app servers you add.",02-distributed-systems
"The connection-pool death spiral","A downstream slows, so W rises; L = lambda W means concurrency rises; the pool is finite so requests queue; queueing adds wait, so W rises again. Latency feeds back into concurrency, which is why saturation is a cliff rather than a slope.",02-distributed-systems
"Why run at 70 percent utilisation?","Wait scales as 1/(1-rho): 2x at 50 percent, 3.3x at 70, 5x at 80, 10x at 90, 20x at 95. The knee is 70 to 80 percent. It is arithmetic, not conservatism.",02-distributed-systems
"What is write skew?","Two transactions read overlapping rows, decide, and write disjoint rows. No write-write conflict, so snapshot isolation lets both commit and an invariant over the set breaks silently. PostgreSQL REPEATABLE READ is snapshot isolation and permits it.",02-distributed-systems
"Three fixes for write skew, best first","Express the invariant as a database constraint (a counter row with a CHECK, or an exclusion constraint) so there is nothing to skew; materialise the conflict with SELECT ... FOR UPDATE; or use SERIALIZABLE, which needs application retry logic on SQLSTATE 40001.",02-distributed-systems
"Is serialisability stronger than linearisability?","Neither. Orthogonal. Linearisability is recency on a single object; serialisability is isolation across objects with no real-time requirement. Strict serialisability is both.",02-distributed-systems
"The first sentence of any DynamoDB answer","Access patterns first, schema second. The key schema is the query plan, and you cannot change it later without rewriting the data.",03-storage
"Why single-table design?","Not to save on table costs. It is so one Query against one partition returns a heterogeneous set of related items, which is DynamoDB's only mechanism for retrieving related data in one round trip. The join happens at write time.",03-storage
"GSI vs LSI","GSI: own partition key, own capacity, eventually consistent, addable later. LSI: shares the base partition key, strongly consistent, must be created with the table, and caps a partition key value at 10 GB. Default to GSIs.",03-storage
"Do virtual threads make WebFlux obsolete?","They remove the main reason most teams adopted it (scaling I/O concurrency) without losing stack traces, debuggers or thread-locals. They do not replace demand signalling across a network boundary, which is what request(n) gives you. Default to virtual threads on JDK 21+; use reactive for real streaming backpressure.",04-streaming-apis
"What is pinning, and what changed?","A virtual thread that cannot unmount from its carrier. Native frames and class initialisers pin. synchronized pinned through JDK 23 and no longer does in the common cases as of JDK 24 (JEP 491), so the answer depends on your runtime version.",04-streaming-apis
"You switch to virtual threads and throughput is flat. Why?","Threads were not the bottleneck. Check the connection pool (Little's Law caps you at N/L), then a saturated downstream, then pinning. Also: the old thread pool was an accidental rate limiter, so add an explicit semaphore per downstream.",04-streaming-apis
"Why doesn't caching fix GraphQL N+1?","The problem is 50 lookups for 50 different keys, which is batching not caching. GraphQL is a POST with the query in the body so HTTP caching does not apply without persisted queries. And client-shaped queries are unique by construction, so a response cache is cold.",04-streaming-apis
"Two rules for a DataLoader batch function","Return results in the same order and length as the key array, with null for misses (databases return their own order and omit missing rows, which silently misattributes records). And never make the loader a module-level singleton, because its memoisation crosses users.",04-streaming-apis
"The five slots in a context budget","System instructions, tool schemas, retrieved context, conversation history, and the output reserve, which comes off the top because input and output share the window. Order them stable to volatile so the prefix caches.",06-context-agents
"Prompt caching economics","A read costs about 0.1x input price; a write costs 1.25x on a short TTL or 2x on a long one. Break-even is two requests short-TTL, three long-TTL. It is a prefix match, so one timestamp in the system prompt disables it entirely.",06-context-agents
"Where does the cache breakpoint go in a multi-turn conversation?","At the end of the most recently appended turn, not at the end of the system prompt. Within a few turns the history dwarfs the system prompt, so that is where the tokens are.",06-context-agents
"What is the recall cliff in filtered vector search?","Below roughly a percent filter selectivity, HNSW traversal both slows and loses recall, because most visited neighbours fail the predicate and the graph can be disconnected with respect to the filter. Raising ef_search does not reliably fix it; exact search over the surviving set does.",07-search-ranking
"Why never post-filter an ACL?","Two reasons. Recall: with a 1 percent filter, a top-100 yields one survivor. Security: the number of results you drop leaks the existence of documents the user cannot see, which is information disclosure even when content is never returned.",07-search-ranking
"Why is interleaving more sensitive than A/B?","The comparison is within-impression rather than between-population, so the user is their own control and user-behaviour variance drops out. Published validations report one to two orders of magnitude fewer impressions for the same power.",07-search-ranking
"Interleaving vs A/B, in one line","Interleaving picks the ranker; A/B decides whether to ship it. Interleaving measures relative ranker preference only and cannot see revenue, latency or retention.",07-search-ranking
"Diagnostic order for a slow-but-healthy pod","Shape first (all pods or one, tail or uniform, what changed). Then CFS throttling, GC and major faults, per-dependency latency AND pool wait, DNS and ndots, node steal time and run queue, disk and network saturation, probe config, then profile.",08-compute-kernel
"Why is ndots:5 a latency problem?","Any hostname with fewer than five dots is tried against each search domain first, so resolving api.stripe.com issues three or four failing queries before the real one, doubled for A and AAAA. Fix with a trailing dot, a lower ndots in dnsConfig, or NodeLocal DNSCache.",08-compute-kernel
"You cannot revoke a stateless credential without...","...reintroducing state. The design question is where to put it and how much. Shrink the window first with 5 to 15 minute access tokens, then do the real revocation at the refresh boundary, which already talks to the issuer.",10-security
"Watermark vs jti denylist","A per-user tokens_valid_after watermark is one entry per user, written only on an event, and it maps onto the cases that matter (password change, account disable, global logout). A jti denylist grows with revoked tokens but can revoke one session while leaving others alive.",10-security
"Refresh token rotation with reuse detection","Each refresh issues a new refresh token and invalidates the old. If an already-used token is presented again, you cannot tell theft from a lost response, so revoke the entire family. The legitimate user re-authenticates; the attacker is locked out.",10-security
"Redux: what is server state?","Anything that originates from an API, can change without this browser doing anything, or would be different after a page reload. Typically 60 to 70 percent of a large store. It belongs in a server cache library, not a reducer.",11-frontend
"What do you lose migrating Redux to a query cache?","Normalised entity consistency. Entity adapters keep one order in one place so an edit updates every screen; a query cache is keyed by request, so the same entity can live in two entries and you must invalidate both.",11-frontend
"What is metrics cardinality, and what is the cost model?","Series = the product of every label's distinct values, and each active series costs a few kilobytes of memory plus index. The cost model is series count, not sample rate. One unbounded label (a user ID) makes it unbounded.",12-sre-observability
"Why is a cardinality OOM worse than it looks?","Because recovery is slow: WAL replay of millions of series takes minutes during which nothing is scraped and no alerting rule evaluates, and a memory-constrained pod can OOM again during replay and crash-loop.",12-sre-observability
"The cardinality policy that actually works","Three layers. A rule with a rationale (metrics are for aggregates; identifiers belong in traces and logs, linked by exemplars). Enforcement in the collection path (metric_relabel_configs, sample_limit) so a bad target fails loudly. And alerting on head series plus the churn rate.",12-sre-observability
"Cognitive load, operationally","Not workload. Count what a team must hold: services on call for, distinct domains, runtimes, integrations, stakeholder groups. The indicators are onboarding time, bus factor per area, interrupt rate, and deploy coupling.",14-architecture-patterns
"How do you validate a proposed team boundary?","Co-change analysis over six months of commits. If the cut runs through directories that change together in a large fraction of commits, it converts an in-team change into a cross-team negotiation and the boundary is wrong.",14-architecture-patterns
"The five extraction forces for a microservice","Independent scaling, independent deploy cadence for separate teams, fault isolation in-process bulkheads cannot provide, genuine polyglot need, regulatory or residency separation. Codebase size, clean boundaries and team autonomy are not on the list.",14-architecture-patterns
"How do you enforce modular-monolith boundaries?","Three mechanisms, all required. Compile-time or CI dependency rules (module system, ArchUnit, import-linter) so a cross-boundary import fails the build. One database schema and role per module so a module physically cannot read another's tables. And code ownership on each module's public API.",14-architecture-patterns
"Why double-entry rather than a balance column?","Because it gives you a checkable invariant: the sum of every entry is zero, per currency, always. That turns errors from silent and unbounded into detectable within one reconciliation cycle, and it gives you the audit trail.",15-design-answers
"How do you prevent an overdraft race in a ledger?","Make the check part of the write: UPDATE balances SET balance = balance + delta WHERE account = ? AND balance + delta >= 0, and treat zero affected rows as insufficient funds. Read-check-then-write is a write-skew bug.",15-design-answers
"What is the real bottleneck in a payments ledger?","The hot revenue or fee account that every transaction credits. Row-level lock contention on it caps throughput long before the database is otherwise stressed. Fix with sharded counters, or no projection at all for accounts nobody needs a real-time balance for.",15-design-answers
"The reliability-investment reframe","You are not asking for capacity, you are pointing out you already spend it invisibly at a worse exchange rate. Open with the number: unplanned work as a percentage of capacity, and its trend.",16-leadership
"The sentence that makes a capacity ask credible","And if the number hasn't moved by the review date, we should stop rather than keep spending. It converts a request into an experiment, and it is what makes the second ask easy.",16-leadership
"Error budget policy, and the catch","While inside the SLO the team ships at full speed; when the budget is exhausted, feature work pauses until it recovers. The catch is that leadership must sign it before the budget runs out, not during the incident.",16-leadership
"RTO vs RPO","RTO is time to restore; RPO is how much data you may lose. Independent: a system can fail over in 30 seconds and lose an hour of writes, or take 8 hours and lose nothing.",17-dr-multiregion
"Why can't you have RPO zero across regions?","Zero RPO needs synchronous replication, which makes every write wait for the remote acknowledgement. Light in fibre gives roughly 1 ms per 100 km round trip, so London to Virginia adds ~75 ms per write. Practical answer: synchronous in-region, asynchronous cross-region, so your RPO is your replication lag.",17-dr-multiregion
"The three DR dependencies everyone forgets","Identity provider, DNS (and its TTL, which bounds failover speed), and the secrets manager. Your real RTO is the max of your critical dependencies' RTOs, not your own.",17-dr-multiregion
"The reverse-due-diligence mechanic","Ask the same question of three people and compare. What does success look like at six months, and who decides whether it happened? Divergent answers mean nobody has agreed what the role is for. Write the answers down between rounds.",18-offer-and-questions
"How to ask a hard question without being adversarial","Ask about the past rather than the present, ask for a specific instance rather than a characterisation, and give permission to be honest. Walk me through your last incident and whether the action items shipped beats is reliability a problem here.",18-offer-and-questions
"The staff design-round structure","5 min clarify (requirements as numbers), 3 min capacity math out loud, 3 min API contract, 5 min data model and partition key, 10 min architecture at container level, 12 min deep dive (let them pick), 5 min failure modes and degradation, 2 min tradeoffs.",01-interview-mechanics
"The single biggest differentiator in a design round","Doing capacity math out loud and then using the result to justify a decision. It takes three minutes, almost nobody does it, and it converts every later choice from preference into consequence.",01-interview-mechanics
"Why does RRF beat weighted score blending?","BM25 is unbounded and corpus-dependent; cosine is bounded and compressed; min-max normalisation is computed against the candidate set so the same document normalises differently per query; and score distributions vary by query so a fixed weight is wrong for most. Rank means the same thing everywhere.",05-ai-llm
"What does k=60 do in reciprocal rank fusion?","Damps the difference between top ranks. At k=60 rank 1 contributes only ~1.15x what rank 10 does, so a document must rank decently in several lists rather than topping one. That rewards agreement between retrievers over confidence within one.",05-ai-llm
"The two metric families for RAG","Retrieval: recall@k, NDCG, MRR, context precision. Generation: faithfulness (every claim traceable to the retrieved context) and answer relevance. Recall@k is the ceiling; no prompt work gets you above it. One combined accuracy number cannot direct any work.",05-ai-llm
"Three LLM-judge biases and their fixes","Position bias (evaluate both orderings and require consistency), verbosity bias (instruct against length and monitor score-length correlation), self-preference bias (use a different model family as judge). And validate the judge against human labels before trusting it.",05-ai-llm
"How much does GQA buy you?","The grouping factor, directly, because KV cache size is linear in KV head count. 64 query heads with 8 KV heads instead of 64 is an 8x smaller cache, so 8x more concurrent sequences at the same memory.",05-ai-llm
"What did PagedAttention fix?","Fragmentation. Naive allocation reserves max sequence length per request because the kernel wants contiguous memory, wasting 60-80 percent. Paging allocates fixed blocks on demand via a block table, so waste is at most one partial block, and blocks can be shared for a common prefix (prefix caching).",05-ai-llm
"Why does batching transform decode but not prefill?","Amortisation. In decode the GPU reads every weight from HBM to produce one token per sequence, so reading the weights once serves the whole batch. In prefill the GPU is already saturated with arithmetic from a single long prompt, so batching just queues them.",05-ai-llm
"LLM cost levers, in order","Measure per feature with an outcome field; prompt caching (usually broken by something dynamic in the prefix); context trimming, especially retrieval k; model routing cheap-first with escalation; batch APIs; then semantic caching and distillation last.",05-ai-llm
"Why does escalation rate matter more than price ratio in model routing?","Escalated requests pay for both calls. At 30 percent escalation with a fifth-price model you save about half; at 60 percent you save almost nothing and have added latency to most requests.",05-ai-llm
"The lethal trifecta","Private data, exposure to untrusted content, and a way to communicate externally. An agent with all three is exploitable by indirect prompt injection. Remove any one leg and the attack cannot complete; the cheapest leg is usually egress.",05-ai-llm
"Why don't prompt-level injection defences work?","Instruction and injected text share one channel, so you are asking the model to make a probabilistic judgement about which text is more authoritative, and the attacker has unlimited attempts. Every published prompt-level defence has been broken. Architecture is the defence.",05-ai-llm
"What is the dual-LLM pattern?","Privilege separation. A quarantined model reads untrusted content and returns only constrained structured output; a privileged model with tools and private data acts on that structure and never sees the raw text. Cost: the privileged model has less context.",05-ai-llm
"Why is per-step accuracy useless for agents?","It compounds. 95 percent per step over 20 steps is 0.95^20, about 36 percent task success. Use task-level success against a checkable end state, including an assertion that nothing else changed.",05-ai-llm
"What is pass^k and why does it matter?","The fraction of tasks that succeed on all k independent attempts. pass@1 asks whether the agent can do the task; pass^k asks whether it reliably does. Agents degrade sharply as k rises, and consistency is what decides shippability.",05-ai-llm
"Where do most agent failures actually live?","Tool design, not model capability. Wrong tool selected means the description does not say when to call it; wrong arguments means the schema is too permissive. Tool-layer fixes routinely move pass@1 20 points with no model change.",05-ai-llm
"Why is fixed-size chunking usually wrong?","It cuts where the token counter says rather than where the meaning ends, so a procedure gets split and neither half is retrievable or usable. Recursive character splitting is strictly better at the same cost; structure-aware is better still.",05-ai-llm
"The highest-return chunking change","Prepending the heading path to each chunk. One line, free at query time, and it fixes the dominant failure in structured corpora: an orphaned fragment that contains the answer but nothing connecting it to the question.",05-ai-llm
"The tail-at-scale arithmetic","Fan out to N servers each with probability p of being slow, and the aggregate is slow with probability 1-(1-p)^N. At N=100 and p=1 percent, 63 percent of requests are slow. The tail at the leaf becomes the median at the root.",02-distributed-systems
"What percentile must you control under fan-out?","The one your fan-out demands: solve (1-p)^N >= target. At N=60 and a 99 percent target you need each backend's p99.98, not its p99.",02-distributed-systems
"Hedged requests, and the risk","Send to one replica; if no response by the p95, send a duplicate and take the first answer, cancelling the loser. Extra load is bounded at a few percent. The risk is that under overload hedging amplifies, so gate it on the observed hedge rate.",02-distributed-systems
"Why is exactly-once delivery impossible?","Two Generals. Over an unreliable channel no finite protocol lets both parties agree a message was received, because the acknowledgement can be lost. What you can build is exactly-once effects: at-least-once plus deduplication.",02-distributed-systems
"Five things an idempotency key mechanism needs","Scope the key by tenant and operation; store the result not just the key; handle in-flight explicitly with a 409; hash the request so the same key with different parameters is a 422; and propagate the key downstream.",02-distributed-systems
"The dual-write problem and its fix","Writing to a database then publishing an event are two operations with no shared transaction, so a crash between them leaves them permanently inconsistent. Fix: the transactional outbox, writing the event in the same transaction, with an at-least-once publisher and idempotent consumers.",02-distributed-systems
"What is a watermark?","An assertion flowing through a stream that no events earlier than T are still expected, so a window can close. It is a heuristic, which makes it a completeness-versus-latency dial rather than a guarantee.",04-streaming-apis
"Your Flink job consumes normally and emits nothing. Why?","A stalled watermark. An operator's watermark is the minimum across its inputs, so one idle partition freezes the whole job: no window fires, no error, normal-looking lag. Fix with an idleness timeout on the source; alert on watermark lag.",04-streaming-apis
"What must be true of your sink if you use allowed lateness?","It must be idempotent or upsert-capable, because a late event causes the window to re-fire with an updated result. An appending sink double-counts.",04-streaming-apis
"News feed: push, pull or hybrid?","Hybrid, and the reason is the follower distribution, not preference. Reads outnumber writes ~100:1 so precompute at write time, but one account with 50M followers makes a single post 50M timeline writes. Push below a threshold, pull above it, merge at read time.",15-design-answers
"Why is the celebrity pull path cheap?","A celebrity's recent posts are identical for every follower, so that cache entry is written once and read by millions. And the number of celebrities any one user follows is small, so the merge is bounded.",15-design-answers
"CVSS vs EPSS vs KEV","CVSS scores intrinsic severity, EPSS predicts probability of exploitation in the next 30 days, KEV is CISA's catalogue of confirmed active exploitation. Three different questions; a priority is the combination plus your exposure.",10-security
"The patching order","KEV first, because observed exploitation beats any prediction. Then EPSS times exposure. Then CVSS times exposure times data sensitivity. 'We patch all criticals in seven days' without exposure context is the junior answer.",10-security
"What bounds your patching velocity?","Inventory accuracy. You cannot patch what you do not know you run, and most organisations fail at that step rather than at applying the patch. An SBOM registry that answers 'who uses this library' in minutes is the first investment.",10-security
"An engineer missed three commitments. First move?","Not the conversation. An hour of preparation, because it is a symptom with about six causes and at least two of them are management failures: interrupt load, and someone not feeling able to say work was slipping.",16-leadership
"How does a missed-commitments conversation end?","One specific change from them, one specific change from you, a check-in date close enough to be real, and a written summary the same day. No surprises at review time only works if the conversations happened and were recorded.",16-leadership
"Zero trust in one sentence for a director","Being on our network currently means being trusted, so a phished laptop can reach the customer database. Zero trust checks every request against who you are, what device you are on, and whether you should have that specific access, every time. One compromised laptop stops being one compromised company.",10-security
"The zero trust sequencing, and why","Identity, device, workload, network, data. Identity first because everything downstream needs a reliable answer to who is asking, and SSO is the one security project users like, which makes it fundable. Network is fourth because segmenting by IP is brittle; you want to segment by workload identity.",10-security
"Zero-downtime reindex, in one line","Applications read and write through an alias, never a concrete index name, so the switch is one atomic _aliases call and the rollback is the same call reversed.",03-storage
"Two settings that halve reindex time","Zero replicas and refresh_interval -1 during the bulk load, because both multiply indexing work and neither is needed while nobody reads the index. Restoring them before the swap is the step people forget.",03-storage
"How do you handle writes during a reindex?","Dual-write from the application, or repeated delta passes filtered on updated_at with version_type external so they are idempotent and cannot overwrite newer documents with older ones, or replay from the source of truth if you have CDC.",03-storage
"Deploy vs release","Deployment moves bits onto infrastructure; release exposes behaviour to users; a feature flag decouples them. Deploy continuously, release deliberately.",13-deployment-delivery
"The biggest benefit of decoupling deploy from release","Not rollback speed, though 4 seconds beats a 25-minute redeploy. It is that trunk-based development becomes possible, because unfinished work merges behind a disabled flag, which removes long-lived branches and merge hell as a category.",13-deployment-delivery
"What does NOT decouple with a feature flag?","Database schema (needs expand-contract), cached and serialised data (version cache keys with the schema, or the old path reads a format it cannot parse), published events (consumers deploy before producers), and irreversible external side effects.",13-deployment-delivery
"The four feature-flag types","Release (days to weeks, deleted after rollout), ops/kill switch (permanent infrastructure), experiment (owned by the A/B platform), permission/entitlement (permanent business rule). Only release flags need an expiry policy.",13-deployment-delivery
"Contract testing, in one line","Consumers declare what they need in executable form; consumer tests run against a mock generated from that; the provider's CI replays every consumer's contract against the real provider. The two sides never run at the same time, so no shared environment is needed.",13-deployment-delivery
"What contract testing cannot catch","Emergent behaviour. Two services can each satisfy their contracts and produce a wrong outcome together, like marking an order shipped before payment settled. Keep three to five end-to-end tests plus synthetic monitoring for that.",13-deployment-delivery
"Why 40 services is tractable for contract testing","The interaction graph is sparse. Forty services typically have fewer than 100 real consumer-provider edges, not 1,560, so the work scales with edges rather than with the square of the node count.",13-deployment-delivery
"A director wants a date you cannot commit to. First move?","Ask what the date is anchored to. A contract, a customer commitment already made, a conference and a stretch target need completely different responses, and the real constraint often has a better answer than either party started with.",16-leadership
"How do you quote a date credibly?","With percentiles from historical cycle time, not story points: 60 percent confidence on the 29th, 90 percent on the 12th. Points measure imagined effort; cycle time measures what happened. And commit to 60-70 percent of theoretical capacity.",16-leadership
"Two teams building the same service. First move?","Verify the duplication is real, because they are often solving different problems that look alike. Then quantify the cost in engineer-years, confused consumers and any live correctness divergence, and translate it into whatever the decision-maker already said they wanted capacity for.",16-leadership
"How do you make a consolidation actually happen?","Give the losing team something real: they own the migration, their distinctive features get ported, their lead is named as a contributor. 'Your year of work is deleted' is why consolidations get agreed and then quietly not done.",16-leadership
"Promotion, one level short: the question that decides whose problem it is","Have they had the opportunity to demonstrate what is missing? If the gap is cross-team scope and every project you assigned was inside the team, the gap is yours, because at this level the evidence comes from the work someone is assigned.",16-leadership
"What do you promise in a promotion conversation?","The packet and your advocacy, never the outcome, because you do not control the calibration room. Plus a commitment to say in January if it is not tracking, so they do not find out in March.",16-leadership
"Serverless vs containers: the crossover","Around 30-40 percent average utilisation. Below it, per-request billing wins; above it, per-time billing wins because the time is fully used. Committed-use discounts push the crossover down to roughly 20 percent.",08-compute-kernel
"How do you size the container for the comparison?","Little's Law: concurrency equals throughput times latency. 50 requests/sec at 200 ms is 10 in flight, so about 2 vCPU with headroom, not a guess.",08-compute-kernel
"The constraint that overrides serverless cost math","Connection management. A function per invocation cannot hold a pool, so hundreds of concurrent functions exhaust the database. That is the most common way function architectures fail at scale, and it fails rather than merely costing more.",08-compute-kernel
"Where is the durability boundary?","fsync. write() returns when data is in the page cache, which is RAM, so it survives a process crash and nothing else. fsync pushes to the device and flushes the device cache. Commit path: append to WAL, fsync WAL, then acknowledge.",08-compute-kernel
"fsyncgate, in one line","On Linux a writeback failure can be reported once and the dirty pages then marked clean, so a retried fsync returns success against data that is gone. PostgreSQL 12+ panics on fsync failure rather than retrying.",08-compute-kernel
"synchronous_commit = off vs fsync = off","The first loses a bounded window (about 200 ms) of committed transactions and leaves the database consistent. The second risks corruption. Teams conflate them.",08-compute-kernel
"Why is etcd sensitive to disk latency?","Every Raft log append is an fsync before a follower can acknowledge, so commit latency is local flush plus a quorum round trip. A 10 ms fsync caps cluster write throughput regardless of network speed.",08-compute-kernel
"eBPF: the signature that means reach for it","The caller and callee disagree. Trace says the DB call took 340 ms, the DB says 4 ms. That gap is client-side and no application instrumentation can see it.",08-compute-kernel
"The four eBPF questions, in order","Off-CPU (offcputime, runqlat), block I/O (biolatency, biosnoop), network (tcpretrans), then application internals (funclatency on a uprobe). Off-CPU first, because most intermittent latency is time not spent on CPU, which a sampling profiler cannot see.",08-compute-kernel
"Why a CPU profiler misses intermittent latency","It samples on-CPU time. The latency is usually off-CPU: run-queue wait, lock, page fault, disk, or a TCP retransmit. Off-CPU flame graphs are the artifact that answers it.",08-compute-kernel
"Cache invalidation with many dependencies: the first deliverable","A table, per entity: change rate, tolerable staleness, and fan-out per change. Price changes 50k/day with zero tolerance and fan-out 1. A category changes 20/day, tolerates an hour, fan-out 80,000. One strategy cannot be right for both.",09-caching-edge
"Tags or versioned keys?","Fan-out decides. Tags (surrogate keys) below roughly 1,000 objects per change: precise, no garbage. Versioned keys above it: one INCR beats 80,000 deletes, at the cost of superseded entries sitting until eviction.",09-caching-edge
"The subtle bug in dependency-index invalidation","The index expiring before the entries it tracks. The purge finds an empty set, deletes nothing, and pages stay stale until their own TTL. Give dependency sets a TTL strictly longer than the entries.",09-caching-edge
"Why CDC for cache invalidation instead of app-emitted purges?","An app-emitted purge is a line of code someone can forget: the admin tool, the importer, the migration, the manual data fix. CDC reads the write-ahead log, so it captures every write path including the ones that bypass your service.",09-caching-edge
"Why keep a TTL when purging works?","A purge is a message and messages get dropped. A purely purge-driven cache with an infinite TTL has no self-healing path: one lost message means one wrong value served forever.",09-caching-edge
"When a knowledge graph beats a vector index","Multi-hop questions where no chunk contains the chain; global questions about the corpus where no value of k works; relationship questions like dependency impact; and anywhere the reasoning path must be auditable.",06-context-agents
"The move that makes a knowledge graph affordable","Noticing how much of it already exists in structured systems: service catalogue, tracing data, org directory, ticket system. LLM extraction only for relationships that exist purely in prose.",06-context-agents
"GraphRAG global search, mechanically","Leiden community detection over the graph, hierarchically, then a pre-generated LLM summary per community per level. A global question maps over those summaries and reduces. No vector-index equivalent exists.",06-context-agents
"The three shard key tests","Cardinality (can you split?), frequency (is one value dominant?), monotonicity (does every insert land on one shard?). A key can pass one and fail the others: _id has perfect cardinality and is the worst common choice.",03-storage
"Why a monotonic shard key is fatal","Every new document has the highest value, so every insert lands in the top chunk, which lives on one shard. You get an N-shard cluster with single-shard write throughput.",03-storage
"What is a jumbo chunk?","A chunk past the size limit that cannot be split because every document in it shares one shard-key value. The balancer then refuses to move it. It is the failure mode of poor frequency spread.",03-storage
"Compound shard key: the routing rule","Only queries containing the prefix fields route. A query on the suffix alone broadcasts, exactly like a compound index.",03-storage
"Why a column rename takes five deploys","A rolling update is not atomic. Both versions serve traffic for minutes, so a bare RENAME throws on every pod not yet replaced. And rollback is a deploy backwards, so old code must work against the new schema too.",13-deployment-delivery
"The event compatibility ordering rule","Additions: producers deploy first, consumers ignore the unknown field. Removals: consumers deploy first, then the producer stops emitting. It is the reverse of intuition and getting it backwards takes down every consumer at once.",13-deployment-delivery
"Why did the rollback fail on a cache format change?","The new version left state the old one cannot read, and with a TTL the cache does not self-heal. Fix: version the cache key so the two cannot collide, and treat an unknown payload version as a cache miss rather than an exception.",13-deployment-delivery
"The five-minute habit that prevents rollback failures","Ask what state this version writes that the previous one cannot read: schema, cache, sessions, published events, object storage, queue messages. Schema migrations get reviewed; a serialisation change in a cached object does not.",13-deployment-delivery
"INP's three phases","Input delay (main thread busy), processing (your handler), presentation (style, layout, paint). The phase split is the diagnosis. Presentation is often largest and is invisible in a JavaScript profiler.",11-frontend
"Why INP replaced FID","FID measured only the delay before the first interaction's handler started. A page could score well while every interaction after the first took half a second to show a result. Teams that 'fixed FID' often have the worst INP.",11-frontend
"INP thresholds","Good under 200 ms, poor above 500 ms, at the 75th percentile of real user sessions. The reported value is roughly the worst interaction, with one outlier discounted per 50 interactions.",11-frontend
"The INP fix that requires nothing to get faster","Paint the pending state first, yield, then compute. INP measures time to the next paint, not time to complete the work, so this alone can take an interaction from 400 ms to 30 ms.",11-frontend
"The micro-frontends test","Does the teams' work co-render on the same page? If teams own separate routes, split by route: real deploy independence, no shared cascade or React, because two routes never render at once. Same page means genuine micro-frontends.",11-frontend
"The constraint that usually kills micro-frontends","Module Federation's singleton: true means one React across all fragments, so every team upgrades together, which is the coordination you were removing. Drop it and you ship two Reacts and hooks break across the boundary.",11-frontend
"Chaos engineering: what makes it an experiment","A steady-state metric in user-visible terms, a hypothesis, a chosen blast radius, and automated abort conditions. Without a hypothesis there is no result, only an incident.",12-sre-observability
"Why run chaos experiments during business hours?","You want the people who understand the system awake and watching. Running at 3am minimises the customers affected and also the people capable of noticing. If it is too risky to run at 2pm, it is too risky to run.",12-sre-observability
"What chaos experiments actually find","Fallback code that has silently rotted, because it is the least-executed code in the system. Alerting that cannot detect the failure at small blast radius. Runbooks that no longer match. Two of the three are observability findings.",12-sre-observability
"Latency or failure injection first?","Latency. Dependencies rarely die cleanly, they slow down, and systems handle slow far worse than dead: a clean failure trips a breaker, while slowness fills thread pools and propagates backpressure.",12-sre-observability
"The repository pattern, precisely","A collection-like interface over persistence, one per AGGREGATE ROOT, not one per table. Per-table is a DAO with a fashionable name and gives up the boundary that made the pattern worth having.",14-architecture-patterns
"The test for whether a repository earns its cost","Is there an invariant that would be violated if code could load a partial version of this thing? Order with line items and a cancellation rule: yes. A reporting endpoint producing a screen: no, that is a query object.",14-architecture-patterns
"The strongest argument against the repository pattern","Your ORM already implements it (SQLAlchemy Session, EF DbContext are Unit of Work), and it leaks on exactly the properties that matter: cardinality, indexes, locking, N+1. Those decide whether the system works.",14-architecture-patterns
"The CQRS ladder","1: separate handlers (hours). 2: separate read models, same DB (days). 3: separate read store, same transaction (weeks). 4: async projections (months, and consistency changes). Almost everyone asking imagines 4 and needs 1.",14-architecture-patterns
"Which CQRS rung changes consistency?","Only rung 4. Rungs 1 through 3 are strongly consistent. And rung 4 is a product decision, not an engineering one: whether a customer can place an order and not see it for two seconds.",14-architecture-patterns
"CQRS and event sourcing","Independent patterns, frequently deployed together. Conflating them is why teams think CQRS costs months. Most teams asking for event sourcing want an audit trail, which an append-only audit table gives without making replay the recovery path.",14-architecture-patterns
"Converting SCOR to STAR","Complication becomes the Task in first person. Options move to the front of Action, one sentence each with its cost, and you keep all of them. Resolution splits: what you did is Action, what happened is Result. Add an explicit 'what was mine to decide'.",01-interview-mechanics
"Why prepare in SCOR and deliver in STAR","STAR is the scoring rubric; SCOR is a narration order. STAR has no slot for the alternatives, and at staff level the decision is the content. Preparing in SCOR forces the complication and options to exist; they survive the conversion.",01-interview-mechanics
"What makes a scar-tissue story work","Three sentences, under 30 seconds, one number only someone present would know, and it returns to the technical point. 'It caused an outage' is generic; '40 seconds at 100 percent CPU' is a memory. Three or four per interview, not one per answer.",01-interview-mechanics
"Down-levelled offer: the first move","Do not accept, decline or negotiate. Ask which of three things happened: the loop calibrated you lower, the req is scoped lower, or it is an anchor. Ask without mentioning compensation.",18-offer-and-questions
"The highest-conversion move in a level negotiation","Offering an additional conversation with a staff engineer focused on the named gap. It converts your assertion into something they can verify, costs them an hour, and is hard to refuse.",18-offer-and-questions
"The question that actually decides a down-levelled offer","The promotion path: who has gone senior to staff on this team, how long, when are the cycles, what work builds the evidence. 'Definitely possible for strong performers' means no path exists; price the offer as though the level is permanent.",18-offer-and-questions
"Why you cannot roll back a mobile release","Google Play will not let you decrease a staged rollout percentage and users who have the build keep it; App Store phased release pauses but does not reverse. Halting freezes the affected population, it does not shrink it.",13-deployment-delivery
"What turns a 3-day mobile incident into a 20-minute one","A server-side kill switch on the affected feature. On the server a bad deploy is fixed by rollback; on mobile a bad binary is fixed by a flag or it is not fixed for days. Hence: ship every feature dark, enable server-side.",13-deployment-delivery
"The mobile segmentation that is decisive most often","Upgrade versus fresh install. If fresh installs are clean and upgrades crash, it is a migration or restored-state bug that no internal test could catch, because test devices are clean installs.",13-deployment-delivery
"Why the mobile alert fires late","Staged rollout mathematically dilutes a segmented failure. A crash hitting 100 percent of one OS version at 20 percent rollout looks like noise in the aggregate. Alert per OS version and per upgrade path, or staging hides the problem it was meant to bound.",13-deployment-delivery
"Multilingual search: clarify this word first","Nine separate corpora with same-language queries, or cross-lingual where a French query matches an English document? Different systems. Cross-lingual needs one shared embedding space and is the interesting case.",15-design-answers
"Why hybrid rather than dense-only for product search","'iPhone 15 Pro Max 256GB' is exact-match, and a dense encoder puts the 128GB variant at near-identical similarity, so it confidently returns the wrong product. Exact-identifier queries are a large share of commercial traffic.",15-design-answers
"The filtered-ANN recall cliff","HNSW traversal assumes a connected graph; filtering removes nodes and disconnects regions, so the search cannot reach qualifying neighbours that exist. At ~1 percent selectivity you can lose most recall, silently.",15-design-answers
"Filtered vector search: the routing rule","Exact scan under ~10,000 estimated candidates (exact is faster there); partitioned index where the filter is a partition key; widened ef otherwise. Route by cardinality estimate, do not pick one algorithm.",15-design-answers
"Multilingual docs: how many vectors per product?","One. Embed the canonical description and keep per-locale lexical fields. Nine embeddings of one product are near-duplicates competing for the same slots, hurting diversity and inflating the index ninefold.",15-design-answers
"The two freshness paths in search","Text and embeddings: GPU pipeline, under an hour, ~50k changes/day. Price and stock: attribute store, under 5 seconds, ~2M changes/day, applied at RANKING time. Re-embedding on price change costs more GPU than the serving fleet.",15-design-answers
"The number that decides a recsys serving design","30 million item-feature reads per second (60k RPS x 500 candidates). Not servable remotely, so item features live in the serving process: 2M items x 256 fp16 = ~1 GB, broadcast to every replica.",15-design-answers
"The funnel rule","Each stage may only reduce the set, and recall lost at retrieval can never be recovered downstream. Which is why retrieval recall is measured separately from ranking quality.",15-design-answers
"Why two-tower retrieval works","The item tower is expensive and offline (produces the ANN index); the user tower is cheap and per-request. No user-item interaction at retrieval time, which is exactly what makes an ANN index possible and why retrieval ranks worse than the ranker.",15-design-answers
"Where diversity belongs, and why","In the re-rank after scoring, not in the model. A pointwise ranker scores items independently and cannot express 'twenty hiking boots is worse than twelve boots and eight related items'. That is a set-level constraint.",15-design-answers
"What happens if you skip exploration","Short-term engagement improves; over months the training data becomes the model's own past decisions, items never shown never get positive signal, and the effective catalogue narrows. Invisible in daily metrics, expensive to reverse.",15-design-answers
"Hedged requests, and when to use them","Send a second request at the p95 and take the first response. Costs ~5 percent more load, removes the tail. Justified when your p99 is dominated by dependencies' tails rather than your own work, which is the tail-at-scale argument.",15-design-answers
"Exactly-once: the correction to make first","Exactly-once DELIVERY is impossible: a worker dying before ack is indistinguishable from never running. What you build is exactly-once EFFECT: at-least-once dispatch plus idempotent execution.",15-design-answers
"The idempotency key that actually works","Derived from job identity plus scheduled instant (job_id:scheduled_for), never a fresh uuid4 per attempt. Same occurrence, same key; different occurrence, different key. A per-attempt UUID deduplicates nothing.",15-design-answers
"Why SKIP LOCKED and an idempotency key, not just one","SKIP LOCKED stops two schedulers dispatching simultaneously. It does not stop a scheduler crashing after enqueue and before marking dispatched, which re-dispatches on the next poll. The key covers that.",15-design-answers
"The lease bug most implementations have","Not checking ownership on every heartbeat. A worker paused by GC or VM migration wakes up believing it still owns the job after a takeover. The heartbeat must be a conditional update, and zero rows updated means abort immediately.",15-design-answers
"Ticketing: the reframe","Not a scale problem. 50,000 seats is 10 MB and 8,300 RPS is unremarkable. It is a contention problem: 500,000 people want the same rows in the same second. And 90 percent cannot succeed, so most of the system's job is rejecting people clearly.",15-design-answers
"The ticketing guarantee, versus the optimisation","A unique partial index on (event_id, seat_id) where status is sold. That is the guarantee and it holds even if Redis is wrong. Redis holds and conditional updates are optimisation to avoid hitting it constantly.",15-design-answers
"Conditional update vs SELECT FOR UPDATE","Both correct. FOR UPDATE serialises every attempt on a hot seat behind a lock held across a round trip. UPDATE ... WHERE status='available' RETURNING is one atomic statement; zero rows means someone else got it, which is a normal outcome.",15-design-answers
"The admission rate formula","(seats_remaining / expected_conversion) / hold_duration_seconds. 50,000 seats at 40 percent conversion with 600 s holds is about 208 users/sec. It is a control loop, not a constant, and when seats run out you stop admitting and tell the queue.",15-design-answers
"Notifications: the split that drives everything","Three traffic classes on separate topics: transactional, social fan-out, campaign. A priority field does not help when the consumers are already busy with a 200M campaign. The real failure is a password reset queued behind marketing.",15-design-answers
"A celebrity posts to 50M followers. What is enqueued?","A resumable fan-out JOB, not a message. Cursor pagination in 10k chunks, checkpoint per chunk, bulk preference filtering with one multi-get, voluntary yielding, and the payload stored once by reference (50M copies of 2 KB is 100 GB).",15-design-answers
"The four sources of duplicate notifications","Producer retries, queue redelivery (by design), fan-out chunk replay after a crash, and two services noticing the same event. One derived key, sha256(event_id:user_id:channel), covers all four via SET NX.",15-design-answers
"Preference evaluation order, and why","Legal (consent, unsubscribe), then explicit user choice, then quiet hours in the user's timezone, then frequency caps. Cheapest to most expensive, because most notifications are rejected and rejecting early is free.",15-design-answers
"Quiet hours: drop or defer?","Defer. Dropping means the user never learns about it, which is almost never the intent. The exception is content that is worthless later, which should carry an explicit expiry instead.",15-design-answers
"Why bounce handling is a correctness requirement","Email throughput is limited by reputation, not bandwidth. SES suspends above ~5 percent bounce or ~0.1 percent complaint, so an unhandled hard bounce degrades deliverability for transactional mail too. Hence separate IP pools per traffic class.",15-design-answers
"Ad clicks: the first question to ask","Billing or dashboards? Dashboards tolerate 0.5 percent error and need seconds; billing needs exactness over 24 hours and tolerates hours. Two paths reading one topic, with divergence between them as a monitored metric.",15-design-answers
"Why partition clicks by click_id, not campaign_id","Campaign partitioning gives a hot partition for the biggest advertiser (ad spend is heavily skewed). click_id partitioning is uniform and makes dedupe state local. The aggregation then does a keyBy shuffle, one hop, much cheaper.",15-design-answers
"The three-tier lateness policy","Within the watermark: normal window firing. Within allowed lateness: window re-fires with an updated count, so the sink must upsert not append. Beyond: side output to object storage for batch reconciliation. Never a silent drop.",15-design-answers
"ON CONFLICT DO UPDATE SET, not +=","The window emits a COMPLETE count for that window, so overwriting is correct and adding double-counts on every checkpoint replay. This one distinction is the most common bug in these pipelines.",15-design-answers
"withIdleness: why it is the highest-value Flink config line","The watermark is the minimum across all sources, so one idle partition out of 200 holds the global watermark back and every window everywhere stops firing, while the job reports healthy.",15-design-answers
"Why batch dedupe must be deterministic","MIN_BY(..., ingest_time) always keeps the earliest occurrence, so a rerun produces byte-identical output. A non-unique tie-break means the invoice changes between runs, which an auditor will find.",15-design-answers
"LLM gateway: what to ship first","Usage recording and cost attribution. It is what gets funded, it is read-only so it can ship as a wrapper before anything sits in the request path, and it builds the case for the rest with data.",15-design-answers
"Gateway failover: the distinction that matters","Same model, different provider (direct -> Bedrock -> Vertex) is identical output and can be automatic. A smaller model is cheaper, faster and DIFFERENT, so it is opt-in per route. Silent downgrade during an incident is unattributable quality loss.",15-design-answers
"Where LLM cost actually goes","Prompt structure, not model choice. Stable system prompt and few-shot examples FIRST, variable content LAST, so the provider prompt cache is usable. For a 20k-token prefix and a 200-token question that removes most of the input cost.",15-design-answers
"Why an LLM gateway is connection-bound","Each request holds a connection for seconds. 2,000 RPS at 8 s average is 16,000 concurrent connections, mostly idle. That dictates async I/O, streaming pass-through rather than buffering, and cancelling upstream on client disconnect.",15-design-answers
"Gorilla compression, and why it matters","Delta-of-delta timestamps plus XOR float encoding takes 16 bytes per sample to about 1.37. That 10x is why metrics need a purpose-built store rather than Postgres, and why the in-memory index rather than the samples is the memory constraint.",15-design-answers
"How a metrics system actually dies","Cardinality, suddenly. It is multiplicative across labels, so adding user_id takes a 40,000-series metric to 80 billion. Ingesters OOM, and because ingest is sharded by series hash the bad series spread evenly, so every shard dies at once.",15-design-answers
"'I need user_id on my metric'","Ask what question they are answering. It is 'the p99 spiked, which request?'. The answer is exemplars: a trace id attached to a histogram bucket sample, so you can jump from the spike to a trace without the id becoming a label.",15-design-answers
"The alert-path independence rule","Alert queries must be answerable from recent local data only. An alert ranging over 30 days cannot fire during an object-storage incident, which is exactly when you need it. Enforce it in rule review, not at runtime.",15-design-answers
"Active-active: the question that forces the design","Coordinate on every write (75 ms quorum from us-east across 5 regions, 180 ms from ap-southeast) or do not coordinate and resolve conflicts. There is no third option. So: what is the write latency budget and what does a conflict cost?",15-design-answers
"Why hybrid logical clocks, not wall clocks","With wall clocks, skew decides which write survives: a region 200 ms fast wins every conflict silently. HLC advances a logical counter when the physical clock does not move, so order is monotonic regardless of skew. It does not fix LWW's lost write.",15-design-answers
"Version vectors: what they actually give you","Detection, not resolution. Comparing tells you dominance or genuine concurrency. Per REGION, not per client, because a per-client vector grows without bound. On concurrency you return siblings or merge.",15-design-answers
"The consistency routing rule for a multi-region store","CRDTs for counters, sets, flags. LWW+HLC for profiles and documents. Home-region ownership for uniqueness or monotonicity. Consensus group for balances. One consistency model for the whole store is the mistake.",15-design-answers
"Session tokens in an eventually consistent store","The client carries the version vector it last saw; the serving region waits briefly or reads from the region that has it. Gives read-your-own-writes and monotonic reads across region changes without global coordination.",15-design-answers
"The forgotten cost of active-active","Cross-region egress. 50k writes/sec x 2 KB to 4 peers is 34 TB/day, often a bigger line item than compute. Batching and compression are required, not optimisations. At 10x, selective replication replaces the full mesh.",15-design-answers
"Greedy vs batched dispatch","Batched. Two requests 200 ms apart can each take the other's best driver: about 40 percent more total wait in the simple case. Batching solves an assignment problem optimally (Hungarian, O(n^3)), costing 2-4 seconds of latency.",15-design-answers
"Why H3 hexagons rather than geohash squares","Hexagons have six equidistant neighbours. Squares have four at d and four at d*sqrt(2), which distorts every radius query and heatmap. And geohash prefixes differ across boundaries, so a prefix query silently misses nearby drivers.",15-design-answers
"How to compute 1M ETAs per dispatch batch","You do not. Haversine pruning first, which is EXACT because straight-line is a strict lower bound on road distance, removing 80-90 percent. Then a cached cell-to-cell matrix. Then real routing for the top 20 per request. Then an ML correction.",15-design-answers
"Why dispatch cost is not just ETA","Acceptance probability (a decline costs 15 s and a re-match), a fairness term weighted by waiting time (or marginal locations get passed over forever while the average looks fine), heading (a U-turn is real time), and soon-to-be-free drivers.",15-design-answers
"RAG access control: why the failure is different","A retrieval mistake is not a bad answer, it is a data leak laundered through a model so it appears as the assistant's own words with no provenance. Authorisation is a property of the whole pipeline, not a filter on retrieval.",15-design-answers
"Why two authorisation layers in RAG","Pre-filter makes the candidate set usable but is stale by the index sync interval. Post-filter re-checks each chunk against a fresh read, catching a revocation from two minutes ago. Post-filter alone gives a 2-percent-access user 2 chunks out of 100.",15-design-answers
"Grants vs revocations","Asymmetric. Revocations must propagate in minutes because failing to revoke is a leak; additions can wait hours because failing to grant is an inconvenience. Push revocations, batch additions.",15-design-answers
"Where RAG access systems actually leak","Not the retrieval filter. The cache (an answer keyed by question alone), conversation history (turn 5 still holds turn 1's content after a revocation), citations (a title is information), and prompt logs (an unpermissioned copy of the corpus).",15-design-answers
"The thing to raise before a permissioned RAG launches","It surfaces pre-existing over-permissioning: documents technically readable by everyone but practically undiscoverable become discoverable. Those incidents look like RAG failures and are ACL hygiene failures. Access review is part of the project.",15-design-answers
"Rate limiter: why not Redis INCR per request","It adds ~0.5 ms same-AZ round trip to every request and makes one Redis a hard dependency for the whole API. It is worst on hot keys, where 1,500 RPS means 1,500 coordinated round trips on one key.",15-design-answers
"Why token bucket over sliding window","Capacity and refill rate express burst and sustained rate as separate parameters, which is what an API product sells ('1,000/min, bursting to 100'). No window algorithm can state that. Also immune to clock skew: refill uses elapsed monotonic time.",15-design-answers
"Two-tier rate limiting, and the overshoot bound","Local token buckets decide; a central authority grants leases proportional to observed demand with per-key node heartbeats. Worst-case slack is active_nodes x rate x refill_interval: about 2 percent at 100 ms and 10 nodes on a 1,000/min limit.",15-design-answers
"Fixed window's fatal flaw","100 requests at 11:59:59 and 100 at 12:00:01 is 200 in two seconds against a '100 per minute' limit. The boundary permits double the intended rate, always, and clients that find it will exploit it.",15-design-answers
"Fail open or fail closed? Compare consequences","Rate limiter: fail OPEN, because failing closed turns a Redis outage into a total API outage. Permission check: fail CLOSED, because failing open leaks data. The rule is not a default, it is which consequence is worse.",15-design-answers