Flashcard deck

Two to five cards are written per completed topic, in front,back,chapter format. The deck lives at output/flashcards.csv in this directory and is reproduced below so it is readable without leaving the book.

How to use it

Import into Anki as a CSV with a comma field separator and three fields mapped to Front, Back and a tag. Or use it as a written self-test: cover the right column, answer out loud, and only then look. Reading a card and thinking "yes, I know that" is recognition, not recall, and recognition is not what an interview measures.

The cards are deliberately verbose on the back. A three-word answer is easy to recall and useless in a room; the backs are written at roughly the length you would actually speak.

The deck

front,back,chapter
"What does Kafka exactly-once actually guarantee?","At-least-once delivery plus deduplication plus atomic visibility, scoped to Kafka. Idempotent producer dedupes retries by PID and sequence number; transactions make output writes and the offset commit atomic; read_committed consumers respect the last stable offset. Anything outside Kafka needs its own idempotency key.",04-streaming-apis
"Why must max.in.flight.requests.per.connection be <= 5 with an idempotent producer?","The broker only remembers the last five sequence numbers per producer per partition. With more in flight, a retry can arrive after the window has moved and the broker cannot tell a duplicate from a gap.",04-streaming-apis
"Consumer lag is climbing but the processor is healthy and error-free. What do you check?","The last stable offset. An upstream transactional producer with an open transaction blocks read_committed consumers past it, so lag climbs while errors stay flat.",04-streaming-apis
"What is the default concurrency of Reactor's flatMap, and why is that a problem?","256, which is the Queues.SMALL_BUFFER_SIZE constant rather than a considered limit. Against a downstream sized for 20 concurrent calls it is a self-inflicted load test. Always pass an explicit concurrency derived from the downstream's capacity via Little's Law.",04-streaming-apis
"flatMap vs concatMap vs flatMapSequential","flatMap: concurrent, output in completion order. concatMap: one inner at a time, source order, no concurrency. flatMapSequential: concurrent like flatMap, output buffered into source order.",04-streaming-apis
"Why does an L4 load balancer break gRPC?","gRPC multiplexes RPCs over one long-lived HTTP/2 connection, and an L4 balancer picks a backend once per connection. All of a client's RPCs pin to one backend and newly scaled pods receive nothing.",04-streaming-apis
"Four fixes for gRPC load balancing","Client-side round_robin over a headless service; an L7 proxy or mesh that balances per stream; xDS lookaside balancing; or MaxConnectionAge on the server so connections recycle.",04-streaming-apis
"Why is prefill compute bound and decode memory bandwidth bound?","Prefill does O(sequence length) FLOPs per byte of weight read; decode does O(batch size). The H100 ridge point is around 300 FLOPs per byte, so prefill sits right of it and decode far left.",05-ai-llm
"KV cache size formula","2 x layers x kv_heads x head_dim x seq_len x batch x bytes_per_element. Llama 3 70B fp16 is 320 KiB per token, so 2.5 GiB for an 8k context.",05-ai-llm
"What limits concurrency in LLM serving?","KV cache memory, not weights and not compute. Weights are a fixed cost paid once; cache is the per-user cost and scales with context length.",05-ai-llm
"The one test that splits a RAG failure in five minutes","Manually place the known-correct passage in the context and re-run. Answer becomes right: retrieval bug. Answer stays wrong: grounding bug.",05-ai-llm
"Why is a reranker the wrong fix for low recall?","A reranker reorders what retrieval returned. If recall@50 is 0.6, the ceiling after reranking is 0.6. Fix the first-stage retriever, then rerank for precision at small k.",05-ai-llm
"Three biases of LLM-as-judge, and their mitigations","Position bias (randomise order), verbosity bias (normalise or instruct against length), self-preference bias (use a different model as judge).",05-ai-llm
"Why can a container using 35 percent of its CPU limit still be throttled?","Throttling is a function of instantaneous parallelism against a 100 ms quota window, not of average utilisation. A 1 CPU limit with 16 runnable threads burns the quota in 6.25 ms and freezes for 93.75 ms.",08-compute-kernel
"Why might removing CPU limits improve p99 latency?","CFS freezes every thread in the cgroup once the quota is consumed within a period. Removing the limit removes the freeze; requests still guarantee a proportional share under contention.",08-compute-kernel
"First metric to check for a slow-but-healthy pod","container_cpu_cfs_throttled_periods_total divided by container_cpu_cfs_periods_total, then throttled_seconds correlated against p99 latency.",08-compute-kernel
"Three ways to prevent a cache stampede","Request coalescing (singleflight or a lock) so one caller recomputes; probabilistic early expiration (XFetch) so clients desynchronise; stale-while-revalidate so the stale value serves while one background refresh runs.",09-caching-edge
"Why does jittering TTLs not fix a hot-key stampede?","Jitter desynchronises different keys populated at the same time. On one key every client reads the same stored expiry and misses together.",09-caching-edge
"Why is a cache stampede self-amplifying?","The herd slows the origin, which lengthens the miss window, which lets more requests arrive and miss, which enlarges the herd.",09-caching-edge
"SSE or WebSocket for LLM token streaming, and why?","SSE. The traffic is unidirectional, so WebSocket's advantage is unused, and SSE stays inside HTTP so load balancers, auth, tracing and compression keep working. It also gives reconnection and Last-Event-ID resumption for free.",09-caching-edge
"Three infrastructure gotchas that break SSE","Proxy buffering (disable with X-Accel-Buffering: no or proxy_buffering off), load balancer idle timeouts (send heartbeat comments), and the HTTP/1.1 six-connections-per-origin limit (fixed by HTTP/2).",09-caching-edge
"How do you cancel a generation over SSE?","AbortController on the fetch closes the connection, the server observes the disconnect and stops generating. Durable cancellation across a partition needs an explicit POST /cancel with the request ID.",09-caching-edge
"Why does PKCE apply to confidential clients that already have a secret?","The secret authenticates the client application; it does not bind the code to the specific authorization request. PKCE closes authorization code injection, which is why RFC 9700 and OAuth 2.1 require it universally.",10-security
"PKCE vs state vs nonce","PKCE binds the code to the client. State binds the callback to the browser session (CSRF). Nonce binds the ID token to the authorization request. You want all three.",10-security
"What does PKCE not protect?","The access token. A stolen bearer token is fully usable until it expires. Sender-constrained tokens (DPoP, RFC 9449, or mTLS binding, RFC 8705) are the control for that.",10-security
"Burn rate, defined","Observed error ratio divided by (1 minus the SLO target). Burn rate 1 exhausts the budget exactly at the end of the window; 14.4 exhausts a 30-day budget in about two days.",12-sre-observability
"The standard multi-window burn-rate alert set","Page at 14.4x over 1h with a 5m short window (2 percent of budget); page at 6x over 6h with a 30m short window (5 percent); ticket at 1x over 3d with a 6h short window (10 percent).",12-sre-observability
"Why two windows in a burn-rate alert?","The long window establishes significance; the short window confirms it is still happening, so the alert clears when the incident does instead of firing for hours afterwards.",12-sre-observability
"Error budget minutes per 30 days at 99.9 and 99.99 percent","99.9 percent is 43 minutes 12 seconds. 99.99 percent is 4 minutes 19 seconds.",12-sre-observability
"Three 99.9 percent dependencies called in series give what availability?","0.999 cubed, about 99.7 percent, which is 2h 10m a month rather than 43m. You cannot be more available than the product of your hard dependencies.",12-sre-observability
"Canary vs A/B test","Canary asks whether the version is safe: operational metrics, minutes to hours, asymmetric decision, automatic rollback, owned by the deploy system. A/B asks whether the change is better: product metrics, days to weeks, pre-registered hypothesis and power analysis, owned by the experimentation platform.",13-deployment-delivery
"Why compare a canary against a contemporaneous baseline cohort?","The whole fleet has a different scale so percentiles are not comparable, and last week has a different traffic mix. The baseline must be a freshly deployed cohort of the old version, at the same size, running at the same time.",13-deployment-delivery
"What can a canary not catch?","Slow-burn data corruption, scale-dependent failures such as pool exhaustion at full traffic, coordination bugs needing both versions to interact, and anything with a period longer than the bake time.",13-deployment-delivery
"Minimum detectable effect for a payments canary at 200 QPS","Detecting 0.1 to 0.2 percent error rate needs about 23,500 requests per arm. A 1 percent canary is 2 QPS, so 3.3 hours. A 30-minute 1 percent canary cannot detect a doubling.",13-deployment-delivery
"Why does a Cassandra delete write a tombstone instead of removing data?","Replicas reconcile by last-write-wins with no coordinator. Silently removing a row would let anti-entropy repair copy it back from a replica that missed the delete, resurrecting it permanently.",03-storage
"What is gc_grace_seconds for, and what breaks if you lower it?","It keeps tombstones alive long enough for repair to carry them to every replica. Default 10 days. Lower it below your verified full-repair cycle and deleted rows resurrect silently.",03-storage
"Why did a Cassandra range query start timing out?","Tombstone accumulation in the scanned range. The reader must merge every tombstone in memory. The WARN log prints live rows and tombstone cells for the exact query.",03-storage
"Two silent sources of Cassandra tombstones","TTL expiry, which generates one tombstone per expired cell, and writing null in an UPDATE, which writes a cell tombstone. Both are far more common than explicit DELETE.",03-storage
"Structure for any leadership role-play question","First move, information I would gather, line I would not cross.",16-leadership
"Comment taxonomy for code review","blocking: / suggestion: / nit: / question: / praise:. Most review harm comes from ambiguity rather than tone; an author who cannot tell a nit from a blocker treats everything as blocking.",16-leadership
"Review order to state out loud","Correctness, then design and boundaries, then tests, then readability, then nits.",16-leadership
"SCOR, and why not STAR","Situation, Complication, Options, Result and reflection. The Options slot is what makes a story sound like judgment rather than a resume bullet; STAR has no slot for it.",16-leadership
"Little's Law, and the two ways to use it","L = lambda x W: concurrency = throughput x latency. Sizing: 3000 QPS at 50 ms needs 150 in flight. Inverted, finding the ceiling: a pool of 50 at 50 ms caps you at 1000 QPS no matter how many app servers you add.",02-distributed-systems
"The connection-pool death spiral","A downstream slows, so W rises; L = lambda W means concurrency rises; the pool is finite so requests queue; queueing adds wait, so W rises again. Latency feeds back into concurrency, which is why saturation is a cliff rather than a slope.",02-distributed-systems
"Why run at 70 percent utilisation?","Wait scales as 1/(1-rho): 2x at 50 percent, 3.3x at 70, 5x at 80, 10x at 90, 20x at 95. The knee is 70 to 80 percent. It is arithmetic, not conservatism.",02-distributed-systems
"What is write skew?","Two transactions read overlapping rows, decide, and write disjoint rows. No write-write conflict, so snapshot isolation lets both commit and an invariant over the set breaks silently. PostgreSQL REPEATABLE READ is snapshot isolation and permits it.",02-distributed-systems
"Three fixes for write skew, best first","Express the invariant as a database constraint (a counter row with a CHECK, or an exclusion constraint) so there is nothing to skew; materialise the conflict with SELECT ... FOR UPDATE; or use SERIALIZABLE, which needs application retry logic on SQLSTATE 40001.",02-distributed-systems
"Is serialisability stronger than linearisability?","Neither. Orthogonal. Linearisability is recency on a single object; serialisability is isolation across objects with no real-time requirement. Strict serialisability is both.",02-distributed-systems
"The first sentence of any DynamoDB answer","Access patterns first, schema second. The key schema is the query plan, and you cannot change it later without rewriting the data.",03-storage
"Why single-table design?","Not to save on table costs. It is so one Query against one partition returns a heterogeneous set of related items, which is DynamoDB's only mechanism for retrieving related data in one round trip. The join happens at write time.",03-storage
"GSI vs LSI","GSI: own partition key, own capacity, eventually consistent, addable later. LSI: shares the base partition key, strongly consistent, must be created with the table, and caps a partition key value at 10 GB. Default to GSIs.",03-storage
"Do virtual threads make WebFlux obsolete?","They remove the main reason most teams adopted it (scaling I/O concurrency) without losing stack traces, debuggers or thread-locals. They do not replace demand signalling across a network boundary, which is what request(n) gives you. Default to virtual threads on JDK 21+; use reactive for real streaming backpressure.",04-streaming-apis
"What is pinning, and what changed?","A virtual thread that cannot unmount from its carrier. Native frames and class initialisers pin. synchronized pinned through JDK 23 and no longer does in the common cases as of JDK 24 (JEP 491), so the answer depends on your runtime version.",04-streaming-apis
"You switch to virtual threads and throughput is flat. Why?","Threads were not the bottleneck. Check the connection pool (Little's Law caps you at N/L), then a saturated downstream, then pinning. Also: the old thread pool was an accidental rate limiter, so add an explicit semaphore per downstream.",04-streaming-apis
"Why doesn't caching fix GraphQL N+1?","The problem is 50 lookups for 50 different keys, which is batching not caching. GraphQL is a POST with the query in the body so HTTP caching does not apply without persisted queries. And client-shaped queries are unique by construction, so a response cache is cold.",04-streaming-apis
"Two rules for a DataLoader batch function","Return results in the same order and length as the key array, with null for misses (databases return their own order and omit missing rows, which silently misattributes records). And never make the loader a module-level singleton, because its memoisation crosses users.",04-streaming-apis
"The five slots in a context budget","System instructions, tool schemas, retrieved context, conversation history, and the output reserve, which comes off the top because input and output share the window. Order them stable to volatile so the prefix caches.",06-context-agents
"Prompt caching economics","A read costs about 0.1x input price; a write costs 1.25x on a short TTL or 2x on a long one. Break-even is two requests short-TTL, three long-TTL. It is a prefix match, so one timestamp in the system prompt disables it entirely.",06-context-agents
"Where does the cache breakpoint go in a multi-turn conversation?","At the end of the most recently appended turn, not at the end of the system prompt. Within a few turns the history dwarfs the system prompt, so that is where the tokens are.",06-context-agents
"What is the recall cliff in filtered vector search?","Below roughly a percent filter selectivity, HNSW traversal both slows and loses recall, because most visited neighbours fail the predicate and the graph can be disconnected with respect to the filter. Raising ef_search does not reliably fix it; exact search over the surviving set does.",07-search-ranking
"Why never post-filter an ACL?","Two reasons. Recall: with a 1 percent filter, a top-100 yields one survivor. Security: the number of results you drop leaks the existence of documents the user cannot see, which is information disclosure even when content is never returned.",07-search-ranking
"Why is interleaving more sensitive than A/B?","The comparison is within-impression rather than between-population, so the user is their own control and user-behaviour variance drops out. Published validations report one to two orders of magnitude fewer impressions for the same power.",07-search-ranking
"Interleaving vs A/B, in one line","Interleaving picks the ranker; A/B decides whether to ship it. Interleaving measures relative ranker preference only and cannot see revenue, latency or retention.",07-search-ranking
"Diagnostic order for a slow-but-healthy pod","Shape first (all pods or one, tail or uniform, what changed). Then CFS throttling, GC and major faults, per-dependency latency AND pool wait, DNS and ndots, node steal time and run queue, disk and network saturation, probe config, then profile.",08-compute-kernel
"Why is ndots:5 a latency problem?","Any hostname with fewer than five dots is tried against each search domain first, so resolving api.stripe.com issues three or four failing queries before the real one, doubled for A and AAAA. Fix with a trailing dot, a lower ndots in dnsConfig, or NodeLocal DNSCache.",08-compute-kernel
"You cannot revoke a stateless credential without...","...reintroducing state. The design question is where to put it and how much. Shrink the window first with 5 to 15 minute access tokens, then do the real revocation at the refresh boundary, which already talks to the issuer.",10-security
"Watermark vs jti denylist","A per-user tokens_valid_after watermark is one entry per user, written only on an event, and it maps onto the cases that matter (password change, account disable, global logout). A jti denylist grows with revoked tokens but can revoke one session while leaving others alive.",10-security
"Refresh token rotation with reuse detection","Each refresh issues a new refresh token and invalidates the old. If an already-used token is presented again, you cannot tell theft from a lost response, so revoke the entire family. The legitimate user re-authenticates; the attacker is locked out.",10-security
"Redux: what is server state?","Anything that originates from an API, can change without this browser doing anything, or would be different after a page reload. Typically 60 to 70 percent of a large store. It belongs in a server cache library, not a reducer.",11-frontend
"What do you lose migrating Redux to a query cache?","Normalised entity consistency. Entity adapters keep one order in one place so an edit updates every screen; a query cache is keyed by request, so the same entity can live in two entries and you must invalidate both.",11-frontend
"What is metrics cardinality, and what is the cost model?","Series = the product of every label's distinct values, and each active series costs a few kilobytes of memory plus index. The cost model is series count, not sample rate. One unbounded label (a user ID) makes it unbounded.",12-sre-observability
"Why is a cardinality OOM worse than it looks?","Because recovery is slow: WAL replay of millions of series takes minutes during which nothing is scraped and no alerting rule evaluates, and a memory-constrained pod can OOM again during replay and crash-loop.",12-sre-observability
"The cardinality policy that actually works","Three layers. A rule with a rationale (metrics are for aggregates; identifiers belong in traces and logs, linked by exemplars). Enforcement in the collection path (metric_relabel_configs, sample_limit) so a bad target fails loudly. And alerting on head series plus the churn rate.",12-sre-observability
"Cognitive load, operationally","Not workload. Count what a team must hold: services on call for, distinct domains, runtimes, integrations, stakeholder groups. The indicators are onboarding time, bus factor per area, interrupt rate, and deploy coupling.",14-architecture-patterns
"How do you validate a proposed team boundary?","Co-change analysis over six months of commits. If the cut runs through directories that change together in a large fraction of commits, it converts an in-team change into a cross-team negotiation and the boundary is wrong.",14-architecture-patterns
"The five extraction forces for a microservice","Independent scaling, independent deploy cadence for separate teams, fault isolation in-process bulkheads cannot provide, genuine polyglot need, regulatory or residency separation. Codebase size, clean boundaries and team autonomy are not on the list.",14-architecture-patterns
"How do you enforce modular-monolith boundaries?","Three mechanisms, all required. Compile-time or CI dependency rules (module system, ArchUnit, import-linter) so a cross-boundary import fails the build. One database schema and role per module so a module physically cannot read another's tables. And code ownership on each module's public API.",14-architecture-patterns
"Why double-entry rather than a balance column?","Because it gives you a checkable invariant: the sum of every entry is zero, per currency, always. That turns errors from silent and unbounded into detectable within one reconciliation cycle, and it gives you the audit trail.",15-design-answers
"How do you prevent an overdraft race in a ledger?","Make the check part of the write: UPDATE balances SET balance = balance + delta WHERE account = ? AND balance + delta >= 0, and treat zero affected rows as insufficient funds. Read-check-then-write is a write-skew bug.",15-design-answers
"What is the real bottleneck in a payments ledger?","The hot revenue or fee account that every transaction credits. Row-level lock contention on it caps throughput long before the database is otherwise stressed. Fix with sharded counters, or no projection at all for accounts nobody needs a real-time balance for.",15-design-answers
"The reliability-investment reframe","You are not asking for capacity, you are pointing out you already spend it invisibly at a worse exchange rate. Open with the number: unplanned work as a percentage of capacity, and its trend.",16-leadership
"The sentence that makes a capacity ask credible","And if the number hasn't moved by the review date, we should stop rather than keep spending. It converts a request into an experiment, and it is what makes the second ask easy.",16-leadership
"Error budget policy, and the catch","While inside the SLO the team ships at full speed; when the budget is exhausted, feature work pauses until it recovers. The catch is that leadership must sign it before the budget runs out, not during the incident.",16-leadership
"RTO vs RPO","RTO is time to restore; RPO is how much data you may lose. Independent: a system can fail over in 30 seconds and lose an hour of writes, or take 8 hours and lose nothing.",17-dr-multiregion
"Why can't you have RPO zero across regions?","Zero RPO needs synchronous replication, which makes every write wait for the remote acknowledgement. Light in fibre gives roughly 1 ms per 100 km round trip, so London to Virginia adds ~75 ms per write. Practical answer: synchronous in-region, asynchronous cross-region, so your RPO is your replication lag.",17-dr-multiregion
"The three DR dependencies everyone forgets","Identity provider, DNS (and its TTL, which bounds failover speed), and the secrets manager. Your real RTO is the max of your critical dependencies' RTOs, not your own.",17-dr-multiregion
"The reverse-due-diligence mechanic","Ask the same question of three people and compare. What does success look like at six months, and who decides whether it happened? Divergent answers mean nobody has agreed what the role is for. Write the answers down between rounds.",18-offer-and-questions
"How to ask a hard question without being adversarial","Ask about the past rather than the present, ask for a specific instance rather than a characterisation, and give permission to be honest. Walk me through your last incident and whether the action items shipped beats is reliability a problem here.",18-offer-and-questions
"The staff design-round structure","5 min clarify (requirements as numbers), 3 min capacity math out loud, 3 min API contract, 5 min data model and partition key, 10 min architecture at container level, 12 min deep dive (let them pick), 5 min failure modes and degradation, 2 min tradeoffs.",01-interview-mechanics
"The single biggest differentiator in a design round","Doing capacity math out loud and then using the result to justify a decision. It takes three minutes, almost nobody does it, and it converts every later choice from preference into consequence.",01-interview-mechanics
"Why does RRF beat weighted score blending?","BM25 is unbounded and corpus-dependent; cosine is bounded and compressed; min-max normalisation is computed against the candidate set so the same document normalises differently per query; and score distributions vary by query so a fixed weight is wrong for most. Rank means the same thing everywhere.",05-ai-llm
"What does k=60 do in reciprocal rank fusion?","Damps the difference between top ranks. At k=60 rank 1 contributes only ~1.15x what rank 10 does, so a document must rank decently in several lists rather than topping one. That rewards agreement between retrievers over confidence within one.",05-ai-llm
"The two metric families for RAG","Retrieval: recall@k, NDCG, MRR, context precision. Generation: faithfulness (every claim traceable to the retrieved context) and answer relevance. Recall@k is the ceiling; no prompt work gets you above it. One combined accuracy number cannot direct any work.",05-ai-llm
"Three LLM-judge biases and their fixes","Position bias (evaluate both orderings and require consistency), verbosity bias (instruct against length and monitor score-length correlation), self-preference bias (use a different model family as judge). And validate the judge against human labels before trusting it.",05-ai-llm
"How much does GQA buy you?","The grouping factor, directly, because KV cache size is linear in KV head count. 64 query heads with 8 KV heads instead of 64 is an 8x smaller cache, so 8x more concurrent sequences at the same memory.",05-ai-llm
"What did PagedAttention fix?","Fragmentation. Naive allocation reserves max sequence length per request because the kernel wants contiguous memory, wasting 60-80 percent. Paging allocates fixed blocks on demand via a block table, so waste is at most one partial block, and blocks can be shared for a common prefix (prefix caching).",05-ai-llm
"Why does batching transform decode but not prefill?","Amortisation. In decode the GPU reads every weight from HBM to produce one token per sequence, so reading the weights once serves the whole batch. In prefill the GPU is already saturated with arithmetic from a single long prompt, so batching just queues them.",05-ai-llm
"LLM cost levers, in order","Measure per feature with an outcome field; prompt caching (usually broken by something dynamic in the prefix); context trimming, especially retrieval k; model routing cheap-first with escalation; batch APIs; then semantic caching and distillation last.",05-ai-llm
"Why does escalation rate matter more than price ratio in model routing?","Escalated requests pay for both calls. At 30 percent escalation with a fifth-price model you save about half; at 60 percent you save almost nothing and have added latency to most requests.",05-ai-llm
"The lethal trifecta","Private data, exposure to untrusted content, and a way to communicate externally. An agent with all three is exploitable by indirect prompt injection. Remove any one leg and the attack cannot complete; the cheapest leg is usually egress.",05-ai-llm
"Why don't prompt-level injection defences work?","Instruction and injected text share one channel, so you are asking the model to make a probabilistic judgement about which text is more authoritative, and the attacker has unlimited attempts. Every published prompt-level defence has been broken. Architecture is the defence.",05-ai-llm
"What is the dual-LLM pattern?","Privilege separation. A quarantined model reads untrusted content and returns only constrained structured output; a privileged model with tools and private data acts on that structure and never sees the raw text. Cost: the privileged model has less context.",05-ai-llm
"Why is per-step accuracy useless for agents?","It compounds. 95 percent per step over 20 steps is 0.95^20, about 36 percent task success. Use task-level success against a checkable end state, including an assertion that nothing else changed.",05-ai-llm
"What is pass^k and why does it matter?","The fraction of tasks that succeed on all k independent attempts. pass@1 asks whether the agent can do the task; pass^k asks whether it reliably does. Agents degrade sharply as k rises, and consistency is what decides shippability.",05-ai-llm
"Where do most agent failures actually live?","Tool design, not model capability. Wrong tool selected means the description does not say when to call it; wrong arguments means the schema is too permissive. Tool-layer fixes routinely move pass@1 20 points with no model change.",05-ai-llm
"Why is fixed-size chunking usually wrong?","It cuts where the token counter says rather than where the meaning ends, so a procedure gets split and neither half is retrievable or usable. Recursive character splitting is strictly better at the same cost; structure-aware is better still.",05-ai-llm
"The highest-return chunking change","Prepending the heading path to each chunk. One line, free at query time, and it fixes the dominant failure in structured corpora: an orphaned fragment that contains the answer but nothing connecting it to the question.",05-ai-llm
"The tail-at-scale arithmetic","Fan out to N servers each with probability p of being slow, and the aggregate is slow with probability 1-(1-p)^N. At N=100 and p=1 percent, 63 percent of requests are slow. The tail at the leaf becomes the median at the root.",02-distributed-systems
"What percentile must you control under fan-out?","The one your fan-out demands: solve (1-p)^N >= target. At N=60 and a 99 percent target you need each backend's p99.98, not its p99.",02-distributed-systems
"Hedged requests, and the risk","Send to one replica; if no response by the p95, send a duplicate and take the first answer, cancelling the loser. Extra load is bounded at a few percent. The risk is that under overload hedging amplifies, so gate it on the observed hedge rate.",02-distributed-systems
"Why is exactly-once delivery impossible?","Two Generals. Over an unreliable channel no finite protocol lets both parties agree a message was received, because the acknowledgement can be lost. What you can build is exactly-once effects: at-least-once plus deduplication.",02-distributed-systems
"Five things an idempotency key mechanism needs","Scope the key by tenant and operation; store the result not just the key; handle in-flight explicitly with a 409; hash the request so the same key with different parameters is a 422; and propagate the key downstream.",02-distributed-systems
"The dual-write problem and its fix","Writing to a database then publishing an event are two operations with no shared transaction, so a crash between them leaves them permanently inconsistent. Fix: the transactional outbox, writing the event in the same transaction, with an at-least-once publisher and idempotent consumers.",02-distributed-systems
"What is a watermark?","An assertion flowing through a stream that no events earlier than T are still expected, so a window can close. It is a heuristic, which makes it a completeness-versus-latency dial rather than a guarantee.",04-streaming-apis
"Your Flink job consumes normally and emits nothing. Why?","A stalled watermark. An operator's watermark is the minimum across its inputs, so one idle partition freezes the whole job: no window fires, no error, normal-looking lag. Fix with an idleness timeout on the source; alert on watermark lag.",04-streaming-apis
"What must be true of your sink if you use allowed lateness?","It must be idempotent or upsert-capable, because a late event causes the window to re-fire with an updated result. An appending sink double-counts.",04-streaming-apis
"News feed: push, pull or hybrid?","Hybrid, and the reason is the follower distribution, not preference. Reads outnumber writes ~100:1 so precompute at write time, but one account with 50M followers makes a single post 50M timeline writes. Push below a threshold, pull above it, merge at read time.",15-design-answers
"Why is the celebrity pull path cheap?","A celebrity's recent posts are identical for every follower, so that cache entry is written once and read by millions. And the number of celebrities any one user follows is small, so the merge is bounded.",15-design-answers
"CVSS vs EPSS vs KEV","CVSS scores intrinsic severity, EPSS predicts probability of exploitation in the next 30 days, KEV is CISA's catalogue of confirmed active exploitation. Three different questions; a priority is the combination plus your exposure.",10-security
"The patching order","KEV first, because observed exploitation beats any prediction. Then EPSS times exposure. Then CVSS times exposure times data sensitivity. 'We patch all criticals in seven days' without exposure context is the junior answer.",10-security
"What bounds your patching velocity?","Inventory accuracy. You cannot patch what you do not know you run, and most organisations fail at that step rather than at applying the patch. An SBOM registry that answers 'who uses this library' in minutes is the first investment.",10-security
"An engineer missed three commitments. First move?","Not the conversation. An hour of preparation, because it is a symptom with about six causes and at least two of them are management failures: interrupt load, and someone not feeling able to say work was slipping.",16-leadership
"How does a missed-commitments conversation end?","One specific change from them, one specific change from you, a check-in date close enough to be real, and a written summary the same day. No surprises at review time only works if the conversations happened and were recorded.",16-leadership
"Zero trust in one sentence for a director","Being on our network currently means being trusted, so a phished laptop can reach the customer database. Zero trust checks every request against who you are, what device you are on, and whether you should have that specific access, every time. One compromised laptop stops being one compromised company.",10-security
"The zero trust sequencing, and why","Identity, device, workload, network, data. Identity first because everything downstream needs a reliable answer to who is asking, and SSO is the one security project users like, which makes it fundable. Network is fourth because segmenting by IP is brittle; you want to segment by workload identity.",10-security
"Zero-downtime reindex, in one line","Applications read and write through an alias, never a concrete index name, so the switch is one atomic _aliases call and the rollback is the same call reversed.",03-storage
"Two settings that halve reindex time","Zero replicas and refresh_interval -1 during the bulk load, because both multiply indexing work and neither is needed while nobody reads the index. Restoring them before the swap is the step people forget.",03-storage
"How do you handle writes during a reindex?","Dual-write from the application, or repeated delta passes filtered on updated_at with version_type external so they are idempotent and cannot overwrite newer documents with older ones, or replay from the source of truth if you have CDC.",03-storage
"Deploy vs release","Deployment moves bits onto infrastructure; release exposes behaviour to users; a feature flag decouples them. Deploy continuously, release deliberately.",13-deployment-delivery
"The biggest benefit of decoupling deploy from release","Not rollback speed, though 4 seconds beats a 25-minute redeploy. It is that trunk-based development becomes possible, because unfinished work merges behind a disabled flag, which removes long-lived branches and merge hell as a category.",13-deployment-delivery
"What does NOT decouple with a feature flag?","Database schema (needs expand-contract), cached and serialised data (version cache keys with the schema, or the old path reads a format it cannot parse), published events (consumers deploy before producers), and irreversible external side effects.",13-deployment-delivery
"The four feature-flag types","Release (days to weeks, deleted after rollout), ops/kill switch (permanent infrastructure), experiment (owned by the A/B platform), permission/entitlement (permanent business rule). Only release flags need an expiry policy.",13-deployment-delivery
"Contract testing, in one line","Consumers declare what they need in executable form; consumer tests run against a mock generated from that; the provider's CI replays every consumer's contract against the real provider. The two sides never run at the same time, so no shared environment is needed.",13-deployment-delivery
"What contract testing cannot catch","Emergent behaviour. Two services can each satisfy their contracts and produce a wrong outcome together, like marking an order shipped before payment settled. Keep three to five end-to-end tests plus synthetic monitoring for that.",13-deployment-delivery
"Why 40 services is tractable for contract testing","The interaction graph is sparse. Forty services typically have fewer than 100 real consumer-provider edges, not 1,560, so the work scales with edges rather than with the square of the node count.",13-deployment-delivery
"A director wants a date you cannot commit to. First move?","Ask what the date is anchored to. A contract, a customer commitment already made, a conference and a stretch target need completely different responses, and the real constraint often has a better answer than either party started with.",16-leadership
"How do you quote a date credibly?","With percentiles from historical cycle time, not story points: 60 percent confidence on the 29th, 90 percent on the 12th. Points measure imagined effort; cycle time measures what happened. And commit to 60-70 percent of theoretical capacity.",16-leadership
"Two teams building the same service. First move?","Verify the duplication is real, because they are often solving different problems that look alike. Then quantify the cost in engineer-years, confused consumers and any live correctness divergence, and translate it into whatever the decision-maker already said they wanted capacity for.",16-leadership
"How do you make a consolidation actually happen?","Give the losing team something real: they own the migration, their distinctive features get ported, their lead is named as a contributor. 'Your year of work is deleted' is why consolidations get agreed and then quietly not done.",16-leadership
"Promotion, one level short: the question that decides whose problem it is","Have they had the opportunity to demonstrate what is missing? If the gap is cross-team scope and every project you assigned was inside the team, the gap is yours, because at this level the evidence comes from the work someone is assigned.",16-leadership
"What do you promise in a promotion conversation?","The packet and your advocacy, never the outcome, because you do not control the calibration room. Plus a commitment to say in January if it is not tracking, so they do not find out in March.",16-leadership
"Serverless vs containers: the crossover","Around 30-40 percent average utilisation. Below it, per-request billing wins; above it, per-time billing wins because the time is fully used. Committed-use discounts push the crossover down to roughly 20 percent.",08-compute-kernel
"How do you size the container for the comparison?","Little's Law: concurrency equals throughput times latency. 50 requests/sec at 200 ms is 10 in flight, so about 2 vCPU with headroom, not a guess.",08-compute-kernel
"The constraint that overrides serverless cost math","Connection management. A function per invocation cannot hold a pool, so hundreds of concurrent functions exhaust the database. That is the most common way function architectures fail at scale, and it fails rather than merely costing more.",08-compute-kernel
"Where is the durability boundary?","fsync. write() returns when data is in the page cache, which is RAM, so it survives a process crash and nothing else. fsync pushes to the device and flushes the device cache. Commit path: append to WAL, fsync WAL, then acknowledge.",08-compute-kernel
"fsyncgate, in one line","On Linux a writeback failure can be reported once and the dirty pages then marked clean, so a retried fsync returns success against data that is gone. PostgreSQL 12+ panics on fsync failure rather than retrying.",08-compute-kernel
"synchronous_commit = off vs fsync = off","The first loses a bounded window (about 200 ms) of committed transactions and leaves the database consistent. The second risks corruption. Teams conflate them.",08-compute-kernel
"Why is etcd sensitive to disk latency?","Every Raft log append is an fsync before a follower can acknowledge, so commit latency is local flush plus a quorum round trip. A 10 ms fsync caps cluster write throughput regardless of network speed.",08-compute-kernel
"eBPF: the signature that means reach for it","The caller and callee disagree. Trace says the DB call took 340 ms, the DB says 4 ms. That gap is client-side and no application instrumentation can see it.",08-compute-kernel
"The four eBPF questions, in order","Off-CPU (offcputime, runqlat), block I/O (biolatency, biosnoop), network (tcpretrans), then application internals (funclatency on a uprobe). Off-CPU first, because most intermittent latency is time not spent on CPU, which a sampling profiler cannot see.",08-compute-kernel
"Why a CPU profiler misses intermittent latency","It samples on-CPU time. The latency is usually off-CPU: run-queue wait, lock, page fault, disk, or a TCP retransmit. Off-CPU flame graphs are the artifact that answers it.",08-compute-kernel
"Cache invalidation with many dependencies: the first deliverable","A table, per entity: change rate, tolerable staleness, and fan-out per change. Price changes 50k/day with zero tolerance and fan-out 1. A category changes 20/day, tolerates an hour, fan-out 80,000. One strategy cannot be right for both.",09-caching-edge
"Tags or versioned keys?","Fan-out decides. Tags (surrogate keys) below roughly 1,000 objects per change: precise, no garbage. Versioned keys above it: one INCR beats 80,000 deletes, at the cost of superseded entries sitting until eviction.",09-caching-edge
"The subtle bug in dependency-index invalidation","The index expiring before the entries it tracks. The purge finds an empty set, deletes nothing, and pages stay stale until their own TTL. Give dependency sets a TTL strictly longer than the entries.",09-caching-edge
"Why CDC for cache invalidation instead of app-emitted purges?","An app-emitted purge is a line of code someone can forget: the admin tool, the importer, the migration, the manual data fix. CDC reads the write-ahead log, so it captures every write path including the ones that bypass your service.",09-caching-edge
"Why keep a TTL when purging works?","A purge is a message and messages get dropped. A purely purge-driven cache with an infinite TTL has no self-healing path: one lost message means one wrong value served forever.",09-caching-edge
"When a knowledge graph beats a vector index","Multi-hop questions where no chunk contains the chain; global questions about the corpus where no value of k works; relationship questions like dependency impact; and anywhere the reasoning path must be auditable.",06-context-agents
"The move that makes a knowledge graph affordable","Noticing how much of it already exists in structured systems: service catalogue, tracing data, org directory, ticket system. LLM extraction only for relationships that exist purely in prose.",06-context-agents
"GraphRAG global search, mechanically","Leiden community detection over the graph, hierarchically, then a pre-generated LLM summary per community per level. A global question maps over those summaries and reduces. No vector-index equivalent exists.",06-context-agents
"The three shard key tests","Cardinality (can you split?), frequency (is one value dominant?), monotonicity (does every insert land on one shard?). A key can pass one and fail the others: _id has perfect cardinality and is the worst common choice.",03-storage
"Why a monotonic shard key is fatal","Every new document has the highest value, so every insert lands in the top chunk, which lives on one shard. You get an N-shard cluster with single-shard write throughput.",03-storage
"What is a jumbo chunk?","A chunk past the size limit that cannot be split because every document in it shares one shard-key value. The balancer then refuses to move it. It is the failure mode of poor frequency spread.",03-storage
"Compound shard key: the routing rule","Only queries containing the prefix fields route. A query on the suffix alone broadcasts, exactly like a compound index.",03-storage
"Why a column rename takes five deploys","A rolling update is not atomic. Both versions serve traffic for minutes, so a bare RENAME throws on every pod not yet replaced. And rollback is a deploy backwards, so old code must work against the new schema too.",13-deployment-delivery
"The event compatibility ordering rule","Additions: producers deploy first, consumers ignore the unknown field. Removals: consumers deploy first, then the producer stops emitting. It is the reverse of intuition and getting it backwards takes down every consumer at once.",13-deployment-delivery
"Why did the rollback fail on a cache format change?","The new version left state the old one cannot read, and with a TTL the cache does not self-heal. Fix: version the cache key so the two cannot collide, and treat an unknown payload version as a cache miss rather than an exception.",13-deployment-delivery
"The five-minute habit that prevents rollback failures","Ask what state this version writes that the previous one cannot read: schema, cache, sessions, published events, object storage, queue messages. Schema migrations get reviewed; a serialisation change in a cached object does not.",13-deployment-delivery