Consistency Models Beyond CAP: Linearizability, Causal, and Session Guarantees
'Strong vs eventual' is a cartoon. The real spectrum โ linearizable, sequential, causal, session guarantees โ and how to pick per operation, not per system.
The Augmented Dev ยท Archive
Dynamics 365, Power Platform, AI, system design, and web development โ filter by theme or search across every post.
Newsletter
One email per post. No spam, no tracking pixels, unsubscribe anytime.
85 of 225 articles tagged system-design
'Strong vs eventual' is a cartoon. The real spectrum โ linearizable, sequential, causal, session guarantees โ and how to pick per operation, not per system.
Authentication, routing, rate limits, transformations, and a plugin chain โ in a tier that must add ~1ms and never be the outage. Envoy/Kong architecture from scratch.
Dual writes are a lie; the database's own log is the truth. Log-based CDC, the snapshot-plus-stream handoff, schema evolution, and ordering guarantees that survive resharding.
A billion uploads a day, a legal requirement to act in hours, and irreversible mistakes in both directions: hash matching, classifier tiers, human review queues, and appeals.
One user, twenty gateway nodes, one limit of 100 req/s. Where does the counter live? Redis+Lua atomicity, the local-cache compromise, and failing open vs closed.
Event-sourced workflow state, deterministic replay, task queues with sticky caches, and why 'just write normal code' is the hardest API promise in infrastructure.
A/B testing at company scale is a systems problem: deterministic bucketing, exposure logging as the source of truth, overlapping layers, and guardrails that auto-stop bad launches.
A billion reads per second over friends-of-friends: why Facebook put a graph API on MySQL shards, two cache tiers, and chose 'read your own writes' over strong consistency.
The gap between a trained model and a production one is plumbing: online/offline feature parity, point-in-time training data, low-latency serving, and safe model rollouts.
Why RocksDB, Cassandra, and half of modern databases buffer writes in memory and merge files forever: the LSM tree, read/write/space amplification, and compaction strategy.
Ten million series, one datapoint each per 10 seconds, queried by tags: delta-of-delta compression, the inverted index over labels, and why high cardinality kills TSDBs.
Logs are 100x your metrics volume and queried 0.001% as often. The Splunk-style full index, the Loki-style label-only bet, and bloom-filtered brute force in between.
80 milliseconds to decide if a transaction is stolen money: streaming features, rules plus models, the decision ladder, and feedback loops with week-late labels.
Top-10 is easy; 'what's my rank among 300 million players' is not. Redis sorted sets, the skip list underneath, sharded merges, and approximate ranks at scale.
Sub-second aggregations over billions of fresh events: the segment lifecycle from stream to deep storage, scatter-gather brokers, and pre-aggregation trades.
You cannot score a billion items per request. The retrieval-ranking funnel, two-tower models with ANN indexes, feature freshness, and the feedback loop that eats itself.
Where does the key that encrypts the keys live? Vault-style seal/unseal, short-lived dynamic secrets, encryption-as-a-service, and surviving your own compromise.
Every keystroke is a query with a 100ms deadline. Why autocomplete precomputes its answers, how to shard a trie, and keeping suggestions fresh without rebuilding the world.
A crawler is a BFS where the graph fights back: URL frontier design, per-host politeness, content fingerprinting, and the traps that ensnare naive crawlers.
Request-response scaling wisdom fails when connections never close. Connection registries, deploys that don't disconnect the world, and the reconnect stampede.
500 hours of video uploaded per minute, played back on everything from fiber to 3G: DAG-based transcoding, segment-level parallelism, and how ABR actually works.
Everyone uses the lock service; few could build it. Sessions and ephemeral nodes, watches without thundering herds, the sequencer trick, and why coarse locks won.
You can't pause a pipeline to photograph it. Chandy-Lamport's marker trick, aligned barriers, and how a consistent snapshot of an always-running system actually gets taken.
S3 doesn't do transactions, yet Iceberg tables commit atomically. Snapshot trees, manifest pruning, optimistic concurrency on a pointer swap, and why Hive-style directories died.
Round-robin is where load balancing starts, not ends: consistent-hash LBs, P2C beating least-connections, deterministic subsetting, and the cold-start herd.
Active-passive wastes a region and fails over badly; active-active must answer 'who owns this write?' Region pinning, conflict surfaces, and the failover you actually rehearse.
Sixty ticks a second, 80ms apart, and everyone must agree who shot first: client prediction with rollback, snapshot deltas, interest management, and the favor-the-shooter bargain.
Google needed multi-row transactions on Bigtable and refused to build a coordinator service. Percolator's answer โ locks as data, a primary row as the commit point โ powers TiDB today.
Count a billion distinct users in 12KB, find heavy hitters in a stream you can't store, and merge p99s across shards โ the three sketches every large system quietly runs on.
Failure detection is the problem under every other distributed problem. Heartbeats that don't scale, SWIM's indirect probes, phi-accrual suspicion, and lifeguard refinements.
Billions of clicks, billed to the cent: streaming aggregation with watermarks, dedupe, idempotent sinks, and lambda-style reconciliation.
How a CDN actually works: edge PoPs, origin shields, consistent-hash cache keys, purge fan-out, and the anycast vs DNS routing decision.
Build the cache, not just use it: slot-based sharding, gossip and failover, eviction under memory pressure, and the hot-key problem that shards can't solve.
Content-addressed chunks, delta sync, metadata vs block servers, and why 'last writer wins' is the wrong answer for file conflicts.
How do 50 people type into the same document without corrupting it? Operational transformation, CRDTs, and the server architecture that makes co-editing work.
Not how to use Kafka โ how to build it: partitioned append-only logs, in-sync replica sets, high-watermarks, zero-copy reads, and log compaction.
Millions of users broadcasting location every 30 seconds, each visible only to friends: pub/sub fan-out, ephemeral state with TTLs, and the privacy-first data model.
Run a million strangers' untrusted programs a day without letting one of them own your fleet: sandbox layers, judge workers, resource limits, and contest-spike architecture.
Eleven nines of durability, exabyte scale: separating the metadata plane from immutable data blobs, erasure coding vs replication, and repair as a first-class workload.
Order books, price-time priority, single-threaded matching, and deterministic replay โ how exchanges match millions of orders with microsecond latency.
Taylor Swift goes on sale and 500K people want the same 500 seats. Seat holds with TTLs, contention control, virtual queues, and never selling seat 14B twice.
A million drivers moving every 4 seconds, matched to riders in under 10: geosharded in-memory indexes, dispatch as a distributed transaction, and surge as a control loop.
Tracing every request would need a system bigger than the one being traced. Head vs tail sampling, span ingestion pipelines, and storage laid out for trace reads.
The always-writable database: sloppy quorums, R+W tuning, vector clocks vs LWW, read repair, anti-entropy with Merkle trees โ the machinery behind Cassandra and Riak.
Dijkstra on a planet-sized graph would take seconds per query. Precomputed hierarchies answer it in milliseconds โ plus map tiles and the live-traffic ETA loop.
How Google Spanner gives serializable transactions across continents: TrueTime's bounded clock uncertainty, commit-wait, Paxos groups, and 2PC on top.
Sync vs async replication, why failover loses writes, and how quorum systems skip the leader entirely. The trade-offs that set your durability story.
Hash vs range partitioning, choosing a shard key you won't regret, the hot-partition problem, and why cross-shard queries are the real cost of sharding.
Delayed jobs, cron at scale, and work claiming with SKIP LOCKED. Why every scheduler promises at-least-once and what that forces on your handlers.
Precompute every follower's timeline or assemble it per request? The celebrity edge case that breaks the pretty answer, and the hybrid everyone ships.
Why 'UPDATE balance' is a bug, how double-entry bookkeeping becomes a schema, and the idempotency and reconciliation machinery that keeps money honest.
Why auto-increment dies when you shard, why random UUIDs wreck index locality, and how time-ordered IDs like Snowflake and UUIDv7 thread the needle.
A lock with a TTL can expire while its holder still thinks it owns it. Fencing tokens fix what timeouts break โ and most lock problems have better answers.
B-trees can't answer 2D questions. Geohash, quadtrees, and hex grids turn 'within 2km' into a prefix scan โ plus the boundary problem that trips everyone.
Overloaded systems don't slow down gracefully โ goodput collapses. Admission control, criticality tiers, and retry budgets decide what breaks and what survives.
Leader election, log replication, and the quorum-overlap trick that makes Raft safe. What etcd, Consul, and Kafka KRaft are actually doing under the hood.
Why column-oriented databases run analytical queries 100x faster than row-oriented ones โ covering physical layout, compression algorithms, vectorized execution, and predicate pushdown with concrete examples.
A deep dive into how Kafka distributes work across consumers, why rebalancing stalls your pipeline, and how to choose an offset commit strategy that matches your delivery guarantee requirements.
Why PostgreSQL's connection model breaks under load, how PgBouncer fixes it, and how to configure transaction-mode pooling without getting bitten by prepared statements or advisory locks.
Why dual writes lose events, how the transactional outbox pattern fixes it, and the relay, ordering, and cleanup decisions that make it production-ready.
Signing, retries, ordering, and dead-lettering: the design decisions that separate reliable webhook delivery from silent event loss.
A fast producer and a slow consumer is a recipe for an out-of-memory crash. Backpressure is the discipline of letting the slow part tell the fast part to wait. Here is how to design it in.
More connections is not more throughput. Past a point, adding connections makes your database slower. Here is how pools actually work and how to size one without guessing.
How does a database survive a power cut mid-write without corrupting your data? The answer is a deceptively simple rule: log the change before you apply it. Here is why WAL is everywhere.
A Bloom filter answers 'have I seen this?' using a tiny fraction of the memory a real set would need. The price is false positives โ and understanding that trade is the whole skill.
A single ACID transaction can't span order, payment, and inventory services. Sagas chain local transactions with compensating actions to keep distributed state consistent โ eventually.
When a downstream service slows down, naive retries turn one sick dependency into a system-wide outage. A circuit breaker fails fast, sheds load, and gives the dependency room to recover.
You wrote to the database and then published an event โ and the publish failed. Now your systems disagree. The outbox pattern makes the write and the event atomic without a two-phase commit.
When you add a node to a sharded cache, naive hashing remaps almost every key. Consistent hashing moves only a fraction. Here is the mechanism, the virtual-node fix, and the traps.
A practical guide to the design decisions that determine whether an event-driven system stays maintainable or quietly rots โ delivery guarantees, ordering, idempotency, schema evolution, and the outbox.
Walk through the architecture of a production search system โ inverted indexes, BM25 ranking, vector embeddings, and hybrid retrieval for 50M documents at 10K QPS.
A system design deep dive into building a notification platform that handles push, email, SMS, and in-app notifications at scale โ covering architecture, priority queues, fan-out strategies, rate limiting, and delivery tracking.
Retrieval-augmented generation demos look great. Production RAG is a different engineering problem โ chunking, hybrid retrieval, reranking, evaluation, and the failure modes nobody mentions at conferences.
A deep dive into the three dominant API paradigms โ REST, GraphQL, and gRPC โ covering design principles, pagination strategies, versioning, authentication patterns, and practical guidance on choosing the right one for your system.
A comprehensive guide to event-driven architecture โ covering pub/sub, event sourcing, CQRS, saga patterns, message broker trade-offs, and the hard lessons teams learn in production.
A practical comparison of the vector databases people actually deploy in 2026 โ and an honest look at when a vector database is the wrong tool for the job.
A deep dive into caching patterns that power the world's fastest systems โ from cache-aside and write-through to multi-level architectures, stampede prevention, and real-world eviction strategies at scale.
Idempotency keys are what separate a payment system that double-charges during a retry from one that doesn't. The mechanism looks simple and has five subtle failure modes you need to know about.
Cut through the hype and understand when a monolith, modular monolith, or microservices architecture is the right fit. Covers service boundaries, data ownership, communication patterns, and practical migration strategies.
Understand how database indexes work under the hood, from B+ tree internals to composite index design. Learn to read EXPLAIN plans, avoid common anti-patterns, and make informed trade-offs between read performance and write amplification.
LLM-powered pipelines break in the same ways old monoliths did โ when you stack synchronous calls. Queues, events, and the patterns that make a six-step AI pipeline survive a partial outage.
A complete system design walkthrough for building real-time chat at scale โ covering WebSocket management, message delivery guarantees, presence systems, group chat fan-out, and end-to-end encryption.
A deep dive into the CAP theorem โ what it really means for distributed systems, why you can only pick two guarantees, and how real databases like Cassandra, MongoDB, and DynamoDB make their trade-offs.
Three patterns for multi-tenant data isolation in SaaS, the trade-offs between cost, blast radius, and compliance, and a migration path from one to another when you outgrow your first choice.
A complete walkthrough of designing a URL shortener service โ covering hashing strategies, database schema, caching, analytics, and scaling to billions of redirects.