Guarantees have scope
Atomicity is bounded by the shared commit substrate.
What it is
3. Every guarantee has a scope, and the scope is the whole claim. "Ordered" means nothing. "Ordered per key, per producer session, within one partition, when there are no retries" is a claim you can check. On one machine a guarantee was usually total: the disk either wrote the block or it did not. Here, guarantees without a stated scope are the main source of production surprises, and they usually come from a vendor's marketing page and not from anyone's decision.
From Data Movement › The epistemic limit
Every control is bounded by the jurisdiction of its enforcement point. Key policy, vending authority and provider custody are all subject to some legal system, and no cryptographic property survives a key holder who is compelled. This is the only constraint across the platform that is not physical, logical, economic or organizational. It is legal, and it is outside the reach of engineering.
From Security & Privacy › Protection gaps, residency
Where it appears
In 11 mechanisms. Each says what the mechanism is about, then how this principle shows up there, in its own words.
- Data Movement
How do records cross between two systems that have independent rates, independent availability and independent lifetimes, and what are you willing to lose when the assumption underneath the crossing breaks?
Every guarantee has a scope, and the scope is the whole claim.
Read it inWhat changed: the epistemic limitMessage keys and key-based orderingDelivery semantics: the basics
- Persistence & Durability
When a system says "yes, your data is safe", what exactly has it promised, and what did it have to do to keep that promise?
The second is the one nobody writes on the architecture drawing.
Read it inDurability across a pipeline
- Distributed Systems Coordination
Who is allowed to decide, and how does everyone else learn the decision without asking?
A clock is safe to build on if and only if its error bound is exposed and enforced, not if and only if it is accurate.
Read it inClocks: three requirements
- Scheduling & Workload Management
Which work runs now, which work waits, and who pays for the waiting?
Two fixes exist, and both make priority a property of the resource, not just of the task:
Read it inHead-of-line blocking and priority inversionFrom how to whichMulti-tenant isolation and quotas
- Change Data Capture & Incremental Processing
What does it cost to know what changed, and is that cheaper than not needing to know?
In one line: schema is an in-band, ordered event; additive changes propagate themselves, and everything else needs a human on both sides.
Read it inSchema change propagation
- Table & Storage Maintenance
Who pays for the gap between the order data arrives in and the order it is read in: the writer, every reader, or a background job, and what is the break-even?
That makes the retention window not a policy but a bound on maximum query duration.
Read it inVacuum: reachable is not in use
- Schema Management & Evolution
What happens when the shape of your data changes on its own schedule, and nobody can change the readers, the writers and the old data at the same moment?
Adding a value to an enum is compatible by every test a registry applies: same type, same width, every old value still valid.
Read it inEnum and symbol-set evolutionCompatibility modes from deployment order
- Metadata, Catalog & Lineage
What can a system prove about its data without reading the data, and how does it know that proof is still true?
Automated classification plus lineage propagation is best-effort privacy that is presented, and audited, as a control.
- Observability & Operations
What is the smallest description of a running system from which we can find a fault, fast enough to matter, at a cost we can still pay while the system is failing?
Boundary condition: canaries prove liveness and path correctness, never correctness at volume or under skew.
Read it inCanaries and synthetic transactions
- Security & Privacy
How do you protect data from someone who watches your design and then chooses how to attack it?
Delegation must attenuate, never amplify.
Read it inDelegation chains and egressRow- and column-level securityConsent, clean rooms and synthetic dataMasking and tokenizationEncryption in transit, key rotation and crypto-shreddingProtection gaps and residencyThree control surfaces, in order of desperation
- Measurement & Experimental Method
What would have to be true for this number to mean what I think it means?
Width is inclusive, the sampling frequency sets the blind spot, and the clock you sample on decides which half of the truth you see.
Read it inFrom a number to a map: flamegraphsWhat kind of thing is a measurement?Workload realism and scale laddersReproducibility versus validity; pinning environmentsThreats to validity and scale honesty
Related
Made on the same pages most often.