Masking moves failure
Masking a failure moves it from a channel with a schema to a channel without one.
What it is
Masking turns failed requests into slow ones, so the industry systematically moved its failures from the error channel to the latency channel. That was the right choice for availability, and it has a consequence nobody priced: the error channel has a schema, an observer and an alert; the latency channel has a distribution nobody is watching the tail of. Errors are counted, logged, typed and paged on. Latency is averaged. A failure moved from the first channel to the second becomes invisible by that move alone.
From Emergent Failure Dynamics › Fail-slow hardware
What it assumes but cannot verify: that the capacitor is charged and the firmware will finish the job. A degraded battery makes controllers fall back silently to write-through (each write goes to disk before it is acknowledged). The symptom is a 50× throughput collapse in a system that is still perfectly correct. It is the hardest class of incident to diagnose, because nothing is broken and every check passes.
From Persistence & Durability › Battery-backed memory, NVRAM
Where it appears
In 13 mechanisms. Each says what the mechanism is about, then how this principle shows up there, in its own words.
- Persistence & Durability
When a system says "yes, your data is safe", what exactly has it promised, and what did it have to do to keep that promise?
The symptom is a 50× throughput collapse in a system that is still perfectly correct.
Read it inBattery-backed memory and NVRAM
- Consistency & Isolation Models
When many users, many objects and many copies exist at once, which histories does the system promise never to show, and who writes the code for the histories it does show?
LWW is convergence bought by silently losing data.
- Query Planning & Optimization
How does a system choose a plan for a question when the facts that decide the best plan are unknown until the plan has run?
If the data violates the constraint, the answer is silently wrong.
Read it inRule-based optimization
- Emergent Failure Dynamics
What happens when nothing is broken, every component is healthy, and the system's own response to stress makes the stress worse?
One line: masking converts availability failures into latency failures, and latency is the channel with no error type, no alert and no owner.
Read it inFail-slow hardwareTrigger versus sustaining effect
- Time & Temporal Semantics
When am I allowed to act on data that may still be incomplete, and what do I owe the reader if I was wrong?
It is an instance of the rule "masking moves a failure into a channel that has no schema": the error is still there, but there is no column in which anyone can see it.
Read it inLate data: drop, divert or re-fire
- Streaming
What does it cost to remember, when the input never ends?
Retention limits chosen for memory reasons become correctness limits, and they fail without raising anything.
Read it inState TTL and expiry
- Change Data Capture & Incremental Processing
What does it cost to know what changed, and is that cheaper than not needing to know?
In one line: merge is only as correct as the key's uniqueness, stability and non-nullity, and a key change is a delete the source will not call one.
Read it inKeys, and why upsert presupposes them
- Schema Management & Evolution
What happens when the shape of your data changes on its own schedule, and nobody can change the readers, the writers and the old data at the same moment?
Promotion is a provable widening; coercion is a lossy parser dressed as a cast.
Read it inType promotion versus coercionDead-letter versus permissive parsingIdentity by position
- Data Quality & Validation
How do you check that data is right, when "right" is a claim about the world and not about the bytes?
Quarantine converts a missing-data problem into a biased-data problem.
Read it inQuarantine: how a loud failure becomes a quiet biasDeclarative constraints: why the warehouse stopped enforcing them
- Metadata, Catalog & Lineage
What can a system prove about its data without reading the data, and how does it know that proof is still true?
If identity is a path, every rename is a silent delete.
- Observability & Operations
What is the smallest description of a running system from which we can find a fault, fast enough to matter, at a cost we can still pay while the system is failing?
Remediation frequency is itself a first-class metric.
Read it inRunbooks and auto-remediation
- Security & Privacy
How do you protect data from someone who watches your design and then chooses how to attack it?
Masking the output does not mask the predicate.
Read it inMasking and tokenization
- Specialized Processing Models
What do you build when a query predicate cannot be reduced to a range over an ordered key?
One line: a coordinate is meaningless without its CRS, a CRS is a unit, and unit errors here are silent.
Related
Made on the same pages most often.