the glossary.

The property that makes batching free. If a merge is associative, a replica can fold updates in whatever bundles the network happened to deliver — one at a time, or a thousand at once after a partition heals — and land on the same state, so the sync protocol is allowed to be an implementation detail rather than part of the correctness argument. Associative, commutative and idempotent together give a bounded semilattice, and that structure is the actual theorem behind "converges without coordination": order-free, grouping-free, duplicate-free, in that order.

A float32 exponent runs from −126 to +127, and storing a signed number would mean either a sign bit of its own or two’s complement — both of which break ordering. Instead 127 is added first, so the whole range lands in 0…255 and the stored bits rise monotonically with the value. The payoff is that two positive floats can be compared as if they were plain integers, bit pattern against bit pattern, which is why hardware comparison is one instruction. The two ends of the stored range, all-zeros and all-ones, are reserved for the special values.

The strongest fault model, and the one whose cost is easy to under-read from the formula. N ≥ 3f + 1 says three nodes cannot survive one traitor, and the reason is worth holding onto: the two honest nodes each receive a different story and have no way, from inside, to tell which of the other two is the liar. Everything expensive about BFT protocols follows from needing to distinguish that. The practical point is the diagnostic one — ordinary production failures are crash-stop or grey, not malicious, and paying Byzantine prices for them buys nothing.

The model that matches how people actually read a system, which is why it is enough for most social products: a reply never appears before the thing it replies to, and nobody notices or cares which of two unrelated posts landed first. What it gives up is the single global order, and that is a real forfeit rather than a technicality — two replicas can disagree about concurrent writes forever and both be correct. The machinery is a version vector or a vector clock per replica, no leader and no quorum round, which is why it survives a partition while linearizability does not.

A standard deviation of 6 means nothing until you know whether the mean is 40 or 4,000. Dividing by the mean turns it into a percentage and makes it portable: the team in the essay below runs at about 15%, and that number can be set beside a team scoring on a completely different scale. It is also the term that carries the whole cost of an experiment — the required sample size grows with its *square*, so halving a team’s variability cuts the wait to a quarter.

The property that lets replicas apply the same set of updates in whatever order they receive them and still agree. Counters and set-unions have it; a multiply mixed in with an add does not, and a single non-commutative operation in the mix is enough to force ordering back onto the system — which means coordination, which means latency and a leader. This is the first of the three properties behind CRDTs, and the one that most often fails quietly: an operation that looks like an increment but reads the current value before writing is not commutative at all.

The honest name for what working systems actually have, and the reason the essay spends its warning on Kafka rather than on theory. End-to-end exactly-once is not a feature to switch on; a sender that cannot tell a lost message from a lost acknowledgement must choose between losing and duplicating, and every real pipeline chooses duplicating. What makes the duplicate harmless is deduplication in the consumer, which means the guarantee lives in your handler and not in the broker. Side effects that leave the system — an email, a third-party charge — each need their own idempotency key, because the broker’s transaction cannot reach them.

Read the definition for what it does not say. It does not order the writes on the way there, and it does not bound how long "eventually" is; both are left to the implementation, and both have to be asked about by name rather than assumed to be milliseconds. The conditional matters too: convergence is promised *if writes stop*, and a system under continuous write load has no moment at which the guarantee is testable. It is the right floor for a shopping cart or a like count, and the wrong one for anything a second reader will make a decision on.

The other half of the lease, and the reason the pair works where either alone does not. The insight is that the check has to move: the lock service cannot stop a paused client from writing, but the *resource* can refuse a write whose token is below the highest it has seen. Monotonicity is doing all the work — the storage layer needs no clock, no membership view and no opinion about who should be leader, only the ability to compare two integers. This is why "we have a distributed lock" is not yet an answer to split-brain.

The whole of the format is a convention: the bits are a plain integer, and the reader agrees where the point sits — Q16.16 means sixteen bits of whole part and sixteen of fraction, a step of 2⁻¹⁶ everywhere on the line. That uniformity is the point. Money is counted in fixed-point (or in integer cents) because a cent must weigh the same at ten and at ten million, and a format whose step grows with the value cannot promise that. What it gives up is range: the same bits that buy a constant step near zero run out early at the top.

The failure mode that outlasts the outage it should have been, because every automatic remedy is waiting for a signal that never arrives. The mechanism is a gap in observation: the system judges its own health with a different measurement than the one its clients experience, and grey failure is exactly the region where those two disagree. The design consequence is specific — a health check that answers for the node rather than for the request is not a detector, and adding more such checks does not make one. Measure the thing the caller actually waits on.

Lamport’s answer to having no global clock. Notice that the relation is defined by three rules and nothing else, which means most pairs of events in a real system are simply unordered — not simultaneous, not tied, but *concurrent*, with no fact of the matter about which came first. That is the point rather than a gap in the definition: a system that has not exchanged a message has no way to know, and any order you print for such a pair is invented. Every causal mechanism downstream — vector clocks, version vectors, CRDT delivery — is an encoding of exactly these three rules.

The property that makes retrying safe, and therefore the property every at-least-once pipeline is silently built on. The test is the operation’s *effect*, not its shape: SET A 5 qualifies and ADD A 5 does not, and no amount of careful retry logic converts the second into the first. The common mistake is to inherit it from a layer that cannot give it — HTTP calls PUT and DELETE idempotent at the protocol level, which says nothing about whether your handler writes a row per call. It is also not commutativity: idempotence is about repetition, commutativity about order, and a system replaying out-of-order messages needs both.

The TTL is there to solve one problem: a holder that dies while holding a plain lock blocks the resource forever, and no third party can safely take it away. An expiry makes the grant self-healing without anyone having to judge whether the holder is really dead. What it does not solve is the holder’s own view of time. A process paused past its expiry has no way to notice, so it wakes up and acts on a lease that has already been reissued — which is why a lease alone is half a design, and the other half lives at the storage layer.

The strongest consistency property you can actually build, and the most over-bought. Two words in the definition carry the cost: *one object*, and *real time*. Because it is per-object, it says nothing about two objects changed together — that is the transactional question, and reaching for linearizability to answer it buys the wrong guarantee at the higher price. Because it respects real time, an acknowledged write must be visible to every later reader, which forces a consensus round or a bounded clock onto the critical path. Most requests that arrive asking for "strong consistency" are satisfied by read-your-writes, which costs a sticky route.

The half that cannot be disproved by any finite run: no matter how long you watch nothing happen, "eventually" has not yet failed, which is why liveness is the hard one to test and the easy one to lose. Almost every guarantee with "eventual" in its name is a liveness claim, and almost none of them come with a bound — that missing bound is the same gap the essay flags under eventual consistency. Pair it with safety to read a design honestly: safety says the system will not be wrong, liveness says it will not be useless.

Also called the significand. In IEEE 754 the mantissa is stored normalised, as a fraction after an implied leading 1, which is why a 23-bit float32 field buys 24 bits of precision: the first bit is never written down because it is never anything else. This is also why precision is a fixed *number of digits* rather than a fixed step size — the mantissa says how many digits, the exponent says where they sit. Doubling a value leaves the mantissa alone and adds one to the exponent, so the gap to the next representable number doubles with it.

A small word carrying a large theorem. CALM states the equivalence in both directions: a program has a coordination-free distributed implementation if and only if its logic is monotonic. The direction that changes decisions is the second one — non-monotonic logic does not merely benefit from coordination, it provably requires it, so an operation that has to observe an absence (a count, a minimum, "nobody else has claimed this") is where the latency comes from and no amount of engineering removes it. The practical move is to redesign toward monotone forms, not to optimise the barrier.

The guarantee that stops time going backwards for one reader. Without it, two reads a second apart can land on different replicas and the second can be staler than the first — the refresh that loses the comment you just saw. It is a promise about one session, not about the system, so two clients may still disagree; that narrowness is what makes it cheap. A sticky route to one replica delivers it almost for free, and a per-client version floor delivers it without pinning the route.

The write-side twin, and the one that makes a sequence of edits from one client behave like a sequence rather than a set. Without it, two writes issued in order can reach a replica in the other order and the earlier one wins, so an edit silently reverts to the value before it. Like every session guarantee it is scoped to one writer: it says nothing about interleaving with another client, and buying the per-writer version of the property is far cheaper than buying a global order to get it.

It is a value, not an error: the operation returns, and the program keeps going. NaN is contagious — every arithmetic operation touching one produces another — so a single meaningless step at the top of a long calculation is still visible at the bottom rather than being quietly absorbed. It is also the one value not equal to itself, and x != x is the honest test for it, because equality with a thing that is not a number cannot be true. That inequality is a consequence of the definition, not a quirk, and it is why a NaN sorts strangely and why a lookup keyed on floats can lose an entry to one.

Its usefulness here is not that velocity is bell-shaped; it is that *averages* are, near enough, almost regardless of what they average. Two numbers then describe the whole picture, and distances read off in widths: about 68% of the bell lies within one width of the centre, 95% within 1.96 of them. That second number is where a detection threshold comes from, and it is the only reason a rule like "under 7 points, say nothing" can be derived rather than guessed.

Named by Lepper, Greene and Nisbett in 1973, who took preschoolers already choosing to draw in free play and split them three ways: promised a certificate before drawing, given one unexpectedly afterwards, or given nothing. Two weeks later only the promised group drew less, and drew worse — and since that group and the surprise group both ended up holding the same certificate, the reward is not what did the damage. The promise is. The name is precise in an uncomfortable way: the problem is not too few reasons but too many. Given an external reason good enough to explain the behaviour, the internal one becomes unnecessary, and what is unnecessary fades.

The whole mechanism is the pigeonhole principle wearing a system-design hat: if R + W > N then the read set and the write set cannot be disjoint, so at least one node in every read has seen the newest write. Two things follow that people miss. First, a quorum is not a majority — majority is one convenient way to pick R and W, not the definition, and R=1, W=N is a perfectly good quorum with very different performance. Second, the overlap guarantees a fresh *copy is present*, not that the reader picks it; that still takes versioning or read repair.

The cheapest guarantee with the highest ratio of complaints solved, and the essay puts the number at nine out of ten. Almost every report that reads as "the system is inconsistent" is really this one property missing: the user saved, the page reloaded off a follower replica, and the change was not there. Note what it does not promise — nobody else is guaranteed to see the write yet, and there is no global order. That is the trade that keeps it to a sticky session or a version token in the client rather than a consensus round.

Half of the pair a system is analysed with, and formally the half that can be violated by a finite prefix of an execution: one bad step is proof, forever. That is what makes safety testable and what makes a counterexample so useful. Its twin is not its opposite, and the two are not a dial to trade between — a system that never does anything wrong because it never does anything satisfies safety completely and is still broken. Both have to hold; any design that claims a trade-off between them has renamed something else.

It is the square root of the sample variance, and it answers the question the variance cannot: how far off is a normal reading. For the team in the essay below it is 6.23 points against a mean of 40, which says that a sprint landing six points away from average is not an event — it is Tuesday. Everything downstream depends on it: the standard error, the detection threshold, and the number of sprints an experiment needs.

Squaring is what makes the deviations stop cancelling out, and it is also why the result is in squared units — points squared, which nothing in the world is measured in. That is the only real reason the standard deviation exists: it is the square root, taken to get back to the unit you started in. The n−1 is not a fudge; using n would understate the spread, because the sample mean sits closer to its own data than the true mean does.

The row people skip, and the one that shows the map has two axes rather than one. Sequential consistency keeps the single global order and drops only the real-time tie: everyone sees the same sequence, but a write acknowledged a moment ago may sit later in it than a read that began afterwards. That makes it strictly weaker than linearizability and strictly stronger than causal — and it is the reason "causal is sequential minus real time" is wrong. Causal drops the single global order too, which is a different relaxation entirely. Its home is shared-memory models, not databases.

The database half of the pair, and the word "some" is the whole of it. Serializability fixes the *outcome* to a serial order without fixing *which* one, so it never appeals to a clock: two transactions that ran concurrently may be serialised in either direction and both answers are correct. That is why it composes across many objects where linearizability does not, and why it cannot on its own tell you whether a transaction that committed a second ago is visible now. Adding that real-time requirement back is a separate, stronger property with its own name.

The canonical way a replicated system corrupts itself rather than merely stopping, which is why it is worth more fear than an outage. The trigger is rarely exotic: a network partition cuts the old leader off, or a garbage collection pause freezes it long enough for an election, and it wakes up still believing it holds the role. Nothing the old leader can check about itself detects this — it has no way to know time passed. The fix is therefore never "elect more carefully"; it is to make the storage layer refuse writes carrying a stale fencing token.

A sprint is short and, crucially, always the same length, which is what makes the counts from different sprints comparable at all. It is also the sample size of every argument built on velocity: a quarter of six sprints is six data points, and six is a small number to reason from. Any question of the form "did we get faster?" is really a question about how many sprints have been observed.

The distinction from the standard deviation is the one people skip and then get wrong: the standard deviation describes how scattered the individual readings are, while the standard error describes how unreliable their average is. Averaging steadies things, but only as fast as √n — four times the data for half the wobble, which is why measuring a small effect gets expensive so quickly. It is the number that decides whether a difference between two averages means anything.

Stated as a property it sounds mild; stated as a rule it is demanding — the data plane must keep serving on what it already knows, so nothing in the recovery path may depend on something that has to succeed *during* the incident. That rules out scaling up when the failure starts, fetching fresh config, and calling the API that is itself degraded. The price is paid in advance and looks like waste on a normal day: capacity provisioned and not used, state cached before it is needed. That is the shape of the bargain, and it is why the control plane and the data plane have to be independent.

Story points are deliberately not a unit of time: the team compares a piece of work against work it has done before and assigns a number, so the scale is local to that team and means nothing across teams. The trouble starts when the number is lifted out of planning, where it does useful work, and into performance measurement, where it becomes a target the same people who assign it can move. Even setting that aside, a points total is a noisy measurement, which is the subject of the essay below.

The name exists because the two properties it joins are independent, and a system can hold either one alone. Strict serializability is what a reader usually *means* by "the database is consistent": transactions are atomic across many objects, and a commit you have been told about is visible to everything that starts afterwards. It is also the most expensive point on the map, since it inherits the consensus round from the real-time half and the multi-object machinery from the other. Spanner is the reference implementation, and the uncertainty window it waits out is the price printed on the label.

Below the smallest normal value the exponent has nowhere left to go, and without subnormals the line would jump straight from that value to zero — a gap larger than the gap between any two neighbours above it. So the all-zero exponent is reserved: the leading 1 is no longer implied, and the mantissa is read as a plain fraction. The numbers reach nearer to zero, and pay for it, losing a bit of precision for every power of two they descend until nothing is left. The property this buys is that a − b == 0 if and only if a == b, which is not true in a format that flushes to zero.

You cannot drive the risk to zero, only choose it: setting it at 5% is what puts the threshold 1.96 widths out from the centre, and demanding 1% pushes the threshold further still. Every threshold is therefore a decision about how often you are willing to be fooled, made before the data arrives. Guarding against this error alone is not enough — pushing the threshold out to be safe makes the opposite mistake more likely.

The two errors trade against each other: a threshold set far out to avoid false alarms is exactly a threshold a real effect struggles to clear. An effect sitting precisely on the threshold is caught half the time, which is the uncomfortable fact that makes "we hit the number" so weak a statement. Deciding to catch a real effect 80% of the time — the usual choice — is what pushes the required difference well past the threshold, and with it the amount of data an honest answer needs.

ULP(v) = 2^(E−p): it depends on the exponent, which is to say on how large the value is. This is the single fact that makes floating-point behave the way it does. Precision is *relative* — the ratio ULP(v)/v is roughly 2^−p everywhere, so a float keeps about the same number of significant digits at 0.001 and at a billion — and it is the right unit for talking about error: "correct to within one ULP" is a claim about the format, while "correct to within 0.0001" is a claim that stops being true as the numbers grow.

Velocity is measured after the fact, not planned: it is whatever the team actually closed. Because it is a count over a fixed window it fluctuates for reasons that have nothing to do with capability — someone off sick, a story that turned out easier than it looked, a sprint that swallowed an incident. That fluctuation is the reason a quarter is a *series* and not a figure, and the reason any claim about velocity going up has to clear the noise before it means anything.