Blog

Four rate limiting algorithms, one request stream, and a harness that counts what each of them actually admits in the worst rolling second.

A list CRDT has one job — converge — so you can brute-force it: 400 operation logs, every one of the 720 delivery orders each, diff the results. Three orderings broke the naive implementation in three different ways, and one of them left every replica in perfect agreement about a scrambled document.

A Bloom filter's error rate is one of the few things we teach that you can actually check, so I built one, inserted 500,000 keys, queried it with ten million keys that were not in it, and compared the result against the textbook formula at seven different sizings.

Eight concurrent workers sharing one idempotency key turned a $49 order into $392 of real charges on PostgreSQL 17.6, and adding a FOR UPDATE row lock changed nothing at all. This walks through what actually prevents the double charge, measured at every step, and what Stripe's and Shopify's own documentation says rather than what gets repeated about them.

A measured walk through the hash ring: how much of your cache modulo hashing really destroys, how many virtual nodes you actually need for even distribution, and the 32-bit collision bug that makes the textbook implementation return unroutable keys.

Shopify replaced Redis with MySQL SKIP LOCKED for inventory reservations. DoorDash replaced Redis Cluster with stateless Kvrocks. The lesson isn't "Redis is bad" — it's about matching infrastructure to access patterns.