Copy-and-Replay vs Branch-at-a-Point: Two Backup Recovery Paths
A side-by-side comparison of copy-and-replay recovery and branch-at-a-point restores, showing why restore time scales with data size in one model and not the other.
Loading…
Topic
Reliability
287 posts about Reliability. Every summary links to the original.
- 287 posts
- 45 companies
- 2 explainers
See the idea
Reliability explainers
The SQS Decision Most Diagrams Skip: Normal Work vs. Broken Work
Amazon SQS connects producers and workers, but its real design test is failure. Compare the processing path with the signals and controls needed when queue operations break.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave
In the first half of 2026, network-layer DDoS attacks exceeding 1 Tbps surged by 519% quarter-over-quarter, with 935 mitigated attacks recorded across the period. Threat actors shifted their focus toward reflection and amplification methods, making DNS-based floods and CLDAP floods the dominant vectors. Despite the rise in hyper-volumetric traffic, 96.62% of network-layer attacks remained under 500 Mbps and 90.60% ended in under 10 minutes. Geopolitical conflicts and international events heavily influenced target selection, pushing the Media, Production & Publishing industry to the top position. Because brief multi-gigabit bursts trigger downstream routing instability and application timeouts before analysts can respond, automated, always-on edge mitigation has become critical.
Unveiling good and bad behaviors on the Agentic Internet
Web traffic increasingly shifts between human interaction and automated agents, rendering point-in-time security checks ineffective against sophisticated automation. Cloudflare addresses this shift through continuous behavioral analysis designed to evaluate trust across entire user sessions rather than relying on static point-in-time hurdles. Its CDN-injected client-side system, Precursor, tracks continuous behavioral indicators like cursor movements to catch mid-session automated takeovers. To counter rapid bot adaptation, Cloudflare is introducing self-adjusting machine learning models under Adaptive Intelligence and non-deterministic defenses such as the AI Labyrinth. These tools allow site owners to poison scraper training data, trap crawlers in synthetic webs, or queue legitimate agents while dynamically penalizing abusive traffic.
Agentic payments for marketplaces: How a smart fridge can shop safely
GreenMart’s smart-fridge scenario addresses how an agent can turn a detected grocery need into an authorized order without receiving unrestricted access to household card or wallet credentials. GreenMart uses Stripe Agentic Commerce Suite to expose its catalog and checkout through a hosted Agentic Commerce Protocol (ACP) endpoint, while retaining responsibility for inventory, pricing, fulfillment, and order operations. A fridge agent discovers products and creates a checkout, and a companion app evaluates the final checkout against deterministic household rules covering items, totals, delivery, substitutions, and budgets. After approval, Link can provide bounded payment authority, while direct Shared Payment Tokens (SPTs) support lower-level Stripe integrations; virtual cards are described for eligible non-Stripe merchants. The design emphasizes auditable policy decisions, explicit escalation or denial, idempotent retries, webhook reconciliation, and stopping when changes exceed the household’s authority.
What are Agentic Workflows?
Agentic workflows are AI-driven processes that let one or more agents plan, execute, and refine multi-step tasks toward a defined goal with minimal human intervention. Unlike chatbots and fixed automation, they evaluate context and intermediate results at runtime, gather data, select tools dynamically, and adapt when outcomes are incomplete, incorrect, ambiguous, or unexpected. The described pattern combines agents and LLMs with APIs, databases, code executors, prompts, feedback mechanisms, memory and state management, and, for complex work, coordinated specialized agents. Production reliability depends on clear success criteria, action guardrails, human review points for high-stakes actions, audit trails, governance, and production-grade infrastructure. Examples include customer-service resolution, fraud investigation, supply-chain optimization, and event-driven document processing across systems.
How Salesforce Eliminated Single-Region Risk and Reduced Downtime Blast Radius at 4B Metrics/Min
Salesforce redesigned its internal observability platform, Argus, to eliminate single-region failure risks while ingesting approximately 4 billion metrics per minute. Operating out of a single AWS region previously created a global blast radius and generated high cross-region data transfer costs. To mitigate these risks without the prohibitive expense of full multi-region replication, the engineering team implemented a geo-local architecture that processes and stores telemetry closer to its origin across production geographies. A newly introduced federation query layer relies on Elasticsearch mappings to route queries selectively to relevant regional clusters, avoiding broad fan-out. The platform also adopted metadata caching for wildcard queries and implemented HTTP 206 partial-response handling to maintain visibility when individual regions experience downtime.
What is WAL backpressure, and why does ClickHouse Managed Postgres need it?
Postgres writes every change to the write-ahead log (WAL), and Managed Postgres uploads completed segments to object storage for point-in-time recovery; if uploads lag, retained WAL can fill the disk and cause a PANIC shutdown. ClickHouse Managed Postgres counters this with a data-plane systemd timer that checks pending segments every 15 seconds and uses cgroup v2 I/O controls to throttle client write bandwidth at 80%, 50%, or 20% of provisioned throughput as backlog thresholds rise. The drain path—including the archiver, checkpointer, and related processes—is placed in an immune cgroup, while client backends are throttled and reads remain uncapped. In a test with a 500 MB/s gp3 volume and an archive limited to 4 MB/s, the backlog reached 3,433 segments and 53 GiB before recovery. Once the limit was removed, the archiver cleared the queue, the throttle released automatically, and the disk stayed below 33% full.
Fixed cadence to seconds: making ClickHouse Cloud autoscaling more reactive
ClickHouse Cloud’s vertical autoscaling recommender originally ran on a fixed timer, creating latency when workloads suddenly increased and services needed resources before the next scheduled pass. The redesign keeps the periodic sweep as a safety net while adding a reactive fast path, using controller-runtime as an event-processing layer with sources feeding a shared rate-limited work queue and reconciler. The queue provides deduplication, exponential backoff, bounded concurrency, leader election, and metrics, while ClickHouse stores near-real-time signals that a polling source reads; the excerpt notes polling sets a floor on reaction speed. The reactive path is rolling out cautiously in observe-only mode, with periodic reconciliation remaining the main driver, and the stated goal is to trigger scale-ups for critical events such as out-of-memory conditions in seconds rather than waiting for the next scheduled run.
Using Triggers On Schemaless, Uber Engineering's Datastore Using MySQL
Schemaless triggers provides a scalable, fault-tolerant, and lossless way to listen for changes in Schemaless, Uber Engineering’s datastore using MySQL, and drives workflows including trip billing, analytics-warehouse ingestion, and cross-datacenter replication. Schemaless stores immutable cells and all their versions, allowing each shard to function as a partitioned change log with monotonically increasing added IDs while retaining random-access APIs. The framework tails shards through get_cells_for_shard, assigns them to worker processes under a leader, persists offsets in shared storage, and invokes column-specific callbacks such as bill_rider; handlers must be idempotent because retries can occur. Failed workers’ shards are reassigned, repeatedly failing cells can move to a separate queue, processing continues during leader or shared-storage outages although redistribution pauses, and replicas insulate triggers from database-node failures.
Dispatches from O'Reilly: The best risk mitigation strategy in data? A single source of truth
Data organizations face severe operational risks from inconsistent metrics, sprawling access controls, and incomplete change management across disparate BI tools and warehouses. Traditional remediation relies on centralized BI gatekeepers and fragmented governance frameworks, which introduces costly bottlenecks and fails to scale. Implementing a semantic layer mitigates these risks by consolidating metric definitions, business logic, and calculations into a single governed location. Centralizing access shrinks the governance surface area and allows metric updates to propagate automatically to downstream consumers, including Tableau, Power BI, Excel, and AI tools. Structured metadata captures context directly alongside models, enabling reliable self-service and federated hub-and-spoke delivery while keeping definitions auditable under version control.
Building an agentic harness that outlasts the model
Shopify’s Application Security team built an agentic harness that scans software for vulnerabilities, proves candidates with real tests, and opens Shopify-specific remediation pull requests. Its Dispatch orchestrator partitions repositories, runs category-specific Hunting agents in parallel, verifies findings sequentially with a different model, and persists architecture artifacts for later diff-based scans. Test oracles require realistic integration or functional coverage, including cross-tenant fixtures for IDOR checks, while unproven candidates are rejected or downgraded. Across more than 80 applications and thousands of scans, the workflow produced over 300 findings, including two rated Critical by Shopify’s severity calculator, with full scans costing $50–$300 and incremental scans $5–$50. The post concludes that durable value lies in the harness’s verification, partitioning, cross-model review, and deterministic infrastructure rather than in any single model.
Building Reliable Production AI with Durable Workflows
AI prototypes rely on simple prompt-response interactions, but production AI systems handling thousands of records must manage distributed execution issues like worker crashes, rate limits, and transient failures. Rather than treating long-running operations as single large jobs or rebuilding state from logs, systems require durable workflows that preserve execution history across failures. In Agentforce Grid, execution is organized into a hierarchy where column runs divide into recoverable batches and rows composed of discrete activities. Each batch checkpoints after every successful row, retrying up to ten times with exponential backoff and resuming strictly at incomplete work to prevent duplicated model calls. Exposing progress across these hierarchical boundaries ensures that both users and engineers can distinguish completed, failing, and retryable units.
AI Sovereignty is Your Alpha: How to Avoid Transferring Your Alpha to a Hosted Model Provider
The document examines how use of third-party AI model services can expose an organization’s “alpha”—institutional knowledge and tradecraft embodied in data sent to and generated from models—to hosted model providers. It identifies risks involving provider reuse, storage, human review, model or service improvement, contractual liability caps, ZDR-ineligible beta services, safety-classifier triggers, and inference routed through prohibited regions. Its recommended approach combines contractual protections with operational controls: define robust Zero Data Retention, limit data use to service delivery, bind both hyperscalers and relevant AI labs, maintain an allow-list, block beta headers, and constrain unilateral term changes. It also calls for observability and contractual incident safeguards, including investigation periods, migration buffers, and regional routing limits, while noting that the document is not legal advice.
amazon.science
Amazon is investing in the Lean Focused Research Organization
As AI agents handle high-stakes operational and financial decisions, traditional software testing fails to provide exhaustive correctness guarantees across all possible inputs. Mathematical proof offers deterministic verification that systems cannot behave incorrectly, but requires accessible tooling to function at modern software scale. To address this, Amazon announced substantial long-term financial backing for the Lean Focused Research Organization, representing the largest donation in the organization's history. Internally, Amazon relies on Lean for verifying differential-privacy mechanisms in AWS Clean Rooms, hardware compilation in AWS Neuron, and policy constraints within Amazon Bedrock AgentCore. Developing Lean externally through an open-source research organization provides independent auditability for regulators and accelerates community-driven tooling for neurosymbolic AI safety.
From 57 bugs to 1, thanks to Seer
Software teams frequently defer low-priority bugs to the backlog because manual triage, investigation, and code fixes consume valuable engineering time. To resolve 56 out of 57 backlog bugs, Dan Mindru utilized Sentry telemetry combined with Seer and the hosted Sentry Model Context Protocol server. Sentry captures context including traces, logs, and session replays, allowing Seer to assess fixability scores and generate pull requests with unit tests for isolated issues. For more intricate problems, developers query production breadcrumbs and telemetry directly in their agentic editors while supplying missing historical business logic. Consequently, automated tool calling and agent workflows drastically lowered the economic cost of addressing routine production bugs.
Observability for every Supabase project with Grafana Cloud
Supabase now offers a one-click Grafana Cloud integration from its Dashboard, with the setup available on every plan, including the free plan. The setup provisions authentication, metric scraping, and a pre-built observability dashboard that tracks more than 200 metrics through Supabase’s Metrics API. Those metrics cover CPU and memory pressure, disk I/O, network traffic, connections and pooler behavior, replication lag, checkpoints, database size, and query statistics, while the same open-source dashboard definitions support self-hosted Grafana, the existing Grafana Cloud integration, and the new setup. The release is focused on metrics and is designed to accommodate logs without architectural changes; support for log drains to Grafana Cloud is already in progress. Users can start with Grafana Cloud’s free tier without a credit card on either side.
Treating Pricing Changes Like Code Deploys
Thumbtack manages marketplace pricing by updating hundreds of thousands of bid settings stored in DynamoDB across service offerings. Previously executed through individual custom Go scripts, these pricing rollouts lacked automated runtime state tracking, dynamic database throughput pacing, and durable records for reliable rollbacks. To eliminate manual operational risk, engineering introduced a shared deployment-like engine that accepts declarative target states and executes pure Go transformation functions without direct I/O. The engine enforces idempotency, conducts dry runs with validation reports to S3, coordinates atomic DynamoDB updates with audit logging, and dynamically manages write capacity. This platform standardizes pricing updates into reviewable, resumable, and reversible operations that safely skip already written rows and check for production drift during rollbacks.
Building multi-Region resiliency for AWS CloudFormation custom resource deployment
AWS CloudFormation custom resources extend template provisioning capabilities but lack built-in multi-Region coordination, risking duplicate executions and unhandled failures during regional outages. To solve this limitation, an active-active architecture leverages Amazon Simple Notification Service topics to fan out lifecycle events across primary and secondary infrastructure Regions. The primary Region processes events immediately, whereas the secondary Region processes incoming messages after a deliberate delay implemented via Amazon Simple Queue Service. Coordination relies on Amazon DynamoDB Global Tables with conditional writes to manage distributed locking and enforce idempotency. When failures occur in the primary Region, Amazon CloudWatch alarms signal Amazon Application Recovery Controller to automate failover without manual intervention.
Content Ingestion & Podcast Video Incident Report
On June 24, video transcoding infrastructure reached maximum capacity, causing hours of publishing delays for Spotify video podcast episodes. Four converging factors drove the disruption: insufficient headroom for content spikes, an active routine batch processing job, higher compute costs from a recent video quality upgrade, and a scheduling bug reducing hardware throughput by roughly 10%. Creators exacerbated the backlog by re-uploading unconfirmed episodes, while four hours elapsed between the earliest alerts and formal incident response. Engineers halted the batch job, patched the scheduling defect, and brought an extra compute cluster online to clear all backlogs overnight. Spotify subsequently increased transcoding capacity by approximately 67% and initiated cross-team investments in workload prioritization, rate limiting, and earlier capacity alerting.
What does 99.9% uptime mean for inference?
The post defines three inference reliability tiers by the failure domains each must survive: 99% requires surviving node-level GPU failures like ECC errors and thermal throttling through automated health checks and fast replica replacement within a single data center. 99.9% requires surviving a full data-center failure by deploying weights across two facilities with enough capacity on each side and routing live traffic to both continuously, not a cold standby. 99.99% requires multi-region deployment with AZ redundancy and reserved failover capacity. The authors argue that vague SLA definitions hide which failure domains are covered, and that infrastructure ownership—whether a provider controls its hardware or rents from a hyperscaler—determines how quickly failures are resolved.
Security incident disclosure — July 2026
An intrusion into part of production infrastructure was driven end to end by an autonomous AI agent system, accessing a limited set of internal datasets and several credentials used by services. The attack began through two code-execution paths in dataset processing, then escalated from a worker to node-level access and moved laterally across internal clusters while running thousands of actions in short-lived sandboxes. AI-assisted anomaly detection surfaced the compromise, and LLM-driven analysis of more than 17,000 attacker events reconstructed the timeline, identified indicators, mapped credentials, and separated impact from decoys. Hosted frontier models initially blocked forensic requests containing attack artifacts, so the investigation used zai-org/GLM-5.2 on internal infrastructure. The initial vulnerabilities were closed, affected infrastructure rebuilt, credentials rotated, and cluster controls and alerting strengthened; assessment of possible partner or customer impact remains ongoing.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.