Browser & Frontend Runtime
Eight layers traced: from the service worker to the second navigation
One e-commerce product page: server-rendered, React-based, hero image, “Add to cart” button, a registered service worker. A mid-range Android phone, 4G. What exactly happens — in which order, across which threads, spending how much time — from the moment the user taps the link to the moment the cart badge updates?
The page we are tracing.
One concrete page: an e-commerce product page, server-rendered, React-based, with a hero image, a price, an “Add to cart” button, a reviews section below the fold, and a service worker registered from a previous visit. The user is on a mid-range Android phone on 4G. We follow this exact page from the moment they tap a link to the moment they successfully add the item to the cart.
Layer 1 — Network.
The tap triggers a navigation. DNS resolves the host, a TLS handshake secures the connection, and an HTTP request goes out. But there is a twist: a service worker from a prior visit is registered. The browser gives the service worker’s fetch handler the first look — it can serve the navigation from cache or pass it through to the network. Either way, the first byte of HTML arrives. This is TTFB, and it is the floor under everything: nothing downstream can start before the bytes are here.
Layer 2 — HTML parse and the preload scanner.
The HTML parser begins turning bytes into a DOM tree, top to bottom. Running ahead of it is the preload scanner, spotting <img>, <script>, and <link> references and kicking off their downloads early. This is why the hero image, sitting in the initial HTML as a plain <img>, starts downloading immediately — the LCP clock is already ticking and discovery happens as early as possible. A render-blocking <script> in the <head> would pause the main parser here; a defer’d one would not.
Layer 3 — CSS and the CSSOM.
As <link rel="stylesheet"> resources arrive, the browser parses them into the CSSOM. CSS is render-blocking by design: the browser will not paint until it has the CSSOM, because painting with incomplete styles would mean a flash of unstyled content. The DOM and CSSOM together form the render tree. If the CSS is large or served slowly, every paint downstream waits.
Layer 4 — JavaScript: V8 parse and compile.
The JavaScript bundle arrives and V8 goes to work — but not by running it immediately. V8 first parses the source and compiles it to bytecode (the Ignition interpreter’s input). For a large bundle this parse-and-compile step alone is tens to hundreds of milliseconds of main-thread time on a mid-range phone, before a single line has executed. This is the hidden cost inside “the JavaScript is too big”: the bytes are not just a download, they are CPU work.
Layer 5 — First paint.
With the render tree ready, the render pipeline runs: style, layout, paint, composite. The product photo, price, and layout appear. The hero image, if it has finished downloading, paints — and this is very likely the LCP moment, the largest contentful element arriving. The page now looks done. But it is a picture: no handler is attached, no state is live.
Layer 6 — Hydration.
Now React runs hydrateRoot. It walks the same component tree the server walked, and instead of creating DOM nodes it adopts the existing server DOM, attaching event handlers and wiring up state and effects — the reconciler in hydration mode. This is one long task: V8 executes the component tree, the reconciler does its render and commit. While it runs, the main thread is blocked. The page looked done at layer 5; it becomes actually interactive only when hydration reaches each component.
Layer 7 — The interaction.
The user taps “Add to cart.” If they tap before hydration reached that button, the input is delayed — queued behind the hydration long task — and INP records a large latency. If they tap after, the handler runs: it updates cart state, the reconciler re-renders the cart badge, the render pipeline paints the change. The time from tap to that paint is one INP sample.
Layer 8 — The second navigation and the worker.
The user navigates to checkout. Now the service worker earns its keep: it serves the app shell from cache, so the second navigation’s TTFB is tens of milliseconds instead of a network round trip.
- TTFB — network served
- ~300 ms
- TTFB — service worker cache
- ~30 ms
- JS parse + compile (V8)
- ~150 ms
- Hydration long task
- 300 ms – 1 s+
- Good LCP / INP / CLS
- 2.5 s / 200 ms / 0.1
- Canonical break count
- 5, one per domain
The overlapped timeline — three tracks, not one sequence.
The crucial insight is that these layers are not a tidy sequence — they overlap on a timeline across three resources:
- The network track is busy fetching HTML, then CSS, then the JS bundle, then the image, in parallel where the protocol allows.
- The main thread track is busy parsing HTML, then compiling JS, then painting, then running the hydration long task.
- The GPU track does the final composite.
A DevTools performance trace shows exactly these three tracks. Reading a slow page means finding which track is the bottleneck at the moment that matters — network-bound before first paint, main-thread-bound during hydration. The skill is not knowing the layers; it is reading where, on the overlapped timeline, the time actually went.
Parallelism: why the layers are not sequential.
The browser does not do one step, wait, do the next — it keeps all three resources busy whenever there is work. While the network downloads the JS bundle, the main thread is already parsing the HTML that arrived earlier. While the main thread compiles the JS, the network is already fetching the image. The preload scanner exists precisely for this parallelism — it finds resources and throws them onto the network while the main parser is busy with something else.
The diagnostic consequence: a “slow page” is almost never one slow step. It is the moment where parallelism broke down, where one track became the constraint and the other two sat idle waiting for it. A render-blocking script is the classic example: it stops the main parser, and while it downloads, the main thread is idle even though it could be parsing the rest of the HTML.
On the second navigation (to checkout), TTFB drops from ~300 ms to ~30 ms. Which layer is responsible?
On the trace, V8 spends ~150 ms before a single line of the bundle has executed. What is it doing?
A DevTools trace of the product page: LCP fires at 1.5 s (good). But there is a 900 ms main-thread long task starting at 1.6 s, and the user's tap on 'Add to cart' at 2.0 s shows an INP of 700 ms. What is the long task, and why is INP bad despite a good LCP?
Why is reading a DevTools trace described as finding the bottleneck 'track', not the bottleneck 'layer'?
Order the eight layers of the page's life, from the user's tap to the second navigation.
- 1 Network — DNS, TLS, HTTP; service worker gets first look
- 2 HTML parse — DOM tree, preload scanner discovers resources
- 3 CSS — CSSOM built, render tree formed
- 4 V8 — JS bundle parsed and compiled to bytecode
- 5 First paint — layout, paint, composite; LCP fires
- 6 Hydration — reconciler adopts server DOM, attaches handlers
- 7 Interaction — tap handled, re-render, INP measured
- 8 Second navigation — service worker serves the app shell
A good LCP and a bad INP coexisting — the page paints fast but cannot be tapped — has a name. It describes the window where the page is a convincing picture that does not respond. What is that window called?
On the trace, the JS bundle parse-and-compile in V8 takes about how many milliseconds for a typical bundle on a mid-range phone — the cost before any line executes?
Why this works
The eight layers are not an arbitrary list — they are the shape the web acquired over thirty years of evolution. Early pages were layers 1–3 and nothing else: network, parse, paint — a static document. JavaScript added execution, and layer 4 (V8) became significant. AJAX and SPAs pushed rendering into the browser, killing layer 5 as “first paint of something useful.” SSR brought server rendering back for fast first paint and SEO — but it also introduced layer 6, hydration, and with it the uncanny valley. Service workers (layer 8) were added to win back the instant repeat loads lost when sites moved away from static files. Each layer is a solution to a past tradeoff that became a new tradeoff.
- 01Trace the e-commerce product page from the user's tap to a working 'Add to cart' button, naming each of the eight layers.
- 02What is the three-track structure of a DevTools trace, and why does 'finding the bottleneck track' matter more than 'finding the slow layer'?
- 03Why does V8 spend ~150 ms before a single line of the bundle executes, and what does this cost affect?
A server-rendered, React-based product page traverses eight layers: network (TTFB ~300 ms, or ~30 ms from service worker cache), HTML parse with preload scanner starting the hero image early, CSS building the CSSOM (render-blocking), V8 parse-and-compile (~150 ms of main-thread work before execution), first paint and LCP, a hydration long task (300 ms to 1 s+) that blocks early taps, the interaction (INP measured tap-to-paint), and a second navigation served from cache. These eight layers run on three overlapping tracks — network, main thread, and GPU — not a single sequence. Parallelism is the norm; a bottleneck is the moment one track stalls and the others wait. The hydration uncanny valley — good LCP, bad early INP — is the structural failure of server-rendered apps: the page looks done before it works, and every tap inside the hydration long task is a delayed interaction the user feels.
- The full picture: URL to LCP to INP as a relay racejunior
- Tasks, microtasks, and scheduler.yield()middle
- Stage costs and the renderer process modelmiddle
- V8''''s four-tier JIT pipeline and profile-guided tieringmiddle
- Service worker lifecycle and cache strategiesmiddle
- Render phase purity and commit phase sub-stepsmiddle
- Hydration cost: selective, progressive, islands, resumabilitymiddle
- Core Web Vitals: what LCP, INP, and CLS measurejunior
appears again in278
- Why GraphQL gets N+1junior
- DataLoader mechanics: tick-boundary batchingmiddle
- Batch function contracts: ordering, shapes, errorsmiddle
- Federation and lookahead: batching beyond DataLoadermiddle
- Query complexity defences: depth, cost, persisted queriesmiddle
- Senior GraphQL API: scheduling contract, tenant isolation, observabilitysenior
- The journey of a request: seven stops from socket to responsejunior
- Accept and parse: from kernel queue to a typed requestmiddle
- Routing and middleware: choosing what runs, and in what ordermiddle
- Handler and response: from business logic to bytes on the wiremiddle
- Streaming and backpressure: when the client reads slower than you writesenior
- Timeouts and tail latency: budgets, deadlines, and the fan-out trapsenior
- Middleware and DI: the two patterns that shape every backendjunior
- Writing middleware: signatures, next(), and the three framework modelsmiddle
- Inversion of control: how dependencies reach a classmiddle
- DI scopes and lifecycles: singleton, request, transientmiddle
- DI as a testing seam: fakes, mocks, and the boundary that matterssenior
- DI containers in production: resolution graphs, circular deps, and when not tosenior
- Blocking vs non-blocking I/O: two ways to waitjunior
- The event loop: one thread, ordered phasesmiddle
- What blocks the loop: CPU work and sync callsmiddle
- Offloading CPU work: worker threads and the libuv poolmiddle
- Backpressure and bounded concurrencysenior
- Throughput under load: tail latency and saturationsenior
- Why pool: the cost of creating a connectionjunior
- Pool sizing: why bigger is not fastermiddle
- Acquisition and timeouts: the wait queue is the real latency dialmiddle
- Why idempotency: making retries safejunior
- Server-side state machine: four states of an idempotency keymiddle
- Retry strategies: backoff, jitter, and thundering herdmiddle
- Outbox and inbox: effectively-once across the dual-write boundarymiddle
- Concurrency and cache architecture for idempotency at scalesenior
- Observability, production failures, and global-scale designsenior
- What is a cache stampede and why it makes things worsejunior
- Lock and single-flight: bounding concurrent rebuildsmiddle
- XFetch: coordination-free probabilistic early expirationmiddle
- Stale-while-revalidate and CDN request coalescingmiddle
- Detecting stampedes and designing TTL for productionmiddle
- Metastable failure, fencing tokens, and production postmortemssenior
- What a relation is: tables, rows, keys, and constraintsjunior
- Constraints, keys, and Postgres data typesmiddle
- Normal forms, denormalization, and why schemas stickmiddle
- JSONB, arrays, and when a side table winsmiddle
- Heap storage, TOAST, and column alignmentsenior
- Schema integrity: deferral, versioning, and production failure modessenior
- Relational vs document, wide-column, graph, and key-valuesenior
- What an index is and how it speeds up queriesjunior
- The leading-column rule and composite index designmiddle
- Partial, expression, and covering indexesmiddle
- Index types: GIN, GiST, BRIN, Hash, Bloom, and HOT updatesmiddle
- Index-only scans, the Visibility Map, and INCLUDEsenior
- Production failure modes and the index audit playbooksenior
- Index design exercise: full-text search strategysenior
- EXPLAIN and execution plans: what the planner decides and whyjunior
- Scan types: Seq, Index, Bitmap, Index-Onlymiddle
- Join algorithms and the row-estimate cascademiddle
- pg_statistic, ANALYZE, and production observabilitymiddle
- Extended statistics: fixing correlated-column estimate failuressenior
- Plan cache, cost-constant tuning, and planner internalssenior
- Production failure modes and plan stabilitysenior
- MVCC: why readers and writers never wait for each otherjunior
- Row versions and snapshots: the on-disk mechanicsmiddle
- HOT updates and isolation levels: what you gain and what you paymiddle
- Vacuum and bloat: keeping the storage tax boundedmiddle
- CLOG, XID wraparound, and MultiXact: deep visibility internalssenior
- SSI internals and production autovacuum tuningsenior
- Real-world MVCC failures, deployment patterns, and distributed snapshotssenior
- Connection pools: amortising the cost of a Postgres backendjunior
- PgBouncer session, transaction, and statement modesmiddle
- Pool sizing: the (cores × 2) + spindles formula and the two-layer stackmiddle
- Pool exhaustion and idle-in-transaction: the 3 AM failure modemiddle
- Migrating to transaction mode: rollout playbook and PgBouncer 1.21 prepared statementsmiddle
- The Postgres process model and why raising max_connections degrades throughputsenior
- Pooler landscape 2026, serverless connection storms, and the full failure-mode taxonomysenior
- What a schema migration is and why it replaces ad-hoc DDLjunior
- ADD COLUMN: instant in PG 11+ vs rewrite in older Postgresjunior
- The lock-queue failure mode: why instant DDL can freeze the databasemiddle
- Safe DDL patterns: NOT VALID, CONCURRENTLY, and unsafe-op fixesmiddle
- Expand-contract: zero-downtime for breaking schema changesmiddle
- Advisory locks, migration tools, and deploy coordinationsenior
- Migration failure taxonomy and production disciplinesenior
- Why sharding exists: the single-Postgres ceilingjunior
- Shard-key selection: hash, range, list, and directory strategiesmiddle
- Partitioning vs sharding: same word, two different thingsmiddle
- Co-location and Citus: the invariant that makes sharding usablemiddle
- The hot-shard failure mode: detection, isolation, and durable policymiddle
- Schema-based sharding and multi-tenancy alternativessenior
- Online resharding, 2PC, and the operational cost of shardingsenior
- The seven acts: from CREATE TABLE to Citusjunior
- Acts 1–3 in depth: schema, indexes, and planner statisticsmiddle
- Acts 4–6 in depth: MVCC bloat, connection pooling, and safe migrationsmiddle
- Act 7 in depth: sharding, co-location, and the seven-tier tradeoff cascademiddle
- Observability, anti-patterns, and production triagesenior
- Raft roles, terms, and why majority quorums prevent split brainjunior
- How Raft replicates a log entry and decides it is safe to commitmiddle
- Raft leader election: timeouts, voting rules, and the four safety propertiesmiddle
- Raft in the real world: partitions, slow disks, and client routingmiddle
- Raft extensions: pre-vote, learners, snapshots, and linearizable readssenior
- Raft in production: membership changes, Multi-Raft, and observabilitysenior
- Where data fetching happens — and why it decides LCPjunior
- Fetch waterfalls — diagnosis and the Promise.all curemiddle
- React Server Components and Suspense streamingmiddle
- Client-side cache: TanStack Query, SWR, and stale-while-revalidatemiddle
- LCP, prefetch, and race conditions in interactive fetchingmiddle
- Senior internals: RSC payload, caching layers, and production failure modessenior
- Bits on the wirejunior
- Latency mathmiddle
- Bufferbloat and congestionsenior
- The physical frontiersenior
- The IP envelopejunior
- Reading the IP headermiddle
- The three-way handshakejunior
- Sequence numbers and connection statemiddle
- Flow control and congestion controlmiddle
- BBR, production observability, and beyond TCPsenior
- DNS: what it does and why it existsjunior
- The resolver walk: referrals, record types, and gluemiddle
- TTL, caching, and DNS propagationmiddle
- What TLS does and why it existsjunior
- The 1-RTT handshake: key shares and ECDHEmiddle
- Session resumption and 0-RTTmiddle
- Key schedule, SNI, ALPN, and extensionssenior
- 0-RTT defenses, ECH, hybrid PQ, and production TLSsenior
- CDN: putting content next doorjunior
- Anycast and GeoDNS: routing to the nearest edgemiddle
- Tiered cache and Cache-Controlmiddle
- Vary header and cache keysmiddle
- Stale-while-revalidate and cache stampedesenior
- Edge workers and edge-side compositionsenior
- CDN operations and observabilitysenior
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket frame format: opcodes, masking, fragmentationmiddle
- WebSocket vs SSE vs long-polling: choosing the right transportmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Balancing algorithms: round-robin to power-of-two-choicesmiddle
- L4 vs L7 load balancing and client-IP preservationmiddle
- Health checks, connection draining, and slow startmiddle
- Session affinity, consistent hashing, and the right fixmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- QUIC streams and head-of-line blockingjunior
- Integrated handshake and 1-RTTmiddle
- Connection IDs and network migrationmiddle
- Loss detection and congestion controlmiddle
- 0-RTT resumption and packet encryptionsenior
- Deployment tradeoffs and CPU costsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- The twelve layers: one URL, seven actorsjunior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Critical render path and Core Web Vitalsmiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- What the three signals are: logs, metrics, and tracesjunior
- Metrics and cardinality: the cost model of a time-series databasemiddle
- Logs and volume: the cost model of structured loggingmiddle
- Traces and sampling: the cost model of distributed tracingmiddle
- Join keys and exemplars: making the three signals composemiddle
- Observability 2.0: wide events and the cost shiftsenior
- Failure modes and engineering practice: cardinality budgets, PII, and samplingsenior
- Why structured logs exist: the diary vs the spreadsheetjunior
- The production log schema: fields every line must carrymiddle
- Log levels and alert routingmiddle
- Sampling strategies and log costmiddle
- PII redaction and log injectionsenior
- Trace context propagation in logssenior
- OTel Logs Data Model and audit logs as a subsystemsenior
- What is OpenTelemetry: API, SDK, Collector, OTLPjunior
- OTel signals, Semantic Conventions, and the OTLP wire formatmiddle
- Auto-instrumentation and manual spans: the 80/20 of OTelmiddle
- The OTel Collector: receivers, processors, exporters, and deployment patternsmiddle
- Sampling strategies: head, tail, and parent-basedmiddle
- Vendor neutrality, eBPF instrumentation, the Operator, and browser/serverless OTelsenior
- Operating the OTel Collector: reliability, version skew, failure modes, and governancesenior
- RED and USE: two checklists, one triage disciplinejunior
- Instrumenting RED in Prometheus: counters, histograms, and cardinality disciplinemiddle
- USE on Linux: CPU, memory, disk, network, and PSImiddle
- Golden signals, dashboard layout, and service mesh auto-REDmiddle
- Cardinality as a cost driver: labels, PII, exemplars, and samplingmiddle
- Native histograms, SLO tie-in, and production failure patternsmiddle
- SLI, SLO, and the error budget: reliability by the numbersjunior
- Choosing SLIs and SLO targets: ratios, not feelingsmiddle
- Multi-window multi-burn-rate alerting: why AND beats ORmiddle
- Error budget policy, latency SLOs, and composite journeysmiddle
- Iceberg SLIs, composite SLO math, and SLA vs SLOsenior
- Production SLO failures, self-observability, security, and the big picturesenior
- What is trace propagation and why broken propagation is worse than nonejunior
- traceparent and tracestate: the W3C header format in fullmiddle
- Baggage and async boundaries: carrying context across queues and callbacksmiddle
- Async context per language, service mesh, B3 migration, and securitysenior
- Production propagation failures, span links, and platform designsenior
- Flame graphs: reading the picture that shows where time goesjunior
- Sampling vs instrumentation profiling: why 99 Hz wins in productionmiddle
- Profile types: CPU, memory, off-CPU, mutex — which one to reach formiddle
- Continuous profiling: always-on flame graphs with eBPF and trace-id correlationmiddle
- How flame graphs are built from samples, and the production workflows that use themmiddle
- Linux perf, eBPF internals, PGO, and the limits of samplingsenior
- Profiling in production: security, war stories, OTel profiles, and the infrastructure designsenior
- The debugging funnel: SLO → RED → trace → profilejunior
- OTel architecture: one SDK, four signals, one wire formatmiddle
- Cost discipline: keeping observability under 5% of infra spendmiddle
- The incident loop: from pager to postmortem to preventionmiddle
- Scale, security, and the ROI of observable systemssenior
- Why profile first: measure where time actually goesjunior
- Amdahl''''s law and self-time: the ceiling on every speedup you can shipmiddle
- The measurement loop: microbench, macrobench, prod profile, observer effectmiddle
- Reading flame graphs: shapes, per-language profilers, and the 60-second scanmiddle
- Statistical baselines: why one run is not a measurementmiddle
- Profiler history and microbenchmark pitfalls: Knuth to GWPsenior
- Hardware counters, cold-start profiles, and profile securitysenior
- Continuous profiling at scale: costs, CI gates, trace correlation, and anti-patternssenior
- What makes a hot path: symptom vs causejunior
- Five shapes of hotspot: CPU, alloc, cache, lock, syscallmiddle
- Reading parent and child chains: where to apply the fixmiddle
- JIT deopt, the fix-and-verify loop, and PR-time profilingmiddle
- Hardware counters and Intel TMA: sub-category diagnosissenior
- False sharing and native-bridge hot pathssenior
- Hot paths in production: security, tail latency, and tooling lineagesenior
- Memory hierarchy: why the same O(N) loop can be 17x slowerjunior
- Row-major vs column-major: access order and the 9x gapjunior
- Cache lines, struct layout, and false sharingmiddle
- Branch prediction and branchless codemiddle
- SIMD, SoA vs AoS, and memory bandwidthmiddle
- Hardware prefetcher, TLB, and memory-level parallelismsenior
- Cache-oblivious algorithms, PGO, and production failuressenior
- GC basics: what the runtime taxes you forjunior
- GC algorithms: generational, concurrent, and per-runtimemiddle
- GC tradeoffs: pause, throughput, heap — and object poolingmiddle
- GC tuning: pacing, heap shape, and allocation observabilitymiddle
- GC internals: tri-color invariant, write barriers, and per-runtime deep-divessenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- N+1: one logical operation, many round-tripsjunior
- Fix families: JOIN, IN, preload, and DataLoadermiddle
- Detecting N+1: query logs, APM traces, and CI gatesmiddle
- DataLoader: batching across resolver treesmiddle
- Cross-protocol N+1: HTTP fan-out and Redis MGETmiddle
- N+1 at scale: pool exhaustion, plan changes, and denormalisationsenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- What a bundle actually costs: download, parse, compile, executejunior
- Core Web Vitals: LCP, INP, and CLSmiddle
- Code splitting: route-level, component-level, vendor splittingmiddle
- Tree shaking and compression: removing what you don''''t usemiddle
- Third-party scripts: the silent budget killermiddle
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior
- At-most-once, at-least-once, exactly-once: the three delivery contractsjunior
- The three failure legs — where duplicates and losses actually happenmiddle
- Consumer-side dedup: the cheapest path to exactly-once processingmiddle
- Kafka exactly-once semantics: idempotent producer and transactionsmiddle
- SQS visibility timeout, DLQ, and the outbox patternmiddle
- Exactly-once in production: impossibility proof, hybrid patterns, and real incidentssenior
- What OAuth is and why passwords are not the answerjunior
- Authorization code flow with PKCEmiddle
- ID token validation and JWKS cache managementmiddle
- Refresh token rotation and scope-based least privilegemiddle
- Sender-constrained tokens: DPoP and mTLSsenior
- OAuth in production: audience attacks, observability, and real failuressenior