A successful ordinary write(2) makes its accepted bytes available through the kernel’s file state, but does not by itself establish crash durability. fsync requests synchronization of a file’s data and associated metadata and waits for completion as reported by the storage stack. It is one operation in an update protocol. Correct ordering, checked errors, directory entries, and the storage system’s actual guarantees still matter. ...
A rate-limit key defines which requests share a budget. An account, API credential, address, tenant, and authenticated session are different identities, not interchangeable spellings of “client.” Choosing the wrong grouping can punish unrelated users or let one workload obtain fresh allowance simply by changing a field. ...
An objective such as “99.9% reliable” is incomplete until someone can classify an observation. Reliable for which users, at which boundary, over what window, and according to which outcome? An error budget gives the permitted failures a quantity only after those questions have answers. Its first engineering task is defining the population and the good-event rule, not choosing a dashboard color. ...
Clock synchronization reduces disagreement between machines’ civil-time readings. It supports certificate validity checks, timestamp interpretation, and many expiration policies, but it does not establish a perfect global clock. A host can emit well-formatted UTC while measuring the wrong instant. Applications still need to distinguish elapsed durations, absolute deadlines, and causal ordering rather than making them all depend on raw wall-clock comparisons. ...
Use an explicit service type, bounded restart behavior, and start-rate limits that leave evidence in the journal.
Keep the common path explicit, observable, and safe to repeat before adding recovery branches.