Fill essential gaps and trim low-value content across the topic briefs

AGENTS.md

@@ -51,7 +51,7 @@ What experienced Go engineers forget before an interview, grouped by subtopic.
 - **Bold** the term or number worth memorizing — at most 3 per concept, not counting tables.
 - **Versions**: note when behavior changed ("since Go 1.22", "Python 3.14+", "Pectra, May 2025").
 - **Cross-topic**: the owner file covers a concept in full; another file may overlap briefly from its own angle and links to the owner: `see [security.md](security.md)` (rules in Topic ownership). Link to files, not anchors (the strict build validates anchors; only use one if you've checked the slug).
-- Suggested size: 5–10 sections, 3–8 concepts each. Shorter is better if nothing is lost.
+- Suggested size: 5–20 sections, 3–8 concepts each. Shorter is better if nothing is lost.
 
 ### What to include
 
@@ -78,15 +78,15 @@ Each concept has one owner file that covers it in full. Other files may overlap
 
 | Concept | Owner | Referenced from |
 |---|---|---|
-| Consistency models, replication theory, consensus, clocks, delivery semantics, sagas, CRDTs | distributed | database, system, backend |
+| Consistency models, replication theory, consensus, clocks (monotonic vs wall), delivery semantics, sagas, CRDTs, CDC | distributed | database, system, backend, os, golang |
 | Retries, backoff, circuit breakers, backpressure, tail latency | distributed | backend, system |
 | Isolation levels, MVCC, indexes, WAL, DB replication setup, pooling | database | backend, system |
-| Caching strategies, rate-limiting algorithms, load balancing, CDN, observability (SLI/SLO) | system | backend, devops |
-| REST/gRPC/GraphQL, pagination, idempotency keys, outbox, graceful shutdown, N+1 | backend | system, database |
+| Caching strategies, rate-limiting algorithms, load balancing, CDN, observability (SLI/SLO), capacity math (Little's law), multi-region and DR tiers | system | backend, devops, os, aws |
+| REST/gRPC/GraphQL, pagination, idempotency keys, outbox, graceful shutdown, N+1, schema evolution, multi-tenancy, time handling | backend | system, database, distributed |
 | AuthN, sessions, OAuth/OIDC, JWT, XSS, CSRF, CORS, clickjacking, crypto, TLS | security | backend, frontend |
 | Containers, Kubernetes, cloud, IaC, deployment strategies, zero-downtime migrations | devops | backend, database |
 | Browser event loop, JS language semantics | javascript | frontend, typescript |
-| Rendering strategies, browser pipeline, Web Vitals, HTTP caching in the browser, React | frontend | javascript |
+| Rendering strategies, browser pipeline, Web Vitals, HTTP caching in the browser, browser storage, React | frontend | javascript, security |
 | asyncio event loop | python | — |
 | TCP/UDP, HTTP versions, QUIC, DNS, IP addressing, NAT, MTU, BGP/anycast | networking | backend, system, devops |
 | Processes, signals, scheduling, virtual memory, OOM, file descriptors, epoll/io_uring, fsync, locks | os | devops, database, golang |

docs/topics/ai.md

@@ -68,6 +68,13 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 - A small **draft model** proposes several tokens; the large model verifies them in one pass and keeps the accepted prefix.
 - Faster decode with the **same output distribution**; the gain depends on how often drafts are accepted.
 
+### Model parallelism and GPU memory
+
+- Serving memory ≈ weights + KV cache + activations; a model too large for one GPU must be split.
+- **Tensor parallelism** splits each layer's matrices across GPUs; it needs a fast interconnect (NVLink), so it stays within a node.
+- **Pipeline parallelism** puts consecutive layers on different GPUs or nodes: less communication, but pipeline bubbles leave stages idle.
+- Data parallelism replicates the whole model for throughput; **disaggregated serving** runs prefill and decode on separate GPU pools, each tuned for its bottleneck.
+
 ### Quantization
 
 - Weights in FP16 take **2 bytes per parameter** (a 70B model ≈ 140 GB); INT8 halves that, **4-bit** (GPTQ, AWQ) quarters it, with some quality loss.
@@ -95,6 +102,8 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 | **IVF** | cluster, then probe `nprobe` clusters | less memory; recall depends on `nprobe` |
 | **PQ** | compress vectors into codes | much smaller, lower recall; often combined as IVF-PQ |
 
+- **Filtered search**: post-filtering the top-k returns too few hits when the filter is selective, and pre-filtering breaks HNSW graph connectivity — use a filter-aware engine or partition the index (per tenant).
+
 ### Chunking
 
 - Chunk along **document structure** (sections, paragraphs); a few hundred tokens with **10–20% overlap** is a common starting point — tune on evals.
@@ -118,7 +127,13 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 | RAG | facts are private or change often; citations matter |
 | Fine-tuning | a stable style, format, or decision gap persists after prompting; poor for keeping facts current |
 
-## Fine-tuning
+## Training and fine-tuning
+
+### Training pipeline
+
+- **Pretraining**: next-token prediction on trillions of tokens; Chinchilla-optimal is ≈ **20 tokens per parameter**, but modern models train far past it so a smaller model is cheaper to serve.
+- Post-training: SFT on demonstrations, then preference tuning (RLHF, DPO) for helpfulness and safety.
+- **RL with verifiable rewards** (math and code graded automatically, e.g. GRPO) is how reasoning models learn long chains of thought.
 
 ### SFT, RLHF, DPO
 
@@ -147,8 +162,8 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 
 ### Stop conditions
 
-- Cap steps, tokens, and cost per run; require evidence (tests pass, a record exists) before declaring success; escalate on repeated failure.
-- Open-ended self-critique loops often repeat the same mistake and burn budget.
+- Cap steps, tokens, and cost per run; escalate to a human on repeated failure.
+- Require evidence (tests pass, a record exists) before declaring success.
 
 ### Context management
 
@@ -167,11 +182,6 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 - **MCP** standardizes how apps discover and call tools, read resources, and fetch prompts — JSON-RPC 2.0 over stdio (local) or **Streamable HTTP** (remote, replaced HTTP+SSE in 2025).
 - Authorization is optional; HTTP servers that support it use **OAuth 2.1**. MCP doesn't replace per-action authorization or business validation.
 
-### Browser automation as a fallback
-
-- Use it only without an API — layouts change and clicks have ambiguous effects.
-- Isolate its credentials and require **approval** before irreversible submits.
-
 ## Evaluation
 
 ### Eval sets and metrics
@@ -200,7 +210,6 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 
 - **Route** easy requests to a small, fast model and hard ones to a strong model.
 - **Semantic caching** reuses answers to similar queries; its key must include user permissions, source version, and freshness, or it leaks.
-- Measure cost **per completed task**, not per call.
 
 ### Batch and streaming
 
@@ -221,5 +230,5 @@ What experienced AI engineers forget before an interview, grouped by subtopic. F
 
 ### Human approval gates
 
-- Require approval before high-impact actions (money, legal, external sends); show the action, evidence, and affected records.
+- Require approval before high-impact actions (money, legal, external sends, irreversible form submits by a browser agent); show the action, evidence, and affected records.
 - An approval covers **one specific action**; re-check that data hasn't changed since the proposal, and record who approved what and when.

docs/topics/algorithms.md

@@ -6,19 +6,32 @@ What experienced engineers forget before an algorithms interview, grouped by sub
 
 ### Time and space bounds
 
-- State the **input size**, then worst-case time and **auxiliary space**; producing an output of size `k` already costs Ω(k).
+- Producing an output of size `k` already costs **Ω(k)**, whatever the algorithm.
 - Nested loops aren't automatically O(n²): if two pointers each advance at most `n` times, total work is O(n).
 - Recursion stack counts as space: balanced divide-and-conquer uses O(log n) frames, a linear chain O(n).
 
+### Input size and target complexity
+
+At ~10⁸ simple operations per second, the constraints tell you which complexity to aim for:
+
+| n up to | Target | Typical technique |
+|---|---|---|
+| 10–11 | O(n!) | permutations |
+| 20 | O(2ⁿ) | subsets, bitmask DP |
+| 500 | O(n³) | interval DP, Floyd–Warshall |
+| 5,000 | O(n²) | pairwise DP |
+| 10⁶ | O(n log n) | sorting, heaps, binary search |
+| beyond | O(n) or O(log n) | linear scan, math |
+
 ### Amortized analysis
 
 - A dynamic array's occasional **O(n) resize** still gives **O(1) amortized** append, because capacity grows geometrically.
 - Amortized is a guarantee over a sequence of operations; hash-table lookup is **expected** O(1), and collisions can make one operation O(n).
 
 ### Recurrence patterns
 
-- **Binary search**: `T(n) = T(n/2) + O(1) = O(log n)`.
-- **Merge sort**: `T(n) = 2T(n/2) + O(n) = O(n log n)`.
+- **Master theorem** for `T(n) = aT(n/b) + f(n)`: compare `f(n)` with `n^(log_b a)` — smaller → Θ(n^(log_b a)); equal → Θ(n^(log_b a) · log n); larger → Θ(f(n)).
+- Merge sort (a = b = 2, f = n) is the equal case → O(n log n); binary search (a = 1, b = 2, f = 1) → O(log n).
 - Recursion without memoization can revisit states exponentially often; after memoizing, cost = **states × work per state**.
 
 ## Arrays and sequences
@@ -50,6 +63,12 @@ What experienced engineers forget before an algorithms interview, grouped by sub
 - **Sliding window maximum**: keep indices with decreasing values; pop smaller values from the back, drop the front once it leaves the window.
 - Every index enters and leaves once — **O(n)** total instead of O(nk).
 
+### Maximum subarray (Kadane)
+
+- Scan once: `cur = max(x, cur + x)`, `best = max(best, cur)` — **O(n)** time, O(1) space.
+- Initialize both with the first element, not 0, so an all-negative array returns its largest value.
+- **Circular** variant: `max(best, total − minimum subarray)`, unless every value is negative (then just `best`).
+
 ### Intervals
 
 - **Merge overlapping intervals**: sort by start, extend the last merged interval while the next start ≤ its end — O(n log n).
@@ -72,7 +91,7 @@ What experienced engineers forget before an algorithms interview, grouped by sub
 - A **polynomial rolling hash** updates a window's hash in O(1) as it slides, so search is O(n + m) expected.
 - Collisions happen: **verify each match** for exact results — two moduli only make collisions rarer; also finds duplicate substrings via binary search on length.
 
-## Sorting and selection
+## Sorting, selection, and sampling
 
 ### Comparison sorts
 
@@ -94,13 +113,25 @@ Standard array implementations; variants differ in stability and space.
 - **Quickselect** partitions around a random pivot and recurses into one side: O(n) expected, O(n²) worst.
 - A size-`k` **min-heap** keeps the largest `k` of `n` items in O(n log k) time and O(k) space.
 
+### Random sampling and shuffling
+
+- **Reservoir sampling** picks `k` items from a stream of unknown length: keep the first `k`, then replace a random slot with the i-th item with probability k/i — one pass, O(k) memory.
+- **Fisher–Yates** shuffle: for `i` from `n−1` down to 1, swap `a[i]` with `a[rand(0..i)]` — O(n), every permutation equally likely.
+- Swapping with `a[rand(0..n−1)]` at each step looks similar but is **biased** (nⁿ outcomes can't split evenly over n! permutations).
+
 ## Data structures
 
 ### Heap invariants
 
 - A binary heap is a **complete tree** in an array; the root is the min or max, siblings are unordered.
 - Peek O(1); insert and remove-root O(log n); **bottom-up construction is O(n)**.
 
+### Heap patterns
+
+- **k-way merge**: push the head of each of `k` sorted lists into a min-heap, pop and push the next from the same list — O(n log k).
+- Running median with **two heaps**: a max-heap for the lower half, a min-heap for the upper, sizes differing by at most one — O(log n) per insert, O(1) median.
+- Heaps can't delete arbitrary items cheaply: **lazy deletion** marks items removed and discards them when they reach the top.
+
 ### Hash tables and collisions
 
 - Expected O(1) lookup and update, no ordering; **collisions** are resolved by chaining or probing, and the table rehashes past a load threshold.
@@ -118,8 +149,8 @@ Standard array implementations; variants differ in stability and space.
 
 ### LRU cache
 
-- **Hash map + doubly linked list**: the map finds a node in O(1), the list keeps recency — move to front on access, evict from the tail.
-- Python: `OrderedDict.move_to_end` + `popitem(last=False)`; Java: `LinkedHashMap` in access order.
+- **Hash map + doubly linked list**: the map finds a node in O(1), the list keeps recency.
+- Move a node to the front on every access and evict from the tail — both O(1).
 
 ### Fenwick and segment trees
 

docs/topics/aws.md

@@ -15,9 +15,16 @@ What experienced AWS developers and DevOps engineers forget before an interview,
 - Use **temporary role credentials** for EC2, ECS tasks, and Lambda; use OIDC federation for external CI so pipelines do not store long-lived AWS keys.
 - In ECS, the **task role** grants the application access to AWS APIs; the **execution role** lets the ECS agent pull images, fetch configured secrets, and send logs.
 
+### Cross-account access
+
+- Within one account, an allow in the identity policy **or** the resource policy suffices (KMS key policies and role trust policies are exceptions).
+- Across accounts, **both** sides must allow: the resource policy trusts the other account or principal, and that principal's identity policy grants the action.
+- Third parties assume your role with an **`sts:ExternalId`** condition, preventing the confused-deputy problem.
+- `aws:PrincipalOrgID` in a resource policy limits access to accounts in your organization.
+
 ### KMS and envelope encryption
 
-- **Envelope encryption**: `GenerateDataKey` returns a plaintext data key (encrypt locally, then discard) and the same key encrypted under the KMS key (store it with the data). KMS `Encrypt` itself only takes **4 KB**.
+- `GenerateDataKey` returns a data key in plaintext (use it, then discard it) and wrapped under the KMS key (store it with the data) — the envelope pattern in [security.md](security.md); KMS `Encrypt` itself takes at most **4 KB**.
 - Every KMS key has a **key policy**; IAM policies grant access only if the key policy delegates to the account.
 
 ## Networking
@@ -32,6 +39,19 @@ What experienced AWS developers and DevOps engineers forget before an interview,
 - **Security groups** are stateful and attach to network interfaces; **network ACLs** are stateless and apply at subnet boundaries, so return traffic needs an explicit ACL rule.
 - **Gateway VPC endpoints** route S3 and DynamoDB traffic without a NAT device or internet gateway; interface endpoints use private IPs and AWS PrivateLink for supported services.
 
+### ALB vs NLB
+
+| | ALB | NLB |
+|---|---|---|
+| Layer | L7: HTTP(S), gRPC, WebSockets | L4: TCP, UDP, TLS |
+| Routing | host, path, header, query string | port only |
+| Addresses | changing IPs; use the DNS name | **static IP per AZ** (Elastic IPs optional) |
+| Client IP | in `X-Forwarded-For` | preserved, or sent via PROXY protocol v2 |
+| Extras | OIDC/Cognito auth, WAF, Lambda targets | TLS passthrough, PrivateLink services, very high throughput |
+| Cross-zone | on by default | **off** by default; cross-AZ data is charged when on |
+
+Gateway Load Balancer inserts inline appliances such as third-party firewalls.
+
 ### Connecting VPCs
 
 | Option | Topology | Note |
@@ -59,7 +79,6 @@ What experienced AWS developers and DevOps engineers forget before an interview,
 ### Lambda limits and concurrency
 
 - Maximum timeout **15 minutes**; synchronous payloads 6 MB each way (streamed responses allow more).
-- Lambda Managed Instances allow up to **90 minutes** for async and event-source invocations (Sept 2026); synchronous calls stay at 15.
 - **Reserved concurrency** guarantees capacity and caps a function; provisioned concurrency pre-initializes environments to reduce startup latency and incurs separate charges.
 
 ### Lambda cold starts and scaling
@@ -74,11 +93,6 @@ What experienced AWS developers and DevOps engineers forget before an interview,
 - **HTTP API**: cheaper, JWT/Lambda/IAM authorizers and throttling, but no usage plans or request validation; integration timeout max **30 s**.
 - ALB in front of Lambda or containers can authenticate via OIDC/Cognito but has no throttling, usage plans, or validation; LCU pricing is usually cheaper at sustained high volume.
 
-### ECS service mechanics
-
-- A **task definition** specifies containers and resources; a **service** keeps the desired number of tasks running and replaces failed ones.
-- Services register tasks with a load balancer target group and roll out new task definitions with rolling or blue/green deployments.
-
 ## Storage and databases
 
 ### S3 consistency and versions
@@ -87,6 +101,12 @@ What experienced AWS developers and DevOps engineers forget before an interview,
 - With **versioning**, deleting an object without a version ID adds a delete marker; deleting a specific version permanently removes it. Lifecycle rules can expire noncurrent versions.
 - A **presigned URL** grants temporary access using the signer's permissions and expires no later than the credentials used to sign it.
 
+### S3 access and CloudFront
+
+- New buckets block public access and disable ACLs (**bucket owner enforced**) by default since April 2023; objects are encrypted with SSE-S3 by default since January 2023.
+- Serve a private bucket through CloudFront with **Origin Access Control**, which replaces the legacy OAI; the bucket policy allows only that distribution.
+- CloudFront **signed URLs or signed cookies** gate private content at the edge; S3 presigned URLs bypass the CDN.
+
 ### S3 performance and classes
 
 - Each **prefix** supports about **3,500 writes and 5,500 reads per second**; spread hot keys over prefixes.
@@ -147,5 +167,11 @@ What experienced AWS developers and DevOps engineers forget before an interview,
 ### Capacity and cost guardrails
 
 - Service **quotas** are per account and Region and often stop scaling before the application does — many are soft and raised by request.
-- AWS Budgets alerts follow billing-data updates, at least daily; use CloudWatch service metrics for operational alarms. Cost Explorer is for spend analysis.
 - EC2 **Spot** capacity can be reclaimed; stop/terminate interruption notices give about **2 minutes** on a best-effort basis (hibernation starts immediately). Checkpoint work and replace capacity proactively.
+
+### Cost drivers
+
+- **NAT gateway** data processing (~$0.045/GB in us-east-1, plus hourly) is a classic surprise; S3 and DynamoDB gateway endpoints are free and skip it.
+- **Cross-AZ traffic** costs ~$0.01/GB in each direction, so chatty services and replicas spread across AZs add up.
+- Internet egress and CloudWatch Logs ingestion (~$0.50/GB) are the other usual suspects.
+- Discounts: Savings Plans and Reserved Instances (up to ~72% for 1–3 year commitments), Spot (up to ~90%), Graviton (roughly 20% cheaper per hour than comparable x86).