Design
Reality check
Each real-world claim, the game rule built on it, the simplification, and its source.
Every game rule has a row here: the real-world claim, the rule built on it, the simplification, and a source (pillar 1). A rule without a row is a bug in the design.
Facts about specific products and versions change, so check this list again before each content milestone (Roadmap). The player-facing version of this promise is Quorum is a game.
Scale#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| About 6 billion people used the internet in 2025. | Users stop near 6 billion. | Rounded; the limit does not grow during play. | ITU, Facts and Figures 2025: https://www.itu.int/en/mediacentre/Pages/PR-2025-11-17-Facts-and-Figures.aspx |
| Traffic follows a daily cycle. | Diurnal demand curve with a 20:00 peak. | One cosine wave; real curves have two humps and holidays. | General operations knowledge |
Determinism#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
ECMAScript defines + − × ÷ and Math.sqrt as exact IEEE 754 operations. It leaves sin, cos, exp, log, and pow to the engine, and engines differ by 1 to 4 ulp. | The Simulation uses only exact operations, tables, and constants. | The diurnal cosine is a series built from exact operations. | ECMA-262; cross-engine probe: https://github.com/mdedys/omaha/blob/main/docs/research/determinism-across-browsers.md |
Queueing#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| L = λW for a stable system. | In-flight requests equal throughput times residence time. | Exact as stated. | John D. C. Little, "A Proof for the Queuing Formula: L = λW" (1961) |
In an M/M/1 queue, mean waiting time is S × ρ / (1 − ρ), and response time (wait plus service) is exponential with mean S / (1 − ρ). | The utilization curve and p99 of the response time ≈ 4.6 × its mean. | Real servers are closer to M/G/c; the shape holds. | Standard queueing theory |
| With fan-out, the slowest of N calls decides the latency; a 1% slow rate on 100 calls makes 63% of requests slow. | 1 − (1 − p)^N tail amplification. | Calls are independent in the model. | Dean and Barroso, "The Tail at Scale", CACM 2013: https://cacm.acm.org/research/the-tail-at-scale |
| Retries can keep a system overloaded after the trigger ends. | Retry storm incident; retries multiply load. | One feedback loop instead of many. | Bronson et al., "Metastable Failures in Distributed Systems", HotOS 2021; Huang et al., OSDI 2022: https://www.usenix.org/system/files/osdi22_full_proceedings_interior_0.pdf |
| Apdex counts satisfied requests fully and tolerating requests (up to 4T) as half. | Revenue per request. | Exact formula. | Apdex Alliance specification |
Runtimes#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| Node.js runs JavaScript on one thread; a long callback blocks every client. | Event-loop block tail on CPU-heavy kinds. | A formula instead of a scheduler. | Node.js, "Don't Block the Event Loop (or the Worker Pool)": https://nodejs.org/learn/asynchronous-work/dont-block-the-event-loop |
| The libuv thread pool has 4 threads by default and serves file system, DNS lookup, crypto, and zlib work. | Async bcrypt queues behind 4 threads per process. | Exact default. | libuv docs in the Node.js repository: https://github.com/nodejs/node/blob/main/deps/uv/docs/src/threadpool.rst |
| CPython's GIL stops threads from running Python code in parallel; threads still help I/O-bound work. | GIL runtimes use one core per process for CPU work. | Free-threaded builds exist and are a separate variant. | Python docs, threading: https://docs.python.org/3/library/threading.html |
PHP-FPM runs one request per worker; pm.max_children should be RAM divided by worker memory. | PHP-FPM slots are limited by RAM; I/O waits hold workers. | One memory number per worker. | Stack Harbor, PHP-FPM pool sizing: https://stackharbor.com/en/knowledge-base/phpfpm-pool-sizing; Stack Overflow discussion: https://stackoverflow.com/questions/71815287 |
| PHP frees request memory at the end of each request (shared nothing). | PHP-FPM cannot leak across requests. | Ignores extensions with persistent state. | PHP request lifecycle (PHP internals documentation) |
| Goroutines start with a small stack (2 KB in current Go). | Go memory per in-flight request is small. | One number. | Go runtime; summary: https://blog.devtrovert.com/p/go-ep7-goroutines-are-stackful |
| Erlang processes are small and have their own heaps. | Per-process GC, few KB per rt connection. | One number. | Erlang efficiency guide, memory: https://www.erlang.org/doc/system/memory.html |
| Phoenix held 2 million WebSocket connections on one server in 2015. | Elixir has the most rt connections per GB. | Benchmark conditions differ from production. | Phoenix blog, "The Road to 2 Million Websocket Connections in Phoenix" (2015) |
| Discord moved its Read States service from Go to Rust because of latency spikes from Go's GC. | GC pause tail; Rust has none. | Go's GC has improved since 2020; the game uses a smaller pause for Go. | Discord, "Why Discord is switching from Go to Rust": https://discord.com/blog/why-discord-is-switching-from-go-to-rust |
| The JVM starts in an interpreter and compiles hot code over time. | Java warmup from 30% to 100%. | Real warmup depends on code paths; the game uses 30 s of sim time. | OpenJDK HotSpot documentation |
| GraalVM native images start fast with lower peak throughput than a warm JIT. | Native image variant. | Fixed factors. | GraalVM documentation |
Java virtual threads make blocking I/O cheap. From JDK 24, synchronized does not pin; native frames still do. | Virtual threads variant. | Native pinning is a flat penalty. | JEP 444; JEP 491 (https://openjdk.org/jeps/491) |
| Relative speeds: compiled and JIT runtimes are faster than CPython, CRuby, and PHP on CPU-bound work. | Speed factors from 0.15 to 1.4. | Compressed so no runtime is useless; order follows public benchmarks. | TechEmpower Framework Benchmarks; Computer Language Benchmarks Game |
| PHP OPcache removes script compilation on each request; the PHP 8 JIT helps CPU-bound code more than typical web requests. | OPcache ×2.5; JIT helps CPU-heavy kinds only. | Fixed factors. | PHP manual, OPcache and JIT |
| Node.js exits on an unhandled exception or unhandled promise rejection by default. | Node.js blast radius is "Process". | Ignores process managers that restart instantly. | Node.js documentation, process events |
Go's net/http server recovers panics in handlers; a panic in another goroutine crashes the program. | Go blast radius is "Request" with a background-goroutine exception. | As stated. | Go net/http documentation |
| Bcrypt is slow on purpose, with a tunable cost. | login costs 80 ms of CPU. | One cost level. | Provos and Mazières, "A Future-Adaptable Password Scheme" (1999) |
| Language popularity differs widely; JavaScript, Python, and Java have the largest pools. | Hiring pool and time to hire. | Stylized factors. | Stack Overflow Developer Survey |
Data#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
PostgreSQL forks a process per connection; max_connections defaults to 100; poolers help. | Connection limit and the Connection Pooler. | Fixed memory per connection. | Percona, "Scaling PostgreSQL with PgBouncer": https://www.percona.com/blog/scaling-postgresql-with-pgbouncer-you-may-need-a-connection-pooler-sooner-than-you-expect |
| PgBouncer transaction pooling breaks session-level features. | Transaction mode limitations. | One error type. | PgBouncer documentation |
| Redis executes commands on one main thread. | One core caps a Redis node; slow commands block. | Ignores Redis I/O threads. | AWS Builder Center, Redis single-threaded design: https://builder.aws.com/content/2tfQijlXleV5iM6hDkSGkMJlpcd/the-engineering-wisdom-behind-rediss-single-threaded-design |
| Elasticsearch makes new documents searchable within about 1 second by default. | Search refresh interval 1 s. | Exact default. | Elastic, near real-time search: https://www.elastic.co/docs/manage-data/data-store/near-real-time-search |
| With R + W > N, a read asks at least one replica that acknowledged the latest write. This is not linearizability. | Wide-column quorum settings; the game labels them "Read-after-write". | Ignores sloppy quorums and hinted handoff. | Amazon Dynamo paper (2007); Cassandra documentation; Kleppmann, Designing Data-Intensive Applications, chapter 9 |
| DynamoDB is a key-value and document database, not a wide-column store. | Listed under Document Store. | As stated. | AWS, "What is Amazon DynamoDB?": https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html |
| Elastic added AGPL to Elasticsearch in 2024 after the 2021 SSPL change. Redis added AGPLv3 in 2025 after its 2024 change. | Product notes on Search Engine and Cache. | None. | Elastic, "Elasticsearch is open source, again" (2024); Redis, "Redis is now available under the AGPLv3" (2025) |
| Asynchronous replicas lag behind the primary. | Replication lag and stale errors. | Lag is a formula of write rate. | PostgreSQL documentation, streaming replication |
Large ALTER TABLE operations can lock a table. | Schema migration lock incident. | Lock time proportional to table size. | PostgreSQL and MySQL documentation |
| Fan-out on write against fan-out on read is a known timeline design tradeoff. | feed designs. | Two designs plus a hybrid. | Public Twitter engineering talks on timelines |
| Kafka orders messages only within a partition. | Partition ordering rule. | Exact. | Apache Kafka documentation |
Operations and cloud#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| AWS gives a two-minute notice before reclaiming a spot instance. | Spot reclaim with a warning. | Warning shortened to 10 s of sim time. | AWS EC2 docs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-instance-termination-notices.html |
| SQS standard queues have nearly unlimited throughput and at-least-once delivery. | SQS variant. | FIFO limits stylized. | AWS SQS features: https://aws.amazon.com/sqs/features |
| Lambda accounts have a regional concurrency limit of 1,000 by default. New accounts start lower, and AWS raises the quota with use. | Serverless concurrency cap. | Uses the established-account value. | AWS Lambda quotas |
| Cloud egress costs money; cross-zone traffic is billed in both directions. | Egress prices. | Stylized round prices. | AWS EC2 pricing pages |
| Cloudflare R2 charges no egress fees. | R2 variant. | As stated. | Cloudflare R2 pricing |
| Stripe's standard US card price is 2.9% + 30¢. | Payment Provider fee. | One region's price. | Stripe pricing |
| Let's Encrypt certificates are valid for 90 days today. The industry maximum is 200 days since March 2026 and falls to 47 days by March 2029. | Certificate expiry incident; 90 days, then 45 days from Series C. | Calendar-based expiry. | Let's Encrypt, "Decreasing Certificate Lifetimes to 45 Days" (2025); CA/Browser Forum ballot SC-081 |
| Speed of light in fiber is about 200,000 km/s (5 µs per km). | Cross-region latency. | Plus a fixed routing overhead. | Physics; typical published round-trip times |
| The OWASP Core Rule Set has paranoia levels that trade detection for false positives. | WAF paranoia levels. | Fixed rates per level. | OWASP CRS documentation |
| Error budgets let teams trade reliability for velocity. | Error budget policy. | Three states. | Google SRE book, "Embracing Risk": https://sre.google/sre-book/embracing-risk/ |
| Deployment frequency and short lead times go with better delivery performance. The 2024 medium cluster had a lower change failure rate than the high cluster. | Deploy frequency lowers bad-deploy size, not the chance. | One curve. | DORA, 2024 Accelerate State of DevOps report; https://dora.dev/guides/dora-metrics |
Observability#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| If you can measure only four signals of a user-facing system, measure latency, traffic, errors, and saturation. | The Dashboard's Overview row. | Saturation is utilization per Node. | Google SRE book, "Monitoring Distributed Systems": https://sre.google/sre-book/monitoring-distributed-systems/ |
| RED (rate, errors, duration) reports what users feel; USE (utilization, saturation, errors) reports causes. Alert on RED. | Services rows with tracing, Resources rows with profiling. | One row per Service and per Node. | Grafana, dashboard best practices: https://grafana.com/docs/grafana/latest/visualizations/dashboards/build-dashboards/best-practices |
Percentiles cannot be averaged across instances; histogram buckets can be summed, then histogram_quantile computes the percentile. | The Dashboard computes p99 from the Ledger, never as a mean of p99s. | The Ledger gives p99 directly. | Prometheus, histograms and summaries: https://prometheus.io/docs/practices/histograms |
| A burn rate of 1 spends exactly the error budget in the SLO window. | The SLO row's burn rate line. | A one-week window, not 30 days. | Google SRE workbook, "Alerting on SLOs": https://sre.google/workbook/alerting-on-slos |
| Thanos downsamples raw data to 5-minute blocks after 40 hours and to 1-hour blocks after 10 days, keeping min, max, sum, and count. | Three Dashboard resolutions with min, max, sum, and count. | 1 minute, 15 minutes, and 1 hour. | Thanos compactor docs: https://thanos.io/tip/components/compact.md/ |
| Every unique label combination is a new time series. | Series per Node, Request kind, and Region only. | No storage cost per series. | Prometheus, metric and label naming: https://prometheus.io/docs/practices/naming/ |
| Prometheus scrapes every 1 minute and keeps 15 days of data by default. | None; the Dashboard keeps 1-minute points for 10 calendar hours. | Shorter raw retention to bound the save. | Prometheus configuration: https://prometheus.io/docs/prometheus/latest/configuration/configuration |
| Exemplars link a point on a metric graph to one trace. | Dots on the Latency Chart open the Waterfall of the slowest kind. | The three slowest seconds, one kind each. | Grafana, exemplars: https://grafana.com/docs/grafana/latest/fundamentals/exemplars/ |
Prices#
Time-billed prices map one sim second to one real hour; per-use prices keep the real list price (Economy). Checked on 3 November 2026.
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| An m7i.large (2 vCPU, 8 GB) costs $0.1008 an hour on demand in us-east-1, about $0.05 per vCPU-hour. | A General vCPU costs $0.05/s. | RAM is folded into the family price. | AWS EC2 on-demand pricing; Holori calculator: https://calculator.holori.com/aws/ec2/m7i.large |
| S3 Standard costs $0.023 per GB-month. | Object Storage $0.000032 per GB per second. | Three storage classes; no Lifecycle rules. | AWS S3 pricing |
| A T4 rents for $0.526 an hour (g4dn.xlarge), an A100 80GB for a $1.79 median, an H100 for a $3.33 median. | GPU Nodes $0.53, $1.80, $3.30/s. | Medians across providers. | https://gpurentalprices.com/providers/aws; https://www.amcompute.com/gpu-cloud-prices/a100-80gb |
| An H100 serves a 70B model at about 2,056 tokens/s at 30 tokens/s per user with vLLM. | H100 2,000 tokens/s per GPU. | One model size; no batch or quantization. | SemiAnalysis InferenceX: https://inferencex.semianalysis.com/run/llama-3-3-70b-on-h100 |
| Serverless open 70B models cost about $0.23 to $0.88 per million tokens. | LLM API $2.50 per 1,000 tokens (time-billed). | Priced on the GPU's scale so they compete. | SemiAnalysis (above); Together AI model pages |
| CockroachDB Cloud Standard costs $0.092 per vCPU-hour. | Distributed SQL $1.95/s for 3 nodes. | Assumes 2 vCPU per node plus storage. | https://cockroachlabs.com/pricing |
| Amazon SES costs $0.10 to $0.16 per 1,000 emails. | $0.0001 per push or email message. | Push and email share one price. | https://aws.amazon.com/ses/pricing |
| Median dilution: seed 19.4%, Series A 18.7% (Carta, Q2 2026); Series B 12.9%; 16% seed to Series C (2025). | Rounds dilute 19%, 19%, 13%, 12%. | Fixed percentages; Pre-seed and later stylized. | Carta, State of Private Markets 2025 in review; https://carta.com/learn/startups/fundraising/seed-funding |
| Private SaaS companies spend a median 5% of ARR on hosting. | Not a target; the cost index sets Burn. | Recorded for the Margin bot. | SaaS Capital, 2026 spending benchmarks |
Teams and business#
| Claim | Game rule | Simplification | Source |
|---|---|---|---|
| Adding people to a late project makes it later. | Coordination penalty. | One formula. | Fred Brooks, The Mythical Man-Month (1975) |
| Systems copy the communication structure of the organization. | Services and teams. | Shared database penalty. | Melvin Conway, "How Do Committees Invent?" (1968) |
| The Rule of 40 is a common SaaS health heuristic. | Valuation multiple. | Linear multiple. | Widely used in SaaS investing |
| Founders are diluted with each priced round. | Dilution per round. | Fixed percentages. | Typical venture terms |
| "Default alive" means reaching profitability on current funds. | Achievement and Venture. | As stated. | Paul Graham, "Default Alive or Default Dead?" (2015) |
| Most product ideas do not improve the metric they target. At Microsoft about a third of controlled experiments improved it, a third were flat, and a third made it worse. | A Feature rolls Win, Flat, or Loss with equal chances; load is certain. | Three outcomes with fixed ranges; one roll per Feature. | Kohavi, Tang, and Xu, Trustworthy Online Controlled Experiments (2020) |
| Most shipped features are rarely or never used. | Flat outcomes are common. | Folded into the Flat outcome. | Pendo, "The 2019 Feature Adoption Report" |
| Adoption of a new product follows an S-curve over time. | Adoption approaches 1 with a 7-day time constant. | An exponential approach instead of an S-curve. | Frank Bass, "A New Product Growth for Model Consumer Durables", Management Science (1969) |
| Latency lowers usage, slowly, and the loss lasts after the delay is gone. 400 ms of extra delay cost 0.59% of daily searches per user over six weeks. | Users leave while Apdex is under the Era's target. | Much faster, so it can be felt in minutes; no lasting effect after a fix. | Jake Brutlag, "Speed Matters for Google Web Search" (Google, 2009) |
| Retention rates rise with tenure because the least loyal customers leave first, not because each customer grows more loyal. | Half of new users are fickle; steady users leave at a fifth of the rate. | Two segments instead of a beta distribution. | Peter Fader and Bruce Hardie, "How to Project Customer Retention", Journal of Interactive Marketing (2007) |
| New products spread through word of mouth; across 213 studies the coefficient of imitation averages 0.38 and of innovation 0.03 a year. | Growth is proportional to users, toward the market. | Logistic growth with no innovation term; the seed stands in for early adopters. | Sultan, Farley, and Lehmann, "A Meta-Analysis of Applications of Diffusion Models", Journal of Marketing Research (1990) |
| Adoption in one country speeds adoption in others, and later countries adopt faster. | Word of mouth crosses regions at a weight of 0.1. | One weight for every pair of regions. | Putsis et al., "Mixing Behavior in Cross-Country Diffusion", Marketing Science (1997); Takada and Jain (1991) |
| The standard error of a difference between two groups falls with the square root of the sample sizes. | Lift's confidence interval narrows with sampled requests. | One spread for every metric; no correction for peeking. | Standard statistics; Kohavi, Tang, and Xu (2020), chapter 17 |
| Small teams scope work by appetite: one to two weeks for a small batch, six weeks for a big batch. | Feature sizes in DH. | Each Feature has one fixed size. | Ryan Singer, Shape Up (Basecamp, 2019): https://basecamp.com/shapeup |
| Developers spend about 42% of their week on maintenance and bad code. | Upkeep approaches 40% of Dev Hours as the product grows. | One saturating curve per service. | Stripe, "The Developer Coefficient" (2018) |
| Feature flags ship code dark and release it to a share of users. | Rollout steps; turning a Feature off stops its effects and load. | Four fixed steps. | Pete Hodgson, "Feature Toggles (aka Feature Flags)", martinfowler.com (2017) |
Incidents and events cited in the game#
| Event | Where used | Source |
|---|---|---|
| Knight Capital loss after a deploy (2012) | Bad deploy | SEC administrative proceeding, 2013 |
| Cloudflare WAF regex outage (2 July 2019) | Regex backtracking, Challenge 23 | Cloudflare blog postmortem |
| GitHub network partition (21 October 2018) | Network partition, Challenge 24 | GitHub blog, "October 21 post-incident analysis" |
| Facebook BGP outage (4 October 2021) | DNS or BGP misconfiguration, Challenge 27 | Meta engineering blog |
| Amazon S3 us-east-1 outage (28 February 2017) | Operator typo, Challenge 28 | AWS summary of the event |
| CrowdStrike update failure (19 July 2024) | Bad config push | CrowdStrike preliminary incident review |
| GitLab database deletion (31 January 2017) | Accidental delete | GitLab postmortem |
| Facebook cache and database feedback loop (2010) | Cache stampede | Facebook engineering note, September 2010 |
| event-stream (2018) and xz-utils (2024) compromises | Supply-chain compromise | Public advisories |
| 2012 leap second | Leap second, Challenge 29 | Public reports from affected sites |
| Pokémon GO launch traffic (2016) | Challenge 15 | Google Cloud blog on Pokémon GO |
| healthcare.gov launch (2013) | Challenge 16 | US government reports |
| Instagram's 13 employees at acquisition (2012) | Challenge 9 | Press coverage of the acquisition |
| Stack Overflow's small server footprint | Challenge 7 | Nick Craver, "Stack Overflow: The Architecture" (2016) |
| Dan Kegel's C10k problem (1999) | Challenge 4 | "The C10K problem" |