Glossary
Every load-bearing term in Nova, one meaning each, with the words it replaces
Nova uses one word per concept. This glossary is the same vocabulary the code, the design documents, and every page of these docs use — when two pages seem to disagree, the definition here decides. Each entry ends with the words to avoid, because the wrong word usually smuggles in the wrong mental model.
Streams and addressing
Record
A single appended unit: body (opaque bytes), optional headers, a timestamp, and a contiguous sequence number. The domain type is stream.Record.
Header
One name/value byte pair riding a record — opaque to nova, carried verbatim from append to read. Names are non-empty; duplicates are legal and keep their order; at most 100 ride one record. A record's size is its content bytes: body plus every header name and value — the one number all caps and budgets speak.
Avoid: attribute, property, tag, key (the stream word)Stream
An ordered, immutable sequence of records with exactly one sequencer at a time.
Avoid: topic, log, partitionClass
A stream's write-path profile — Standard or Express — set at creation and changeable by reconfigure: a class change hands the leadership off, the successor writes under the new class, and acknowledged records keep the class they were written under. Not a durability level: every class is durable at acknowledgement; they differ in how, and in what that costs. Distinct from the storage class of OBJECTS (objectstore's vocabulary): an Express stream's settled history is standard-class regardless — when both senses meet, qualify: stream class, storage class. The domain type is stream.Class; the wire calls it class.
Timestamping
A stream's rule for whose clock stamps record time: client-prefer (default — the client's stamp when present, else arrival), client-require, or arrival. Stamps are clamped monotone within the stream; arrival time caps client stamps unless the stream is uncapped — the door to app-scale monotone stamps (an LSN). Uncapped and age retention are mutually exclusive: age retention reads record time as wall clock.
Avoid: event time / processing time (the Flink words)Sequence number (SeqNum)
The contiguous (0,1,2,…), stream-global position of a record, assigned by the facade's sequencer and validated by every engine (id == expectedNext). A gap is evidence of corruption, never of intent. The domain type is stream.SeqNum; the wire calls it seq_num (S2).
Tail
The sequence number of a stream's last committed record — the client-plane view of the read horizon (the committed ref frontier): durable, readable, monotonic; −1 when nothing has committed yet. Never the sequencer's assignment cursor, which can regress at failover. On the wire the client plane speaks Positions instead — the same boundary, exclusively encoded.
Avoid: high watermark, end offset, next sequence number (that is the Position encoding)Record (wire)
The client plane's encoding — S2's read record: {seq_num, timestamp_ms, headers, body}. Thinner than the domain stream.Record: no batch-end (consumers never see framing). Bodies and headers are opaque bytes.
Stored record
One record as persisted in a chunk's data region: a width-packed flag byte, the header table, then the body — one flag byte total when headerless. Framed by the directory's per-record length (stored-record bytes, not content bytes); integrity rides the chunk's DataCRC — records carry no checksum of their own.
Avoid: envelope (the loglet's slot frame), encoded record, entry (the directory's word)Position
The client plane's wire encoding of one point on a stream — S2's StreamPosition: a sequence number and the timestamp of the record it names. Exclusive at boundaries: an append's End and every Tail position carry one-past-the-last-record plus that record's time. Appends answer {start, end, tail}; CheckTail answers {tail}. Wire and SDK only — internal code keeps contiguous sequence numbers and the inclusive Tail.
Avoid: offset, cursor (that is a reader concept)Match (match_seq_num)
The optional CAS on an append: the sequence number the batch's first record must receive, decided at the sequencer; a miss rejects only that batch and reports the Tail. Internal code stays expectedNext.
Tenure-held configuration
The descriptor fields a leadership resolves once at establish and holds for its tenure — class (the write strategy), producer policy (admission), timestamping (dispatch), throughput (the limiter), and batch (bundling). A change to one reaches the stream only through a departure: the holder hands off and the successor is born under the new descriptor. Retention is not tenure-held: the retention duty reads it live.
Avoid: static config (it does change — through a handoff), hot config (the opposite: nothing on the write path re-reads mid-tenure)Segment
An epoch-scoped sealed extent of a stream — the unit of write ownership and retention, born sealed; its builder is the star whose chain built it. Since the row-fold it is a view read off the committed ref rows (the span commit is its own seal), not a keyspace of its own. Never visible in addressing.
Avoid: ledger, streamlet, shardEpoch
Segment ownership's counter, bumped by CAS at leadership change — the correctness fence a stale leader cannot pass.
Avoid: term, generationEpoch fencing
Using the epoch to lock out a stale leader. Split: epoch assignment (the CAS-bump) is a placement decision; epoch enforcement is the loglet's own fence — poison written into the chain so a stale writer's slots can never reach the copy quorum, returning the Cut. Stale-producer fencing rides the facade's leases; there is no replica fence handler.
Avoid: fencing (bare — Fence is the dataplane verb)Star
A running nova instance — a novad daemon. Identified by a StarID. The system is the constellation of stars.
Location
Where a star runs — an availability zone in cloud terms: the placement spread label, and the key the express bucket set's zones are matched against (reads prefer the zone serving the node's location). Opaque to nova; the operator labels it. The bucket record's location is its S2-style sibling: reserved metadata, no routing semantics yet.
Avoid: AZ and az (the old field and flag names; fine as the cloud term in prose), region (a broader scope than placement spreads over), zone (the express bucket set's own axis — a zone SERVES a location)StarID
The 16-byte stable identity of a Star, persisted on a diskful node by its cookie.
Cookie
A diskful node's on-disk record of its StarID; on restart, a mismatch means the data directory was attached to the wrong Star (disk-swap guard).
Durability and the write path
Facade
The write coordinator inside the serving node (the BookKeeper LedgerHandle equivalent, moved server-side): holds the contiguous-id sequencer, drives the class's write strategy, tracks the committed ref frontier, gates reads, coordinates settlement.
Avoid: client (that is the remote SDK), writerStrategy
A facade's per-class write path — standard (flights chained to standard object storage) or express (flights chained to the express bucket set at the copy quorum). What earlier notes called the "engine interface". Realized by the class's write Core directly (D86).
Express
The low-latency chained class: flights commit as chain slots fanned to a bucket set of express-class directory buckets, one per AZ, acknowledged at the copy quorum (W=2, a hard floor) — express-fast and multi-AZ durable at acknowledgement, express-fast tail reads from the slots, settled to standard class for history (D60).
Avoid: MediumLatency, Zonal (withdrawn — that was the single-bucket chain class), S3Express (a vendor's product name, not the class), express-resident (the settled tier is standard, D60 amending D52)Core
A class's write implementation — open, dispatch, acked, the close-out verbs. It carries the full write-strategy contract itself (D86); what a new class writes, whole. Constructed and assembled by the class's front door.
Avoid: engine (that is the storage node), backend, handler, Adapter (the dissolved shared wrapper — D86; shared machinery is extracted when a second class exists)Saturation
A node's absolute at-a-ceiling state: queued work some resource can no longer service (the USE-method sense), judged by the CPU busy fraction. Opens rebalancing and makes the node refuse new leads. Distinct from load (relative busyness, the balance signal peers compare) and from utilization (how busy a resource is; a resource can be fully busy yet unsaturated).
Avoid: overload (no defined threshold), high utilization (busyness ≠ queued work)Rebalance
The pressure-triggered redistribution of leadership — two triggers, one handoff mechanism: a saturated node hands off led streams, one per tick, until relieved; and a loaded-but-unsaturated node above the spread floor gently re-homes streams whose re-resolution lands on an underused peer (the expansion spread — paced far slower, so new capacity never sits cold). Engages only under absolute self-pressure — a comfortable node never rebalances, however uneven the fleet.
Avoid: self-shed (superseded), load balancing (implies continuous equalization), shed (reserved for backpressure refusal)Handoff
One stream's leadership moving to another node: the leader abandons it, the fenced producer re-routes to the new designated leader — metadata only, never data movement. The one mechanism rebalancing and drain both drive.
Avoid: shed (superseded for this sense), migration, reassignment (both suggest data movement or a central assigner)Stranded
A saturated node's no-relief verdict: a rebalance pass ran with the gate open and shed nothing — no live peer could absorb even one of its streams. Published on the node stats record; cleared by the first successful handoff or by the gate closing. Reads as "add capacity" — unless it persists after new capacity registers, which convicts an indivisible hot stream instead (partitioning is the layer above's lever).
Avoid: no capacity (vague), at capacity (the whole-fleet placement error), starved (relief exists but hasn't arrived; stranded means none fits)Shed
The backpressure refusal of work at an explicit bound — the shed half of "block or shed" — always logged, never silent. Strictly declining new work at a limit; moving existing leadership is a handoff, not a shed.
Avoid: drop (silent; a shed is logged), throttle (shaping, not refusal)Slice
One pod's declared resource share — net capacity in wire bytes, cpu, memory, and (auditors) scratch — the unit machines are packed by and the denominator saturation is judged against. Requests equal the slice, so pods-per-machine is scheduling arithmetic and --net-capacity is the slice's net figure; one pod per machine is the degenerate case, not a mode.
Leadership
One stream's held writership as live, in-memory serving state on a core: the shared sequencer cursor, the live producer handles, the linger timer, and the lease it holds — born at the first Open, joined by later handles, released when the last closes (or abandoned on handoff, delete, shutdown). A live leadership is what makes a node the stream's leader — one leader node holds many leaderships; its absence is what makes a stream vacant. Distinct from the lease, which is only the advisory coordination record it holds — a node can briefly hold a lease with no leadership (nothing in flight), and neither gates safety (the epoch guard does).
Avoid: role (superseded), writer role, ownership (overstates — the epoch guard is the arbiter and fences a zombie "owner"), lease (the record, one part), session (the wire's append session)Bucket
The stream container and governance point: every stream is created in exactly one bucket, which must already exist — nova has no implicit or reserved buckets; tools may adopt a conventional name (commonly default) but must create it like any other. A bucket carries the default stream configuration every new stream starts from (copy-at-create, never live inheritance) and names the settled-object prefix. Named by S3 bucket rules. Immutable identity for its streams' addresses.
Default stream configuration
A bucket's complete stream configuration — class, producer policy, timestamping, retention, batch, throughput — that every stream created in the bucket starts from, whether autocreated or created explicitly; a create names the fields it wants otherwise, and every field it leaves out is copied from the bucket's defaults (copy-at-create, never live inheritance). Always concrete: a field the bucket itself leaves unset takes the domain default at bucket creation. "The bucket's defaults" for short; the wire's default_* prefix and the SDK's Defaults field name it.
Key
A stream's name within its bucket: opaque UTF-8 bytes (no control characters, bounded) that nova never parses — / is grouping convention exploited by prefix listing, exactly as in S3; orders, orders/, and orders/eu are three unrelated keys. Immutable; rename does not exist. The (bucket, key) pair is the stream's ADDRESS.
Address
A stream's public name: the (bucket, key) pair, globally unique by construction and the only stream input any public verb accepts — stream IDs appear in outputs (descriptors, logs, settled-object keys) for correlation, never as an input. Identity remains the nova-minted stream ID, so a stream recreated at the same address is a new stream with an empty history; the predecessor's artifacts keep its old ID.
Avoid: name (underspecified), path, by-id (retired from the public planes — the admin plane is the reverse-lookup surface)Transit bundle
The multi-stream object one write burst publishes — a HighThroughput or Express flight, an aggregation across streams — a short-lived form, denormalized into settled objects within its class's age cap (D66) and reaped after the read grace.
Avoid: bundle alone where settled objects are also in scopeSettled object
A per-stream object at rest — a denormalized output or a rewrite output. The long-lived form stream data takes in object storage, keyed under its stream's bucket.
Avoid: chunk (that is a region within an object)Era
A contiguous run of one chain's slots that one settle job owns — the steady-state settle's scheduling unit (D75). Settle is scheduled in chain coordinates, never by stream; per-stream identity appears only inside the job.
Avoid: window (stream-scoped), batch (one absorb pass's slots — an era spans many)Group settle
One settle job covering an era: every qualifying stream whose extents the era's bundles carry, each bundle read once, one settled object per stream out (D74, amended D75). Each stream's settle converges independently within the job.
Avoid: batch settle (a batch is the absorb's unit), bundle settle (the outputs are per-stream)Settle frontier
One chain's lowest outstanding settle coordinate — the first key of its due range, since batch-marker due keys are chain coordinates, armed at flight cut and removed at resolution (D75). Below the frontier no settle actor ever writes again; teardown's first walk waits behind it before retiring a dead stream's rows (D81). It only advances: markers arm at the cut cursor, never behind it.
Avoid: watermark (unqualified), settle progress (a rate, not a coordinate)Wire adapter
The gRPC adapter on novad serving thin clients (DataPlaneService): producer sessions, redirects, status mapping — over the same facade primitives every plane shares. It adds no semantics of its own.
Avoid: proxy, frontend, nova-facade (deleted by D28), gateway (the term's pre-Gateway-component use; the Gateway is the separate internet-facing tier)Data bridge
The data plane re-encoded for HTTP on novad, for callers inside the trust domain that cannot speak gRPC. A locally-led stream is served through the facade in place; a foreign-led one is proxied one hop to the holder (the admin reader's move) — an HTTP caller never sees a redirect. It adds no semantics of its own, and the trust boundary stays above (ADR-0014): the Gateway fronts this, it is not this.
Avoid: gateway (the component above nova), REST API, HTTP proxy (the internal hop is routing, not the component)Gateway
The internet-facing component above nova — the trust boundary ADR-0014 promised: TLS termination, tenant identity and policy, and holder-aware dispatch into the cluster via its cluster client. It holds only narrow credentials — the caller's own forwarded token, plus read-only storage access when the deployment vends raw read plans — never cluster membership, coord access, or a peer credential; novad itself is never internet-exposed. A separate deployable with its own release cadence.
Avoid: broker (the embedding host in general; the Gateway is one productized broker), proxy, edge (a place, not the component), wire adapter (that serves the gRPC client plane on novad)Cluster client
The fleet-aware data-plane client both the SDK and the Gateway ride: the generated interface over the fleet — each call routed to its stream's remembered holder, a NOT_OWNER answer followed to the address it names, a dead seed rotated past. A holder is remembered only from a redirect and forgotten on any other failure from it. Each rider dials with its own credential (the Gateway forwards the caller's bearer). It holds no cursor state: resuming a broken stream is its rider's business.
Avoid: backhaul (jargon), proxy (it re-encodes nothing), SDK (the public client package — a rider of the cluster client, never the thing itself)Read plan
The manifest the ReadPlan verb answers for a stream range: vended entries (settled objects with the byte ranges to fetch them) plus one open-ended residual ("from sequence X up, ask nova") — a partition of responsibility, never a visibility claim; it carries no tail. A plan is a read capability, authorized exactly as a read.
Vending
Handing a consumer direct object-storage locations for settled bytes, in one of two modes: presigned (short-lived URLs signed by novad; the only per-tenant-safe mode) or raw (bucket + key + range, fetched under the consumer's own storage identity — trust-domain consumers only, since storage IAM knows nothing of tenants). Settled objects only; the tail is never vended.
Avoid: bare (raw's former name), direct read (the client-side experience, not the mechanism), offload (the effect, not the act)Scope token
One nova: entry in a JWT's standard scope claim — a four-field resource grant (action, bucket match, percent-encoded key match, a trailing unencoded * meaning prefix) or a two-field marker (nova:admin, nova:node). Union, allow-only; unknown tokens are ignored and logged; in jwt mode there is no unscoped caller (ADR-0035).
Action
The closed verb set a scope token grants — append, read, list, create, delete, trim — plus the admin and node markers. Autocreate rides the triggering action under the bucket's flags; trim and delete are never bundled.
Avoid: verb (the informal word), permission, operationProducer session
A thin client's agreement with one serving node to append to a stream — the AppendSession gRPC stream itself: it dies with the wire, and a reconnect re-handshakes. A staleness detector, not a fence. An Any stream admits many at once; a Fenced stream exactly one. Wire-only — inside the star the writer role is held as the Producer object instead.
One-shot append
The unary Append: one call, one durable batch, no session — the writer role is joined per call and, on Any streams, kept warm by the role linger. The convenience and HTTP-mapping verb; pipelined producers hold a session.
Avoid: connection, token (that is the fencing token)Fencing token
Optional caller-supplied string (≤ 36 UTF-8 bytes) installed only by the Fence verb; opens and one-shot appends present it, judged by exact equality — presenting never installs. Cooperative on Any streams (token-less writers always pass); on Fenced streams presenting is mandatory while a token is set. Empty clears. Policy, not safety — the epoch guard remains the correctness fence.
Avoid: session token, epoch (different layer)Fence
The dataplane verb that installs, rotates, or clears a stream's fencing token — the only installer. Holder-serialized: by return, every live producer session whose presented token no longer matches is superseded; answers the Tail as the admission boundary. Rides the append scope.
Avoid: fence command (S2's in-log form), fencing (that is epoch fencing)Ownership lease
An optional nova-provided primitive (tryAcquireWriter → epoch, Oxia-backed) a simple broker can use to guarantee single-writer; sophisticated brokers supply their own epoch and use nova only to validate it.
Tail window
The span of a stream above the ref frontier — appended, durable by the class's own rule, not yet covered by a committed ref. Small by construction: the stream's slice of the backlog, leader-served, bounded by the backlog budget. Reads inside it are hot; everything below is cold — hot/cold name the tiers, this names the span. A read's tier is decided per page by position, never declared by the client. Served through the stream's class's TailSource.
Avoid: hot window (superseded), tail region (imprecise), unflushed data (it IS durable)TailSource
The per-class reader of the tail window — the seam the read shell resolves per stream. Read serves records at or above the committed-ref frontier; an empty answer is the caught-up claim, made only when provable — the leader's own acked cursor. Converge resolves what a read could not prove: checkpoint retirement, and the span re-classes cold. Resolved from a registry keyed by class — an unregistered class is an error, never a default.
Avoid: hot tail, TailReader (the shell's Tail is a position; a source is where tail records come from)Wake
The edge a led stream raises when its frontier moves or its leadership departs — closed, never sent: it carries nothing, and the read that follows is the only authority, so a spurious wake is harmless. A subscription on the leader parks on it; anywhere else it polls. Raised through the stream's TailSource; a stream with no tail window here has no wake.
Avoid: notification (suggests a payload), push (the bridge's deferred SSE), nudge (the absorber's word for its own wake), tip feed (the frontier is the position; this is the edge)Vacant
A stream with no writer lease held. No live flight index covers its tail window, so a hot read cannot be leader-served; it converges through settlement — the successor writer's fence, or the settle duty for a star that never returns — which commits refs over the resident span before serving resumes. The moment a lease appears the stream is no longer vacant and hot reads follow the leader (ADR-0017).
Avoid: idle (that is the lease-release trigger, not the state it leaves behind — see Idle), inactiveIdle
An Any-policy leadership whose last producer handle has closed and whose idle timeout is running. A handle that opens inside the window rejoins the live role — no lease CAS, no writer recovery; an expiry the window passes unclaimed releases the leadership, and the stream is vacant from then on. Fenced streams are never idle: their last close releases at once, because a handoff must not wait. The console labels a vacant stream "idle" for the operator; in code and docs idle names the trigger, vacant the state.
Avoid: linger (the denorm size-trigger delay), inactive, dormantLast writer
The durable stream→star record an open lands before its first acknowledgement — the writer lease's durable shadow: the lease says who holds the role now, ephemerally; this says who held it, durably. It is the segment before the segment: a crash that beats the first absorb leaves acked records in its epoch's slots and no segment naming the writer, and the record is what lets a takeover judge that predecessor instead of reading the stream as fresh and reassigning acked sequence numbers. It outranks the latest segment's builder, which lags a writer change by the first absorb. Overwritten by each open (the lease serializes writers); swept by the teardown's final pass.
Avoid: tenure record, builder record (a segment's builder is a different fact: who built that segment), ownership record (the lease is ownership; this is history)Drain
The action that empties a node of leadership: the serving drain refuses new leadership and — after a grace — hands off led streams via the same handoff rebalancing drives, never into a fleet that cannot re-home them. Two triggers, one mechanism. The decommission drain is operator-issued and sticky: it retries until the node leads nothing (the terminate gate, which decommission enforces), and is reversible until terminate — with one caveat: decommission settles a drained star's chain epochs ahead of its gate (D119), and a settled chain is terminal for that process, so a drain reversed after its decommission was attempted sheds the next append until the star restarts. The exit drain is the shutdown prelude a stop signal triggers: bounded and irreversible — past its budget, unshed roles fall to close's certify path. Neither is persisted across restart; a node holds no data, so a drained node is simply one leading nothing.
Avoid: cordon (k8s jargon; drain names the purpose), evacuate (suggests data movement — a drain is leadership handoff only), retire (an exit drain is still a drain, not a third concept)Decommission
The durable, irrevocable, operator-issued declaration that a StarID will never serve again. Consumers may settle bookkeeping against it; the registry refuses a decommissioned star, and the node-id file binds identity to the data volume, so a wiped disk returns as a fresh star — together the nova equivalent of BookKeeper's cookie. Replacement hardware always mints a new StarID; there is no undo.
Avoid: remove, deregister (both sound reversible)Objects and metadata
Bundle
A multi-stream object in object storage: stream-grouped chunks, an embedded footer, and a fixed trailer.
Avoid: roll, blob, fileStored record
The on-object encoding of one record: a width-packed header table, then the body. A chunk's bytes are a bare concatenation of stored records — self-contained, so a chunk range relocates verbatim. A headerless record pays one flag byte.
Avoid: envelope (the slot word), frameFooter
The manifest embedded at the end of a bundle: per-chunk directory entries and record lengths.
Avoid: index file, .idx, manifest (as a separate artifact)Ref
A metastore record mapping a record range of one stream to object storage. Two kinds share one keyspace, discriminated in the value: a single-object ref names one bundle and its footer window; a span ref covers the range across many chain slots (D62). Consumers read both only through the metadata accessors.
Avoid: pointerSpan ref
One immutable ref covering a stream's records across an absorb batch's chain slots: the value carries a per-slot index (slot, first id, footer window) plus the stream's cumulative bytes and time bounds, and a by-time secondary index rides the same put. Created once per (stream, batch) by the absorb; retired at settle when a catalog row takes over its range (ADR-0029).
Avoid: range ref, super ref, batch refCatalog row
A wide row in the refs keyspace covering a contiguous run of a stream's settled objects: its value is the packed per-object boundary list (epoch, first id, revision, footer window, bytes, time bounds, class), from which every object key derives. The settled counterpart of a span ref, and the commit authority for settled visibility; rows split at a size cap into adjacent rows at natural firstSeq keys (ADR-0029).
Avoid: extent row (extent is chunk-adjacent), manifest (the footer's word), index rowRevision
The rewrite lineage counter of a settled object at one (epoch, first sequence): revision 0 is the settle output at the bare derived key; each rewrite or coalesce lands at ~<revision> = max over covered entries + 1. Distinguishes generations so publish-new → repoint → reap-old never overwrites in place; recorded in the catalog entry (ADR-0029).
Linger
The per-class delay between a stream crossing the denorm size trigger and its denorm becoming due. Batches threshold crossings into rounds so a hot stream denorms once per round with everything it accumulated, never once per threshold.
Avoid: debounce, delay (name the concept), batch window (the flush path's word)Age cap
The per-class hard bound on how long any committed byte may remain transit-resident before denorm — the batch marker's due time, and therefore also the bound on slot lifetime, span-row accumulation, and decommission drain. Bounded-lazy denorm's second timer (D66); the first is the size trigger with its linger.
Avoid: force-split period (AutoMQ's word), TTL (retention's territory), deadline (a context word)Transit window
The span of a stream still resident in transit form — committed and ref-covered but not yet denormalized. Bounded by policy at the size trigger plus linger accumulation, never older than the age cap; the only span a reader meets as chain extents.
Avoid: unsettled tail (tail is the client-plane word), denorm debt (unbounded-laziness framing, retired with D66)Storage class
The class of object storage an object resides in — standard or express — recorded on every metadata record that names the object (ref, orphan intent, due marker); consumers resolve it against the node's one class→store authority, so no job branches on mode and keys stay pure identity. Rewrite outputs always settle to standard (D61 implements D60's ruling); the only express-resident objects are live chain slots.
Avoid: placement (that is where streams and leaders go), tier (the hot/cold caching words), bucket class, key namespace (superseded)Probe
The reclamation judgment for one settled object: one ranged footer GET plus one ref lookup per span, early-exiting the moment the verdict is decided. A span is live iff a ref names its object — the footer is the manifest, refs are the only liveness authority (D61; claim rows and summaries are retired, kept in old docs as historical vocabulary).
Avoid: corroboration (the retired claims-vs-refs form), audit (the subsystem, not the act), scanWatcher
Whatever guarantees an object will be revisited: a ref that names it, its orphan intent, or a due marker. The reclamation invariant is that every object always has at least one standing watcher; an intent resolves only once a ref actually names its object.
Avoid: guard, lease (held work, not standing ownership)Reap-check
The due marker armed for a settled object when a span of it stops being referenced; its probe reaps, arms GC, or resolves. Two-phase: an all-dead observation arms a confirmed marker one read-grace later, and only a confirmed all-dead probe deletes.
Avoid: tombstone (the retired row mechanism), reap marker (the old last-death-armed form)Trim-check
The reap-check's stripe-scoped sibling for chain slots: armed per touched stripe when a rewrite pass completes, it advances the rewritten cursor past slots whose denorm markers are gone and trims [trimmed, rewritten) across the whole bucket set. Slots are never probed; slot deletion has one owner, the auditor.
Avoid: slot reap, garbage probe (settlement's above-the-cut window)Rewrite
The one byte-moving mechanism of reclamation: read spans of standing objects, publish replacement settled objects, commit the swap. Denormalization, GC, and coalesce are policies driving the same mover; the rewrite owns every byte move, the auditor schedules it and owns every slot delete.
Avoid: compaction (the KV's word), settle alone (the act one rewrite policy performs, not the mechanism), copy (no commit semantics)Reclaim
Making dead data disappear safely: the below-point walk that drops a stream's segments and refs, the probe's per-object judgment, the reap, and the teardown and retention walks that drive them. Always scheduled through due markers — never a sweep.
Avoid: cleanup (vague), GC (one rewrite policy, not the umbrella), delete (the raw object-store verb)Copy set
The buckets confirmed to hold an Express object when its publish reported durable — the fanout publisher's runtime accounting, never persisted: reads fall through the bucket set, deletes fan to all of it.
Avoid: replicas (the LL ensemble's word), locationsFetch cache
The auditor's whole-object read-through disk cache: an optional scratch tier that dedups the settle's multi-consumer transit-bundle reads. Never authoritative — its loss at any instant is harmless, and a read it cannot admit falls back to a ranged GET.
Avoid: spill (the retired write-staging store), read cache (the retired serving-plane tier), object cache (the shared tier, not this pod-local scratch)Object cache
The shared read-through caching tier fronting the standard bucket: a pool of caching-proxy instances, each on its own local disk, the instance for a key chosen by ring hash with bounded load. Never authoritative — a read it cannot serve falls back to a direct ranged GET, and deliberate deletion routes through it so cached bytes die with the object.
Avoid: read cache (the retired serving-plane tier), fetch cache (the auditor's settle-demux scratch), hybrid cache (the upstream project's name), cache proxy (proxied is the fall-through read word)Cache-routed read
A read sent through the object cache with its byte range outside the request signature, so the cache may widen it to page bounds, fill gaps, and coalesce concurrent overlaps. Carries budgets and always has the ordinary direct read as its substitute.
Avoid: proxied read (the Gateway-to-novad word)Segment meta
The immutable object holding a sealed segment's compacted refs.
Directory
The per-stream object mapping record ranges to segments.
Avoid: chain object, indexLocality
A colocation view of the metadata KV: operations route by a locality key rather than the record key, so the records a locality touches land together on one backend shard (all of a stream's metadata shares the locality key "streams/{id}"). The KV's own term — kept distinct from the backend's "partition key"/"shard" (Oxia) and from the broker's "partition→stream".
Avoid: partition, shard (those name Stream and Segment).Watermark
A monotonic per-stream position marking a stage boundary (checkpoint, rewritten, trimmed). Always named with its stage.
Flight
One bundle's worth of a writer's pooled batches committed as a unit — the granularity at which a chained class's work becomes durable and acknowledged.
Avoid: flush (the trigger, not the unit), uploadChain
A node's ordered log of one epoch's flights — the commit record a chained mode acks against; nothing precedes it. One kind implements the Loglet contract (D60): quorum slot chains — flight bundles at derivable slot keys, each slot fanned to the epoch's Bucket set and durable at the Copy quorum (HighThroughput: one standard bucket; Express: K per-AZ express buckets at W=2). Consumed by the absorb, trimmed behind the checkpoint. One contiguous slot sequence per epoch.
Avoid: WAL (the journal's word), log (overloaded), manifest chain, loglet (the contract, not the artifact), record chain (removed, D60)Loglet
The contract every chain backend implements, in two halves: the live half — the incumbent's sequencer: contiguous positions, acknowledgements released in order at the copy quorum, permanent halt once fenced — and the static half — any successor's fence, walk, and trim against the durable artifact. The fence is idempotent and returns the Cut; slots at or above the cut are tolerated garbage, never acknowledged. The conformance surface for every chain backend (D60; design doc 011).
Avoid: chain (the artifact), transport (the write core's seam above), stripe (the removed sub-chain dimension, D71)Chain slot
One position in a chain, created at most once per bucket (conditional create), identical key across the Bucket set. A slot is committed when flight copies hold the copy quorum, dead when poison holds the blocking set — the two are mutually exclusive and permanent; there is no torn state.
Avoid: entry, offsetPoison slot
A terminator a fencer writes into a slot's empty buckets, in the bucket set's fixed order: poison occupying K−W+1 buckets (the blocking set) makes the slot dead — it can never reach the copy quorum, so nothing at or past it ever acknowledges. The chain's fence; the first dead slot is the Cut. At K=1 it degenerates to D54's single poison slot.
Avoid: tombstone (reserved for record deletion), seal (the segment word)Cut
The position at which a fence ended one stripe of an epoch: the first slot proven dead. Slots below it are committed and contiguous; slots at or above it are unmapped garbage, reclaimed by settlement's window probe and the decommission sweep. Published on the epoch record by CAS.
Avoid: sealed tail (the segment word), end, boundaryCopy quorum (W)
The confirmed copies a slot needs across its Bucket set before its flight may acknowledge — W=1 on HighThroughput, W=2 on Express (a hard floor, never degraded). The write-side sibling of the Copy set (which remains the runtime accounting of which buckets confirmed).
Avoid: ack quorum (Qa is the LowLatency ensemble's word), majorityRepair
The fence's completion of an undecided slot to the copy quorum by copying visible bytes into buckets that lack them — safe because one writer per epoch means a slot has exactly one possible content. Runs before poison, only at the fence, bounded by the pipeline window.
Avoid: re-replication (LL recovery's word), heal (backfill's word)Bucket set
The K object-storage buckets one loglet fans every slot to — one per AZ on Express (default K=3), a set of one on HighThroughput. Node-level engine config, recorded on the epoch record at mint.
Avoid: ensemble (the LL replica word), replicasSlot envelope
The fixed-size self-description at the start of every chain slot: kind (flight or poison), epoch, seq, writer nonce, object size, and footer location, checksummed. One bounded read classifies a slot and locates its footer with nothing but the key; the nonce lets a writer recognize its own write when a response was lost.
Avoid: header (the record/wire word), prologue, manifestCheckpoint
The chain position through which the absorb has taken flights into per-stream metadata. Trimming happens only below it; recovery walks only above it.
Backlog / Backlog budget
The backlog is a chain's released-but-unabsorbed span (tail minus checkpoint, in flights and bytes); the budget bounds it — one number bounding the leader's flight index, settlement time (and so takeover latency), the leader-only read window, and chain storage; producers block at the cap, loudly and with a diagnosed cause — a budget stall is a fault signature, never normal (D60).
Avoid: suffix (the old name — read as jargon), lag (that is the age metric), queue (the due-queue word)Settlement
Crash recovery of a chain: fence to the Cut, walk the backlog's footers, and commit refs pointing into the transit bundles — metadata only, no data movement — then probe one pipeline window above the cut for garbage. Restores "refs cover every acked byte" before any successor serves.
Avoid: recovery (the LL journal/quorum word), replayRelease flush
Settlement's commit step run by a live incumbent for one departing stream, sourced from its own flight index: a born-sealed segment over the resident span and refs into the transit bundles, before the lease releases. Keeps coverage across live handoffs; the epoch stays open.
Avoid: settlement (reserved for the dead-node path), drain (the engine's disk word)Absorb
The background consumer of a chain, in the leader's own process: takes released flights into per-stream metadata — refs into the slots, born-sealed segments — and advances the checkpoint, releasing backlog tokens at commit latency (wake-on-work, never cycle waves). Metadata only; the rewrite owns every byte move, and the auditor owns every slot delete (D57/D60/D61).
Avoid: segment build (the old name), build, denormalize, coalesce (predecessors), compaction (the KV's word)Chunk
One stream's contiguous span of records within a bundle — a region of an object, and the unit a ref maps to metadata. Its location (which object, where inside it) is a separate concept from its identity.
Avoid: extent, run, fragmentFlusher
The write core's single cut-and-claim loop: it turns the node-wide pool into flights and claims each flight's chain slot inline, so cut order is slot order. One per node (one per stripe if multi-stripe chains return).
Avoid: lane, flusher (the predecessors)Pool
The node-wide holding area for admitted-but-uncut batches; its oldest byte anchors the deadline window.
Cluster and operations
Clean release
A leadership departure whose acked tail is provably ref-covered before the role moves — certified by the mark the departing writer's final seal stamps on the stream's last segment. Every departure exits this way: graceful closes and cross-node handoffs, and equally the same-node supersede and poisoned re-establish (D73). The open gate passes on this evidence; a departure without it is an abandonment, and abandonments resolve through settlement, never through trust.
Avoid: graceful shutdown (a process property, not a per-stream one), flush (the mechanism that produces it, not the fact itself)Fleet
The cluster's coordination surface as one constructed handle over the ephemeral namespace — star liveness and membership, published stats, writer leases, placement. Assembly builds one coord.Fleet and hands it out; components accept only the narrow slice they consume behind their own interfaces, so a raw KV handle never leaves the namespace's owners.
Constellation
The whole running system as one managed unit: the fleet of stars, the audit pool, and the metadata plane behind them. Also the controller's resource kind — one Constellation record declares the system a controller maintains.
Avoid: cluster (the machines, or the k8s sense), installation, stackOperator
The operating authority over a constellation — human or controller; an operator-issued verb (drain, decommission) reads the same whichever issues it. Unqualified prose keeps this wide sense; the software holding it is the controller.
Avoid: administrator (no distinct meaning), the k8s-artifact sense unqualified (that is the controller)Controller
The automated operator of a constellation: software that watches the published signals and issues the same node-scoped verbs a human would — scale, drain, decommission, upgrade — never naming a stream. Realized as the Kubernetes operator reconciling Constellation and Gateway resources with admin authority.
Avoid: operator alone for the software, brain, manager, reconciler (one loop inside it)Held
A controller rung that cannot advance because the system has not yet converged — a decommission the gate refuses while settlement runs, a drain whose target is unreachable this pass. Reported as a condition naming the rung and the verb's own words, re-asked on the ladder's cadence, cleared the moment the rung moves. Never an error: a held rung persists the ledger and keeps the pass.
Avoid: halted (a roll stopped for a person — the dirty canary), failed, stuck (a held rung has a named cause), errorWitness
A ready star the controller observes the fleet through and issues target-based verbs through — the overview a gate is judged from, the decommission of another star, the absence that convicts a corpse. Never the subject of the verb it carries, never a star in departure. Greens first: the newest ready star on the declared render.
Avoid: proxy (the witness runs the verb, it does not relay it), leader (no election; any ready star qualifies), victim (the subject)Corpse
A star the fleet no longer sees — absent from the overview as a witness reads it — whose ledger entry still stands: a pod that stands unready with its session gone, or a pod gone entirely. Judged only through a witness, never from a dark fleet; retired by the decommission verb without a drain, its chains settled by the settle duty's dead-star judgment. A ladder victim turned corpse retires at once — it was already being walked out; an unplanned loss out-waits the reap threshold first.
Avoid: dead node (the pod may stand), lost star (that is the event, this is the state), zombie (a fenced writer, the epoch guard's word)Seat
A ring member's share of what the fleet deals over its roster — the due-queue shards rendezvous hands it and the registered subjects placement deals it. Held exactly while the member's ring record stands; vacated by withdrawal, never by quiescence alone. A seat nobody serves is work nobody does.
Avoid: slot (a chain's object), partition (the due-queue shard itself), membership (the record; the seat is what the record earns)Ledger
The controller's persisted list of the stars it owns — one entry per identity with its pod name, location, the render it was minted at, and its ladder phase. The source every pass re-derives from and the record every pass writes back, whatever else the pass managed; a controller restart resumes from it, never from memory.
Avoid: status (the ledger is one part of it), registry (nova's liveness records — the ledger is the controller's intent), inventoryLadder
The controller's ordered walk-out of one star: drain, the terminate gate, decommission, delete. One star per pass, the last ledger entry; every step re-derivable from the ledger and the fleet, so a restart resumes mid-walk. Scale-down and the roll's blue both leave by it.
Avoid: scale-down (one reason to walk it), rollout (k8s's word for a Deployment), teardown (a stream's reclamation)Rung
One step of the ladder, judged fresh each pass: it advances, or it is held with a named cause. A rung never fails a pass.
Avoid: stage, phase (the ledger entry's position — Draining, Decommissioned — which several rungs share), step (too generic)Node stats record
The small, fixed-size, session-ephemeral record each node refreshes with its node-level load aggregates (leaders, appended bytes, saturation, drained) — always aggregates, never per-stream maps. Sibling of the liveness record, so stats churn never rewrites routing.
Avoid: heartbeat (that is node liveness), gossip, metrics (Prometheus's word)Star summary
The periodic log line a star writes with its interval aggregates — leaders, sessions, subscriptions, offered and acked append rate, read rate, backlog age, retained memory, utilization — and its state flags (draining, saturated, stranded). The log's proof of life and load between edges; always aggregates, never per-stream lines. Same facts as the node stats record, different audience: the log, not the registry.
Avoid: heartbeat (that is node liveness), report (novabench's printed result), snapshot (the node stats record's verb)Admin bridge
The read-only JSON mirror of the admin plane's query RPCs on the ops listener — the same handler as the gRPC RPC, re-encoded for a browser. Structurally incapable of mutation.
Avoid: gateway (grpc-gateway, not used), REST API, admin API (that is the gRPC admin plane)Admin reader
The stream page's record-consuming panel: a data-plane consumer riding admin transport — the core's own read routing served on the browser's behalf, driven by a client-side cursor loop. Vacant streams serve committed state without waking; only a foreign-leased hot read proxies one hop to the holder.
Avoid: tail viewer, log viewer, subscriber (the reader polls a unary RPC; Subscribe is the gRPC streaming verb it deliberately does not use)Benchmarking
Workload
Client-plane load generated against a cluster to measure it — shaped by stream count, payload size, pipeline window, and arrival rate. What novabench runs.