How Felix works, why it is built the way it is, and what testing it against crashes and network splits has turned up.
Subscribe with RSSOn an idle shard nothing ships, so a leader never learned that a follower had lost its disk; this is how a storage identity per data directory fixed that, and why it changes only when a directory may hold less than its peers were told.
How Felix keeps one slow subscriber from holding up publishers or other readers, and how a 2% single-publisher loss came from where the feeder gave back a subscriber's byte budget.
Felix checks 107 TLA+ configurations in CI; this is about three times a passing check meant nothing, and the twin configurations, reachability checks and spec pairing we use to catch it.
Deleting a Felix stream or cache and creating one with the same name could bring back the old one's data; this is how incarnations fixed it, and how we kept control-plane members on different releases from storing different answers during the rollout.
Felix brokers speak enough of the Kafka wire protocol for Kafka producers and partition-assigning consumers to use durable Felix streams; this is how a Kafka request becomes a Felix operation, how idempotent sequences survive a failover, and exactly where compatibility stops.
Raising Felix's QUIC MTU on Linux stalled delivery for good, because UDP GSO turns ten packets into one datagram the kernel refuses and quinn never falls back; this is how we found it, why the cap is 6,550, and why 4,096 is the default.