Technical Glossary

AWS load balancer that distributes incoming HTTP/HTTPS/WebSocket traffic across multiple EC2 instances. Operates at Layer 7 (application layer), enabling path-based and host-based routing. Used to switch traffic between Blue and Green environments during deployments.

Tools like Datadog, New Relic, or custom middleware that trace every request through a system — measuring latency, error rate, and throughput. Used to compute percentile latency (P50/P95/P99) across millions of requests in production.

AWS feature that automatically adds or removes EC2 instances based on demand. A target tracking policy watches a metric (e.g., CPU utilization) and adds instances when it exceeds the target (60%), removes them when demand drops.

An immutable, append-only record of every significant action in the system — who did what, to which resource, from which IP, and what changed. Required for compliance, debugging, and forensics.

Flutter state management pattern where UI dispatches Events, the Bloc processes them and emits States. Enforces strict separation between UI and business logic. Well-suited for complex state machines like 7-stage order tracking.

A zero-downtime deployment strategy using two identical production environments (Blue = live, Green = new version). Traffic is shifted from Blue to Green after smoke tests pass. Rollback = shift traffic back to Blue instantly.

Caching pattern where the application checks the cache first; on miss, reads from the DB and writes to the cache for future requests. The application code manages the cache — it's "aside" from the main data flow. Most common Redis pattern.

In Kafka, a named group of consumers that together consume all partitions of a topic. Each partition is consumed by exactly one consumer in the group at a time. Scale by adding consumers up to the number of partitions.

AWS Content Delivery Network (CDN). Caches static assets at 400+ edge locations globally, serving them with ~5ms latency vs 100-300ms to origin. Also integrates with WAF for DDoS protection and supports signed URLs for private content.

Maintaining a pool of pre-established database connections reused across requests, avoiding the overhead of opening a new TCP connection (5-30ms) per query. Mongoose's default pool is 5; increased to 20 for production workloads.

Email authentication standards. SPF (Sender Policy Framework): DNS record listing which servers can send email for your domain. DKIM (DomainKeys Identified Mail): cryptographic signature on outgoing emails proving they weren't tampered with. DMARC: policy specifying what to do with emails failing SPF/DKIM (reject, quarantine, or allow).

A technical analysis signal where price and RSI move in opposite directions. Regular bullish: price makes lower low, RSI makes higher low → bearish momentum weakening → potential upward reversal. Regular bearish: price makes higher high, RSI makes lower high → bullish momentum weakening → potential downward reversal.

System design where components communicate by producing and consuming events, rather than direct synchronous calls. Producers don't know who consumes their events. Enables loose coupling, independent scaling, and natural audit trails.

MongoDB compound index field ordering rule. Put Equality fields first (exact match, highest cardinality reduction), then Sort fields (eliminates in-memory sort), then Range fields (inequality: $gt, $lt). Wrong order means the index can't cover all three operations.

Retry strategy where wait time doubles with each failed attempt (1s → 2s → 4s → 8s → …), capped at a maximum. Prevents overwhelming a struggling service with rapid retries. Combined with jitter (random offset) to prevent thundering herd when many clients retry simultaneously.

Total monetary value of all orders processed through the platform — what customers paid in total. GMV ≠ Revenue. Revenue = GMV × platform take rate (typically 3-5%). GMV is the standard scale metric for commerce platforms.

Flutter routing package providing declarative, URL-based navigation. Supports deep links (open a specific screen from an external URL), route guards (auth redirects), and named routes. Works identically on mobile (custom scheme) and web (real URLs).

MongoDB index type for GeoJSON data (Points, Polygons, LineStrings). Enables efficient proximity queries like "find all stores within 5km of this coordinate" using geohash-based B-tree traversal instead of full collection scan.

System design principle where a component failure causes reduced functionality rather than total failure. The system continues operating at a lower capability level instead of crashing entirely.

Cryptographic mechanism to verify both the integrity and authenticity of a message. Computed as HMAC-SHA256(secret, message). The shared secret ensures only someone who knows it can produce a valid HMAC — used to verify that webhook payloads genuinely came from the payment gateway.

Periodic ping-pong exchange between WebSocket server and clients to detect broken "zombie" connections. Without heartbeat, a TCP connection that dropped without a clean close looks alive to the server indefinitely — consuming memory and slots. Server sends ping every 30s; no pong = terminate.

Property of an operation where executing it multiple times produces the same result as executing it once. Critical for payment systems and retried webhooks — ensures a network retry doesn't double-charge a customer or double-process a webhook.

Compact, URL-safe token format for representing claims between parties. Consists of three base64url-encoded parts: Header (algorithm), Payload (claims: sub, role, tenantId, exp), and Signature (HMAC of header+payload). Stateless — server verifies without a DB lookup.

Indian payment orchestration platform that provides a unified API over multiple underlying gateways (Razorpay, PhonePe, Paytm, etc.). Routes each transaction to the best-performing gateway based on real-time success rates. Handles PCI DSS compliance, retry logic, and UPI.

Distributed event streaming platform. Publishers produce messages to topics; consumers read from them. Topics are split into partitions for parallelism. Messages are retained on disk (log) for a configurable duration — consumers can replay past events.

Kafka's built-in consensus protocol (from Kafka 2.8+, production-ready in 3.3) that replaces ZooKeeper for cluster metadata management. Controllers use Raft consensus to maintain metadata quorum, eliminating ZooKeeper as a separate dependency.

Open standard by Anthropic for connecting LLMs to external data and tools. Like USB-C for AI — any MCP-compatible LLM (Claude, GPT, Gemini) can use any MCP server (database, API, file system) without custom integration per pair. Supports SSE and STDIO transports.

Architecture where a single application instance serves multiple customers (tenants), with their data logically isolated. Three approaches: separate DB per tenant (expensive, strong isolation), schema-per-tenant (complex migrations), shared DB + tenantId field (simplest, chosen for Zoober/TingTing).

Standard candlestick data format for financial time series. Each candle aggregates all trades within a time interval (1m, 5m, 15m, 1h) into five values: opening price, highest price, lowest price, closing price, and total volume.

Concurrency control where a version field (__v in Mongoose) is included in update conditions. The update only succeeds if the document hasn't changed since it was read. If two processes try to update simultaneously, only the first succeeds; the second finds no matching document (version mismatch) → conflict detected.

Latency percentiles. P50 = median: 50% of requests are faster than this. P95: 95% of requests complete within this time — the industry standard SLA metric. P99: slowest 1% — often represents GC pauses, cold paths, or lock contention. P95 is preferred over P99 for SLOs because the last 1% is expensive to optimize.

MongoDB index that only indexes documents matching a filter expression. Smaller index = faster writes and less RAM. Ideal for collections where queries always include a condition matching the filter (e.g., only index isActive: true stores).

Flutter's bridge between Dart code and native Android (Kotlin/Java) or iOS (Swift/ObjC) code. Used when Flutter's built-in APIs don't cover a native feature — biometrics, native payment SDKs, background location, Bluetooth.

Temporary, signed URL for a private S3 object. The server generates it (using AWS credentials) and gives it to the client. The client can then upload/download directly from S3 for a limited time window — without the server proxying the file or exposing AWS credentials.

Authorization model where permissions are assigned to roles, and users are assigned roles. Each API endpoint specifies required permissions; middleware checks if the user's role has those permissions. Cleaner than per-user permission management at scale.

Routing read queries to MongoDB replica secondaries and writes to the primary. Distributes load — catalog browsing (reads) don't compete with order updates (writes) on the same node. Replication lag (~10-500ms) is acceptable for catalog reads, not for financial/order state reads.

In-memory data store used as cache, pub/sub broker, and distributed lock manager. Sub-millisecond read/write latency. Persistence options: RDB (periodic snapshot) or AOF (append-only file for durability). Single-threaded core — operations are atomic by design.

Momentum oscillator (0-100) measuring the speed and magnitude of price changes. RSI > 70 = overbought (potential sell), RSI < 30 = oversold (potential buy). Calculated as 100 - (100 / (1 + RS)) where RS = average gain / average loss over N periods (typically 14).

Ensuring every database query is scoped to the current tenant's data. Implemented at the service layer (not DB layer) — a BaseService class automatically injects { tenantId: req.user.tenantId } into every query filter, making cross-tenant data access structurally impossible through normal code paths.

AWS managed email sending service. Used for transactional emails (order confirmations, OTPs, admin alerts). Requires DKIM/SPF/DMARC setup for deliverability. Monitors bounce and complaint rates — high rates trigger sending limits or account suspension.

Google's compression algorithm optimized for speed over ratio (~1.5-2x compression). CPU overhead is negligible vs gzip (2.5-3x ratio but much slower). Best for high-throughput systems where decompression speed matters more than maximum compression ratio.

HTTP-based protocol for server-to-client streaming. A single long-lived HTTP GET connection; the server pushes text events. Simpler than WebSocket (plain HTTP, no upgrade) but unidirectional — client can't send data back over the same connection.

System with a finite set of states, explicit transitions between them, and guards that validate whether a transition is permitted. Prevents invalid state changes (e.g., DELIVERED → PENDING) by making only legal transitions possible.

Inter-process communication via standard streams (stdin/stdout). The MCP STDIO transport runs the MCP server as a child process; the parent (Flutter app) communicates via piped stdin/stdout. Fast, no network overhead, works offline — but requires process spawning, which is only possible on desktop platforms.

When many clients simultaneously experience the same failure (e.g., server restart) and all retry at the same time, creating a traffic spike that overwhelms the recovering server. Solved with jitter — adding random delay to backoff intervals so retries are spread across a time window.

Side-channel attack where an attacker infers information by measuring how long a comparison takes. Regular string comparison short-circuits on first differing byte — comparing "abc" vs "abd" takes longer than "abc" vs "xyz". Mitigated with constant-time comparison (crypto.timingSafeEqual) that always compares all bytes.

Rate limiting algorithm. A bucket holds tokens (max = capacity). Each request consumes one token. Tokens refill at a fixed rate. When empty → requests rejected (429). Allows bursting up to bucket capacity while enforcing average rate. Implemented in Redis using INCR + EXPIRE per key.

MongoDB index that automatically deletes documents after a specified time. MongoDB scans TTL indexes every 60 seconds and removes expired documents. Used to auto-clean sessions, rate limit records, webhook deduplication keys, and audit logs older than a year.

Percentage of time a system is operational. 99.9% uptime = 8.76 hours/year max downtime. Achieved through redundancy (multi-AZ, replica sets), zero-downtime deploys (blue-green), health check auto-recovery, and graceful shutdown on process restart.

Filters and monitors HTTP requests before they reach your servers. Blocks common attacks (OWASP Top 10: SQLi, XSS, LFI, RCE) and enforces rate limits at the CDN edge (CloudFront layer) — before traffic hits EC2. AWS WAF uses managed rule groups updated by AWS security team.

Protocol providing full-duplex communication over a single persistent TCP connection. Starts as an HTTP request then upgrades. Enables true bidirectional real-time communication — server can push data to client at any time without the client polling. ~40-60KB memory per connection.

When a single logical write triggers multiple physical writes to disk/memory. In a commerce context: order placed → write order doc, write payment doc, update inventory, write notification, write audit log, update analytics = 6+ writes per user action. Avoided by batching, caching hot reads, and using Redis to absorb read traffic so MongoDB only handles actual writes.

Technical analysis algorithm that filters price noise to identify only significant swing points (local highs and lows) where price moved at least N% from the previous pivot. Produces a simplified zigzag line through major price swings, used to find meaningful highs/lows for divergence comparison.