Estate Layout & Governance

A stream's name should carry the owning domain, its purpose, the environment and a version segment. Each answers a question a joining team would otherwise have to ask a person, and grants and quotas are written against the leading segments.

Creation on first use turns every typo into a permanent stream: empty, billed, and indistinguishable from a deliberate one. It also means the stream is born with whatever values the platform supplies and no recorded owning team, rather than values anyone chose.

Most platforms have no rename operation — the name is the stream's identity — so a rename means standing up a second stream and moving everyone. Grants, quotas, retention settings, mirroring rules, dashboards and alert conditions all name the old string.

Absence of writes is one line of evidence out of three. A decommission also needs no reader — nothing attached, no stored reading position advancing — and, where records stay readable after delivery, no replay, all observed over a stated observation window and put to the owner record.

Stand the replacement up, write every record to both, move readers across, move writers, stop dual publication, wait out a quiet period, then delete. The delete goes last, and alone, because it is the one step nothing undoes.

A shared cluster puts one set of nodes and volumes, one capacity ceiling, one deployed version and upgrade window, one administrative surface and one on-call rota behind every stream on it. Dividing the names inside changes none of that.

Splitting multiplies operating load, not traffic. Every cluster needs its own upgrade rounds, grant set and credential rotations, alert coverage, capacity reviews, drills and on-call knowledge, plus a minimum node count and spare headroom. The records written stay the same.

An owner record names who is answerable for a stream years later. People change teams and leave, and nothing about that updates the field, so it still looks filled in while resolving to nobody. A rota or shared mailbox outlives its members.

Exactly as far as the grants written against it. The convention enforces nothing by itself, so the boundary holds only where creation rights are constrained too, no broader grant overlaps it, and no other team's prefix begins with the same characters.

It receives the cluster's own values for how many stored copies a record has, how long records survive, and, where the platform splits a stream, how many parts it gets — plus no owning team. Whoever set the cluster up chose them, for no particular workload.

It covers the credentials enrolled in it, not the team. A quota is a number plus an attachment point, and where that point is a credential rather than the space, per-team budgeting is only as accurate as the credential-to-team mapping.

A version segment in the name marks a stream being replaced, not a payload shape changing. Bump it when the stream's identity changes — what it contains, how it is keyed, its scope, the record-lifetime contract readers depend on. Do not bump it for payload field changes.

The observation window was shorter than the interval between legitimate uses. A quarterly reader is absent for about eighty-nine days out of ninety, so fourteen days of silence is the normal state and proves nothing. The window must contain the slowest periodic user, with margin.

The gate is slower than the path it replaced, so avoiding it is the cheapest option. A reviewed path only holds if it delivers a stream faster than the workaround does; otherwise engineers reuse an unrelated stream and the estate degrades invisibly.

Dual publication protects whoever has not been moved yet: both streams carry the full traffic, so consumers can be relocated gradually and put back. It does not carry stored positions across, does not remove duplicates, and protects nothing after the delete.

The cut-over window and the quiet period were shorter than the interval between two runs of the slowest consumer. A monthly reader never appeared while the old stream was still there to catch it, so the first symptom arrived after the irreversible step.

Everything already running has to move. A second cluster starts empty, so streams, settings and grants are recreated, every producer and consumer is re-pointed and redeployed on its own team's schedule, restart points are chosen by hand, and the old cluster stays until nothing uses it.

Publish one grammar and a vocabulary with written-down expansions, apply it to new streams, and rename only the names that are dangerous rather than merely ugly. Renaming is priced per stream, so a blanket 400-stream rename buys consistency at migration cost.

Anchor ownership to something that outlives the org chart, usually the service that produces the stream; make the field required at creation, re-resolve it on every sweep so an unreachable owner is a finding, and define a fallback owner with a challenge period rather than silent inheritance.

A version or settings change has to be rehearsed somewhere that is not production, and that argument holds whatever a second cluster costs. Sharing also puts unpredictable non-production traffic and the irreversible operations on production's nodes, guarded only by grants.

Narrow it to names, grants and quota attachment. A named space scopes those and nothing else: it does not isolate availability, latency, stored bytes or the blast radius of a cluster-wide change, and teams design against whatever the policy appears to promise.

Settings whose right value is workload-specific and costly to get wrong should have no default, so an absent value fails the request instead of being decided for someone. Everything else needs one, or the mandatory list grows until requesters copy another team's file.

A fixed sequence nobody re-invents, minimum durations tied to the slowest consumer rather than an arbitrary number of days, the delete as its own dated change, a reversible rehearsal before it, and a named person who may shorten any of it.