Nice write up dude! Bloom filters are a classic for pruning shards, but it’s great to see concrete numbers on bit-array size and hash counts — those "back of the envelope" estimates really help ground the theory. I’m curious how you tune the false positive rate in environments where cardinality spikes (e.g. DDoS bursts) — do you resize filters on the fly or accept more “maybe” shards? The HyperLogLog++ section was crisp too, but I’d love to see a comparison to Count-Min Sketch for heavy-hitters queries (e.g. top IPs) and real-world benchmarks against Redis PFCOUNT or ClickHouse’s built-in HLL. Anyone here tried combining these probabilistic structures in the same pipeline?