You implement session windows for user activity analysis. Downstream reports keep changing after publication. Explain.

What the interviewer is testing

Whether you know that session windows can merge retroactively, and that downstream consumers must be designed for retractions.

The mechanism

Session windows group activity separated by a gap timeout. Suppose a user is active at 10:00, idle until 10:25, then active again — with a 20-minute gap timeout that is two sessions, and both may already have been emitted.

Now a late event arrives at 10:15. It falls in the gap, so the two sessions merge into one. The previously emitted results are wrong and must be retracted and replaced by a single combined session.

Session windows have no fixed boundary, so this can happen for as long as late data is accepted.

What follows

Downstream must handle retractions. A consumer that appends emitted results will double-count: it has both original sessions and the merged one. Consumers need either upsert semantics keyed by session identity, or explicit retraction handling.

Published figures are provisional until the watermark plus lateness allowance has passed. Any report generated before then can change.

The options

Accept and design for it: consumers upsert, and reports state their provisional status until the window is definitively closed.

Publish only finalised sessions, waiting until the watermark plus allowance guarantees no further merging. Correct and adds latency equal to the session gap plus the lateness allowance.

Two outputs: a fast provisional stream for operational use and a finalised stream for reporting. This hybrid is common and should be a stated design decision rather than an emergent one.

What a strong answer adds

Sizing the gap timeout from the data. A session gap chosen by intuition — "30 minutes feels right" — produces sessions that do not correspond to real user behaviour. Analysing the actual distribution of inter-event intervals shows where the natural break is, and it is frequently very different from the assumed value.

Common weak answers

Concluding the windowing is broken. Removing late data handling, which loses events rather than fixing the semantics.