Design late-tolerant streaming window aggregator

You are handed an endless stream of events, each a triple (event_time, user_id, category). Records show up in no particular order, and one may reach you as long as 48 hours after it happened. Every reported number must be derived from event_time — the moment the event actually took place — and never from the moment your system received it. Hour buckets are anchored to absolute time: a bucket starting at h covers the half-open span from h to h + 3600 seconds, where h is a…