wickedshimmy

Value classes serve this purpose in Scala: `case class Id(id: Long) extends AnyVal` will have long-typed values at runtime (*mostly).

They can annihilate -- but annihilation channels are OZI-suppressed because of gluon effects in e.g. charmonium (the J/psi, a famously narrow resonance, which was one of the final states of the decay that produced this signal). The same mechanism is likely in play here as well (it is an artifact of QCD) -- the idea is that hadronization can be energetically favorable to annihilation: since the gluons carry a strong charge (color), they participate in the interaction and can nucleate a light q/q-bar pair rather than requiring an additional (virtual) gluon to couple to the annihilation vertex.

(Also it does happen with non-quark particles as well! Positronium for example, is an electron-positron bound states -- we just see more stable hadron particles like this because QCD has Weird Maths).

Yeah, this is an issue of "probability" in the physical sense not being the same thing as probability as defined by the Komolgorov axioms -- essentially, a sample space that does not have unit measure. This can end up being "resolved" by redefining the sample space, and the notion of what an "elementary events" is for physical interactions, for something we can define (and normalize) a total measure over, or by accepting the fact that probability isn't an accurate/complete description of what's going on (in the same way that quantum mechanics resulted in accepting that measurement wasn't a complete description of what's going on).

It's fine. Everything is fine.

This is a very good point, and is the sort of situation where API tokens can come into play and be useful. A client can make a single request to "open a session" and receive a short-lived key that is used as the password credentials for subsequent requests. Store active keys - since they are short-lived, offline attacks are less of a concern and you can probably choose to not slow-hash them. When the token expires and a request fails authentication, the client simply requests a new one and retries. The token lifetime is a much easier adjustment for which to weigh security versus performance/load considerations, compared to against broader password storage security.