Plain meaning
Start with the shortest useful explanation before going deeper.
An 8-byte identifier prepended to account data and instruction data to distinguish types. Anchor computes it as the first 8 bytes of `sha256('account:<AccountName>')` for accounts and `sha256('global:<function_name>')` for instructions. Discriminators prevent type cosplay attacks by ensuring data is deserialized as the correct type.