Tagged architecture
22 pieces
- · 11 min read
If You Cannot Rebuild It, It Is A Source
A three-layer record holds an append-only source layer, a governed derived layer, and a revisable current-state layer with history. The rule between them is that the derived layer must be regenerable from the source. When it cannot be, it has silently become a source that no governing document describes, so nothing controls changes to it.
- · 11 min read
Your AI Vendor's Terms May Ban Your Users: Read the Population Restrictions Before You Pick a Model
Major generative AI providers' terms bar applications that are directed at, or likely to be used by, people under eighteen. The moment a product defines a Student or a Child role, an entire class of model provider is ruled out. Because this is almost always discovered after the architecture is drawn, it arrives as a rebuild rather than as a constraint. Here is how to read provider terms for user-population restrictions, what to do with a mixed user base, and why the clause has to be re-verified at build time.
- · 11 min read
One Core, Many Campaigns: Why Forking the Working Flow Per Tenant Always Drifts
When a product runs many campaigns or tenants, copying the working flow per campaign is the default, and the copies drift. A reliability fix lands in whichever copy somebody was looking at when the bug was reported. Eventually the same inbound event is handled differently depending on which campaign produced it, and triage begins with asking which one. This covers one core plus configuration as data, the test for whether a difference is data or a capability, and how to tell you have already forked.
- · 7 min read
A Migration Is Not a Build: The Old System Knows Things Nobody Wrote Down
Replacing a long-lived platform gets scoped as a greenfield build because the new stack is the exciting part. What actually has to move is fifteen years of business rules encoded in stored procedures and triggers, which no specification describes because nobody ever wrote them. The first deliverable is proving that knowledge moves, on a copy, before anything depends on it having moved.
- · 11 min read
Phasing Is the Architecture: Lay the Reliability Core at Phase One or Rebuild Four Times
A product that must grow from a seed either lays its reliability core at phase one, or rebuilds at every growth step and re-litigates the same reliability questions four times. The core is deliberately more than phase one needs and exactly what the phases after it require, because some properties can be added later at linear cost and some cannot be added later at all. This gives the filter for what belongs in the core, the mechanical test for whether a phase is additive, and what to do when a phase genuinely changes the core's contract.
- · 10 min read
Prove It By Construction, Not By Testing: Partitioning Away A Failure Class
On a tightly coupled memory architecture, two real-time paths that share a memory bank can collide, and the symptom you see is a buffer underrun. You can chase that symptom with soak tests and priority tuning indefinitely. Partitioning the memory and the direct-memory-access ownership so the two paths never reach the same bank removes the collision instead. A collision that cannot happen needs no stress test for its symptom.
- · 8 min read
The Fan-Out Budget: Expand, Filter With Something Cheap, Spend the Paid Call Last
When one user request has to become many calls to a paid provider, cost and latency scale with the number of candidates rather than with the number of requests. The fix is an ordering: generate candidates from something you own, filter them against something cheap, and spend the expensive call only on survivors. The budget then holds per request instead of per candidate.
- · 7 min read
A Cached Price Is a Gate, Not a Quote: Two Jobs One Number Cannot Do
An indicative value and a committed value are different objects with different tolerances, and the cheapest way to break a product is to let one become the other. A cached price that ranks candidates is allowed to be wrong. The same number shown to a user as what they will pay is a promise. Keep them separate in the type system, not just in the documentation.
- · 7 min read
Bound the Concurrency or Your Latency Problem Becomes a Refusal
Running independent calls concurrently is the right instinct, and unbounded concurrency converts a slow path into a failing one. Without a ceiling, a wide request exhausts connection pools and trips provider rate limits under exactly the load where it matters most. With a ceiling, the same load produces a slower response that still completes. Turning a failure mode into a latency mode is almost always the correct trade in a user-facing path.
- · 8 min read
Price the Baseline in the Same Pass, or Your Ranking Is Not Answering the Question
A product that offers a clever alternative to an obvious option has to show it beats that option, on the same inputs, at the same moment. Ranking your own candidates against each other answers which of yours is best, which is not what the user asked. The baseline has to be computed in the same pass, or the comparison is against a number from a different time with different availability.
- · 8 min read
A Global Minimum Is Wrong in Both Directions: Feasibility Rules Belong Per Location
One threshold applied everywhere is simultaneously too strict where conditions are easy and too loose where they are hard, so it rejects good options and admits dangerous ones at the same time. Feasibility rules have to be per location and per case, and the cases differ in kind rather than in degree: clearing immigration and collecting a bag is not a longer version of walking between gates.
- · 7 min read
You Cannot Deduplicate Before You Normalise: Identity Is a Decision, Not a Property
Two records from different sources cannot be compared until they share a shape, so deduplication is downstream of normalisation whether or not anyone planned it that way. The harder half is that identity then has to be defined deliberately: nothing in the data says which fields make two records the same thing, and that choice decides both your duplicate rate and your merge errors.
- · 7 min read
Put the Catalogue in Data and Growth Becomes a Row Instead of a Release
Every product has one thing certain to grow: the list of cities, currencies, carriers, document types or tenants it supports. Where that list lives is decided on day one and cannot be revisited cheaply, because by the time it matters the launch set is wired through the application. Modelled as data, adding to it is a row. Modelled as code, it is a ticket, a deployment and a regression pass, forever.
- · 9 min read
The Most Important Screen Is A Database Decision
In a regulated product, which system holds the official copy of each piece of data sets the compliance posture, the monthly cost, and whether later integrations are additions or rebuilds. It is not a screen and it is the first decision. Decide it per datum, not once for the whole product.
- · 9 min read
Two Code Paths During a Strangler Migration
Incremental replacement behind an existing system means two implementations coexist for the whole migration, with a routing seam between them. That is a real cost rather than a detail. Routing rules, shared state, sessions that cross the boundary and the criteria for declaring a path finished all have to be designed up front, because the alternative is discovering the seam's behaviour from incidents.
- · 7 min read
The Seam Is Nobody's Job: Why Failures Live Between Systems That Each Work Correctly
Three systems, each owned, each correct by its own contract, each reporting success. The failure lives in the relationship between two of them, and relationships are not assigned to anyone. That is why these defects survive code review, pass every component test, and are found by a customer rather than by a team.
- · 6 min read
Who Hears About the Failure First: Five Ways to Buy the Same Integration
The same piece of work can be bought from a platform, an agency, a specialist, a generalist or in-house, and the engineering is similar in all five. What differs is who finds out when the boundary between two systems breaks, how long it takes them, and whether anyone is contractually obliged to care. Choose on that rather than on price.
- · 9 min read
The Device Decides The Form Factor
No mobile browser on one major platform exposes the interface a web page needs to reach a Bluetooth peripheral. If a connected device is anywhere on the roadmap, the product cannot be browser-only, and that constraint is set by the platform rather than by preference. Establish capability constraints like this before design, not during it.
- · 7 min read
Attribute at Capture, Never Infer Later: An Untagged Record Belongs in a Bucket, Not in an Estimate
Attribution reconstructed after the fact from session data, timing or traffic patterns is a model presented as a measurement, and it is confidently wrong in the cases that matter most. Capture the context at the moment the thing happens, store it on the record, and put what arrives without context into an explicit unattributed bucket rather than apportioning it.
- · 7 min read
A Reading Is Only as Good as Its Weakest Hop, So Prove the Whole Path Before You Commit the Fleet
Owning one layer of a telemetry chain means shipping a dashboard that is confidently wrong in ways nobody upstream can see. Four proven hops and one unproven does not give you four fifths of a product. The question worth paying to answer first is whether the whole path holds end to end, and the deliverable from that answer includes the gaps, marked rather than smoothed over.
- · 6 min read
Every Reused Module Is Untested Until You Run It Against the New Envelope
A reused module carries a correctness argument scoped to its old environment. Ariane 5 lost a launcher to a conversion that was safe within Ariane 4's velocity range, and the Therac-25 killed three people reusing code whose assumption about hardware interlocks was no longer true.
- · 6 min read
Boeing 737 MAX and MCAS: The Single Sensor Nobody Fault Injected
MCAS depended on one angle of attack sensor for a function Boeing's own assessment classified as hazardous, a classification that normally precludes single sensor dependence. The safety analysis also understated the system's authority by more than four times. This is a system safety failure, not a missing unit test.