4 articles
New payment confirmation code ran in production on Joytop for a week in shadow mode — deciding nothing, only watching. Tomorrow it becomes the one that decides. What shadow mode actually does, what it protects against, and why you can't turn it on without watching it.
A deploy restarted the workers mid-flight and the emails were simply gone. What it takes to build a queue where a dead process is a delay, not a data loss.
Every payment provider tells you to make your webhook idempotent. Almost nobody tells you what that actually requires — which is a decision about identity, a decision about state, and a place to put the evidence.
Tenant isolation held together by developer discipline will eventually fail, because it only takes one query. Here is how to push the boundary down into Postgres so forgetting stops being possible.
