Topic
Architecture, correctness and the bugs that only show up in production.
78 articles
Dimensions and features already sit on a quote line. Turning them into geometry needs an archetype layout and a registry keyed by code, not a modelling pipeline.
Converting forty key columns to a single id format, three of them had to be reverted, because what they held was a handle, a display name and a mixed bag.
The clients hardcoded language, timezone and currency everywhere. The only endpoint holding the real values needed a permission a sales rep never gets.
Auditors ask why invoice 41 is missing. A database sequence will make holes, and a number allocated at draft becomes a hole the moment the draft is discarded.
Forty-seven error codes the API could emit had no copy in the portal, so users read raw key strings. Nothing in the stack treats that as a failure.
The first model was a person, a certificate and an expiry date. Then came a register of 184 obligations across 15 domains, almost none of them certificates.
Two suites invited members and never removed them. Nineteen accumulated, the seat limit tripped, and unrelated suites started failing on a rule they never touched.
A credential row carried both an expiry date and a status label. Only the date changes meaning as time passes, so every query had to distrust the label.
A field-force product where a rep could not take an order on the phone. The API was complete, the module was marked done, and the flow did not exist on any client.
A clean import run proves nothing. Reconciling every entity count against the source, and naming the cause of every difference, is what proves it.
Statutory real-time invoicing turns each sale into a distributed transaction with a regulator. The first design put the network call inside the sale transaction.
A draft function set a row's identifier after inserting it. The table had UPDATE revoked, so the schema would have rejected code that every review had passed.
Every pricing rule assumed inches. The customer wanted to enter millimetres. Converting at the API boundary was the only change that could not corrupt old quotes.
The first release build of the mobile app failed on two configuration bugs weeks old. Development mode had never touched either code path.
A hundred and fifty multiple-choice questions all had the answer in the first position. Each one was right. The distribution was the defect.
Thirteen of 362 pricing rules needed to call other rules and branch on a dimension. Keeping the language to CALL and CASE is what kept it safe.
A comment said the numbering scheme avoided race conditions. The loop underneath it retried on duplicate key ten times, which is what you write when it does not.
Every contract bug in the project so far had been between contributors rather than inside one, so the rebuild started by making the seams mechanical.
A reorder level of zero means alert me when it runs out. No reorder level means never alert me. The empty string coerces to zero and the distinction is gone.
Nine send points, each carefully guarded, firing into an empty token table because the app had never called either registration endpoint.
A phone out of coverage for a day burned its retry budget on failed connections and parked a valid order as rejected. That is the loss a queue prevents.
One made-to-order product had 24 features and 62 variants. Pricing at product level is combinatorially hopeless; pricing per feature is not.
What auditing a fabricator's quoting workbook revealed about how bespoke pricing really works, and which parts of it a person was silently holding together.
The output document is a specification. Reading real ones confirmed eight pending requests, produced several more, and settled two arguments about tax.
Removing a child archived the row. Adding her back created a new one. Her whole history stayed behind, and her old tablet credential stayed live.
Knowing what to charge is not knowing whether the job is worth taking. Two evaluations through the same rules give per-feature margin without a second engine.
One building held a press, a store and a shop. A type column forces a choice; a capability set does not, and the check reading it used the wrong operator.
A stale closure in a loop created six rows where one was intended, and an unordered query picked whichever of them the database felt like returning.
Deleting a product left 211 orphaned price entries and 104 orphaned variants. Fixing the product path missed the variant path, which orphaned exactly the same rows.
Keeping the full evaluation trace on the quote line paid for itself twice — in explaining old quotes, and in a bill of materials nobody had planned for.
The received quantity could not exceed the ordered quantity. That is a policy, not a fact, and the warehouse hit it the first time a supplier sent a full pallet.
A helper decided a stored value was a fraction if it was between zero and one. The one organisation that most needed the alarm got a perfect score instead.
Four places asked "is this about to run out" and four expressions answered. Two excluded today, one included it, and one forgot to exclude revoked records.
The CAD files looked like the authoritative source for dimensions and geometry. They were neither. What they were useful for was checking the formulas.
One dispatch per order was a scope decision. Removing it for partial shipments exposed a race where two dispatches could each ship the last unit.
A proxy metric that works on average can fail completely on one part of its domain, and the part it fails on is often the part you added it for.
A completeness dashboard counted every variant of every feature as required. The import was fine; the counting rule was wrong, and it hid the real gaps.
Seventy-five endpoints, all parent-facing. The child's half of the product had a schema, a plan and a design, and no server to talk to.
A sale, a production run and an adjustment all wrote the same inventory row. One took a row lock, one wrote a ledger entry, and one did neither.
Publish was a button. Assign was an item in an overflow menu on another screen. The child's tablet needed both, and said nothing when it had one.
The source workbook had two formula columns per row, one per grade. That single detail decides how a bespoke pricing engine has to resolve rules.
Offline delivery capture was a fiction, because the screen that records it could not be opened without a connection. The queue worked. Nothing could reach it.
A production output table had a nullable parent column, an old parent beside it, and two identical foreign keys — one migration, told three ways.
Rows written in one transaction share an update time to the microsecond. A greater-than cursor drops them and a greater-or-equal cursor repeats them forever.
Three fallbacks in one expression, ending in a statutory rate typed into a route handler. A zero-rated sale skipped the first two and got taxed at the third.
An unordered single-row lookup on a non-unique key is not a bug that throws. It is a bug where the user presses a button and the screen ignores them.
The same mistake bit a rental ledger three times in three months — a field naming an amount was read as proof the amount had moved.
A dashboard tile read 86 open jobs for one driver. Three were open. The other 83 had ended in ways the app was never told about.
Seventeen layout tests passed against a stylesheet that made the assertion impossible to fail. Fifty-one screen tests passed on a portal that was entirely read-only.
Hand-written audit calls get forgotten, and a forgotten one makes the whole log untrustworthy. Capture centrally, label by registry, and mine the unlabelled.
A salesperson pitching a campaign that starts next quarter does not care what is free this morning. Availability needs a date argument, not a boolean column.
A test proved expired discounts still applied. The test was wrong, the bug was real, and both came from treating a business date as an instant in time.
Tenant isolation enforced by WHERE clauses depends on nobody forgetting one. Enforced by the schema, a cross-tenant row cannot be written at all.
An approval step no expense could reach. A module nobody opened. Rebuilding around the real workflow started by removing everything that was not it.
Two compromised sites were rebuilt as static HTML with no interpreter and no database. The attack surface did not shrink — it stopped existing.
Two tables held outstanding amounts. Nothing kept them in step with the invoices they came from. Pay an invoice and the ledger never noticed.
Nine modules named after data types. One job — book a hoarding and bill for it — spread across three of them. That is why software feels scattered.
362 pricing formulas, none of them in the source code. How to evaluate business-authored expressions without eval, and why that boundary matters.
A proposal is a slide deck and a cost sheet. Generating both from the same records that produce the booking removes an afternoon of retyping per pitch.
A mutable points column looks simpler for about a week, and then a retried request pays twice and nobody can explain where the balance came from.
A read followed by a check is not a guard. Two webhooks for one payment both passed it, and the customer's account was credited double the amount.
Fixed-precision money columns come back from the driver as strings. Add them with the wrong operator and the total is silently not a number.
A digital screen loops six to eight adverts at once. The system allowed one. That is a correctness defect, and it should be sequenced like one.
Who is this leg assigned to? Nine places answered it independently. Eighty-one legs got an arbitrary answer and eighteen invented a driver who was not there.
Runs until the client stops" is a real commercial term. Storing it as a null end date breaks overlap checks, calendars and availability all at once.
Replacing two hard-coded roles with 77 granular permissions, and the design bug that would have shown field staff the director's dashboard.
The data was a chain and the interface was a set of dead ends. No record linked forward to the one it produced, so every step meant going back to a menu.
A customer paid a five thousand rupee deposit and was immediately asked for it again, because the ledger recorded the receipt as a new row.
Offline-first only works if the client can tell "already applied" apart from "rejected". A single conflict status collapses both into one answer.
A hoarding is a location. What a client buys is a surface, for a window, at a rate. Conflating the two puts the overlap check on the wrong row.
Every invoice had to reference a booking. The business raised invoices without bookings all the time. The constraint had encoded an assumption nobody checked.
An application calling its own API by public hostname consumed two workers per request. At five workers, five simultaneous visitors deadlocked it permanently.
Keeping a husk row for the audit trail produced phantom drivers on eighteen legs. Deleting the row and logging the change was the safer design.
A driver dashboard counted work by a row's updated timestamp. The timestamp was stamped on insert and had never moved on any of 221 rows.
A counter charge and an upstream re-price added the same 1,593 rupees an hour apart. Both stood, and the ledger held back the customer's deposit for it.
A co-investor's profit share and an agency's introduction commission are both money out to a company. Everything else about them differs.
Designing field apps for staff with no signal: local-first writes, durable queues, idempotency and conflict rules decided by the business.
Bespoke manufacturers price in spreadsheets for good reasons. A governed pricing engine keeps the flexibility and removes the drift.
