03 ApplicationBuilt to hold up when nobody is watching
Decisions I made, each with a reason:
- Three databases, three trust levels
- One writable app schema, a read-only copy of the warehouse reached through a self-healing tunnel, and the live warehouse, read-only.
- Access enforced at exactly three points
- Role defaults live in code, per-user overrides in the database, and the page, the API and the menu all ask the same question.
- Nothing outside trusts the browser
- Anything sent to another platform is rebuilt by the server from the typed fields only. A tampered form cannot change an account type or backdate a contract.
- Every card loads on its own
- One card was ready in 165 ms and still waited 1.5 s for its slowest neighbour. Now each one streams in as soon as its own query answers.
- Refuse rather than lie
- If the warehouse comes back empty in the middle of a sync, the app stops and says so instead of sending zeros.
- Migrations only add before a deploy
- Removals ship after, in a separate step. I learned that one by repairing production.