Decisions, at full length.
Each stage in the anatomy is a decision with a cost. These are the ones worth more than a paragraph, written the way I would explain them to the engineer sent to check my work.
The webhook that credits twice
A payment processor delivers every result at least once. The interesting engineering is in what happens when your side fails halfway through.
A ledger you can edit from a route handler is not a ledger
Why every movement of value on the payments platform goes through a Postgres function, and what it costs to keep it that way.
Four rows that were not theirs
Hardening multi-tenant row-level security in four reversible phases, verified by impersonating a member and counting what they could see.
The bug inside the fix
A payout race, the fix for it, the bug inside that fix, and why it is the best argument I have for one person owning the whole path.
The sale that arrives with no referrer
A creator shares a link on Instagram, the buyer taps it, installs the app and purchases. Nothing in that chain carries the creator's name across. Here is what does.
The minimum that belongs to someone else
Held commissions are released to creators once a brand's payout minimum is met. Group the money by creator, the obvious way, and one brand's minimum ends up holding another brand's money.
The commission that must not mint twice
A buyer pays and the platform owes a creator a commission. Between those two facts sit a colluding pair, a call that arrives twice, and a cart with three items on one payment.
The rule that has to be written twice
Firestore security rules do not cascade to subcollections. Forget that in one place and a single query returns every private message on the platform.
Thirty days in the ledger
Splitting a payment at charge time is simpler and wrong: a refund after the creator is paid is a clawback nobody enjoys. Holding the money creates a different set of problems, and each piece of machinery around the hold answers one of them.
Arbitrary but consistent
A gym's assessment answers become rules that swap an exercise for a member before a session. Two rules can disagree about the same movement. The code says who wins, and the comment admits how.
The number that ducked every threshold
A deposit arrives from a browser carrying two numbers. The platform scored one of them and charged the other, and every limit it had was measuring the wrong figure.
The second one tells you the shape
High-risk merchants get dropped by processors, so the platform cannot be welded to one. The interface that makes a processor swappable could not be designed before the second one existed.