Project: review a receipt-ingest architecture decision

Calculate before comparing

Normal traffic is 310 requests per second, and the assumed burst is 744 per second. A worker measurement of 47 per second yields 16 healthy workers at peak, with 17 deployed if one may be unavailable. This is a worker-only planning bound; test the database, network, traffic mix, and latency separately. A complete 90-second writer outage at 744 arrivals per second could produce 66,960 arrivals before retries or rejection if admission stays open. That scenario makes queue capacity and admission policy explicit rather than recommending an untested size.

Compare and test the two contracts

Direct writes can return a completed receipt in the request path but expose writer slowdown to clients. A bounded queue can absorb a brief mismatch but may return only an enqueue acknowledgement; the client must accept a later completion state. Both paths require request-ID deduplication. The proposed queue decision stays unaccepted until client contract review and load evidence exist. Test duplicate replay, poisoned work, full queue behavior, and one failed worker. During a small pilot, stop expansion if completion latency, oldest-message age, or duplicate receipts breach the agreed limits. A rollback plan must account for already accepted queued work.

Observed normal: 18,600/min = 310/s.
Assumed peak: 310 x 2.4 = 744/s.
Measured worker: 47/s; 16 healthy; 17 deployed for one loss.
Writer outage scenario: 744 x 90 = 66,960 arrivals.
Open: client response contract, database capacity, latency target.
Release: limited pilot, stop limits, rollback owner and queue plan.

Performance and operating cost

Fixed-input capacity arithmetic is O(1); checking N workload records to validate the traffic assumption is O(N). Comparing two options across C constraints is O(C), while R release stages with K checks require O(RK) review actions. These counts say nothing about actual production safety without representative load and failure measurements. The final record should distinguish measured, assumed, proposed, accepted, deployed, and superseded states so no diagram or model response appears to authorize a rollout.

Common Mistakes

• Do not present 17 workers as an end-to-end guarantee.
• Do not treat queue acceptance as completed receipt delivery.
• Do not rollback routing while leaving in-flight work without an owner.

Connected lessons

• Architecture prompts: start with constraints and an owner
• Capacity prompts: check units, headroom, and a failed worker
• Architecture decisions: compare real alternatives and consequences
• Architecture prompts: test the failure path and its signals
• Architecture release: require evidence, rollback, and ownership
• Numeric prompts: let code calculate and the model explain
• Prompt release review: assemble the decision packet
• Incident triage prompts: build a timestamped evidence ledger
• Architecture-decision prompt checks