Three patterns for a reliable cloud-to-device command path: derive timeouts on read, use a conditional write as your idempotency primitive, and never trust the broker to tell you which environment a message belongs to.
On DynamoDB, the outbox is one TransactWriteItems and the relay is Streams, Pipes and SQS FIFO with no code of ours. Exactly-once was harder: two error paths in our inbox quietly made it at-most-once.
Events are how our modular monolith keeps its seams sealed. This is the transactional outbox, hash chain and four delivery lanes we built on DynamoDB, and the two ways it failed silently before we made it prove itself.
Our architecture is not a document. It is thirty-five numbered rules and eight named ones — and almost every one exists because something already went wrong quietly.
Every automated check answers a question about code that exists and paths that run. The defects that survive a mature pipeline live outside both — and they announce themselves the same way a healthy system does.
How architecture rules stop being preferences. Someone on the team opens a pull request. One line, added to a service class: @cache def resolve_plan(code: str) -> Plan: ... It gets approved, and of course it does. It's memoization on a lookup that looks pure, it takes
What happened when we made a physical transducer and a call to a language model the same kind of object - one manifest, one reading envelope, one store, and four guards that run at every boot.
Somewhere in most mature codebases there are three ways to schedule a recurring job. Nobody chose that. There is no design document proposing three schedulers, no meeting where a team weighed the options and landed on "several." Look closely and each one had a good reason at the
Keyspaces looked like the safe choice. Cassandra was already running in the stack, so letting Temporal reuse it meant no new engine and everything staying in-account. Then we hit the wall: Temporal's Cassandra schema depends on conditional batch writes, the lightweight-transaction mechanism behind shard-ownership fencing, and Keyspaces doesn&
Two sensors share one I²C bus on our hub. One is an MLX90640 thermal imager sampling an 8×8 temperature grid twice a second. The other is a combination proximity-and-barometer that checks the room distance and ambient pressure at roughly the same cadence. Each sensor looks harmless in isolation.