I build software that stays correct when things fail — and I publish the evidence.

CONTEXT — The obvious design writes stock changes inside the request handler. Under load, that couples user latency to database contention and makes retry semantics ambiguous.

• Synchronous decrement in the API route— retries and duplicate submissions double-decrement; a crash mid-request loses the order
• Optimistic locking in application code— does not survive retried requests or a worker dying between read and write
• Idempotency check → Redis queue → single worker

DECISION — Accept at the edge, deduplicate by idempotency key, enqueue, and let one consumer apply changes through the locking RPC.

ACCEPTED COST — Purchases are eventually consistent (queue latency), which the UI must communicate. In exchange: exactly-once effects, calm failure handling, and a database that can be busy without users feeling it.

CONTEXT — The invariant must hold even if every process above the database misbehaves.

• Check-then-write in the worker— TOCTOU race between check and write
• SELECT … FOR UPDATE inside a Postgres RPC

DECISION — decrement_stock_atomic() locks the row, validates available stock, applies the change, and appends the audit entry — one transaction, one place where the invariant lives.

ACCEPTED COST — Throughput on a single hot item is serialized by design. Jobs are sorted by item id before processing to avoid deadlocks across items.

CONTEXT — Edge rate limiting depends on Redis. What happens when Redis itself is unreachable?

• Fail closed: reject all traffic without Redis— turns a cache outage into a full outage; protection becomes self-inflicted denial of service
• Fail open with a logged warning

DECISION — Availability wins for the rate limiter; the stock invariant never depends on it.

ACCEPTED COST — A Redis outage temporarily removes rate protection — accepted and logged, because correctness is enforced a layer down.

CONTEXT — The latency budget is sub-millisecond on CPU, and the feature space is sparse and categorical.

• Deep CTR model (DeepFM-class)— inference cost blows the latency budget without a GPU serving stack; marginal AUC gain on this data
• LightGBM with isotonic calibration per model

DECISION — Three small LightGBM models (300 trees, depth 4) with per-model isotonic calibration on validation data.

ACCEPTED COST — Probabilities are trustworthy enough to do economics on — EV math needs calibrated inputs, not just good ranking. The ceiling on raw accuracy is accepted.

CONTEXT — Budgets must survive bursty traffic without either exhausting early or under-delivering.

• Static per-minute spend caps— oscillates under bursty auctions; wastes budget in quiet periods
• PID controller tracking spend trajectory

DECISION — A PID pacing controller adjusts bid aggressiveness continuously, with a hard budget circuit breaker behind it as the last line.

ACCEPTED COST — Two knobs to tune (controller gains, breaker thresholds) — documented in the monitoring stack with Grafana dashboards rather than left as folklore.

CONTEXT — Every text-level signal is under attacker control by definition.

• Prompt classifier over text— defeated by paraphrase, encodings, prefix injection — exactly the threat model
• Hidden-state trajectory geometry

DECISION — Read the model's internals: adversarial prompts produce geometrically distinguishable paths even when their surface text is obfuscated.

ACCEPTED COST — Requires access to model internals (white-box only), and inference cost grows with probing. Accepted: this is a defense layer for models you host, not a universal proxy.

CONTEXT — The project's own phase-5.3 audit found whole-prompt trajectory features brittle: sensitive to prompt length and defeated by harmless prefixes.

• One global trajectory per prompt— the repo's own hardening audit documents the failure — length sensitivity, prefix dilution
• Sliding-window geometry features

DECISION — Compute tortuosity, directional stability, energy drift and velocity variance over windows, then aggregate.

ACCEPTED COST — More computation per prompt, and window size becomes a tunable. The failed architecture stays documented in architecture_hardening.md instead of being deleted.

CONTEXT — The 'separate' hybrid variant scored 84.51% test accuracy — six points above the 'shared' variant's 78.17%.

• Deploy 'separate' (84.51%)— more parameters, less interpretable attention, and the gap sits inside overlapping confidence intervals
• Deploy 'shared' (78.17%)

DECISION — Production model = shared variant: better parameter efficiency, interpretable attention maps, honest CI-aware comparison. Both results stay published side by side.

ACCEPTED COST — The headline number is lower than it could have been. That is the point: the README reports the choice and the alternatives' scores.

CONTEXT — Reproducibility claims are cheap; most 'accuracy' numbers cannot be re-derived a month later.

• Trust training logs— logs drift from artifacts; nobody re-runs them
• SHA-256 fingerprint + independent recompute

DECISION — The 944-star dataset is fingerprinted; an audit script recomputes accuracy and F1 from checkpoint weights and test-set IDs. 8/8 checks, 0 mismatches.

ACCEPTED COST — Slower to change the dataset (by design). Anyone can re-run the audit and catch drift.

CONTEXT — The decision engine runs in the kernel's dispatch path; the signal must be nearly free.

• Full workload classification (pattern mining)— too expensive for the hot path; belongs in userspace, adds latency to every dispatch
• Running seek-distance variance

DECISION — Three counters updated per dispatch give a variance estimate that separates sequential, clustered, and random workloads well enough to pick a strategy.

ACCEPTED COST — Coarser than a learned classifier — a deliberately dumb, fast signal in the kernel, with the fancy analysis pushed out to the dashboard.

CONTEXT — Variance is noisy; naive thresholding would flip algorithms constantly, costing more than it saves.

• Switch immediately on threshold cross— thrashing — each switch has re-ordering cost and destroys locality
• Hysteresis band + cooldown window

DECISION — A switch requires sustained evidence and a minimum dwell time in the current strategy.

ACCEPTED COST — Slower to react to genuine regime changes — the cost of stability, chosen consciously.