Backends built
to be depended on.

An append-only, tamper-evident audit log. Every record is hash-chained to its predecessor like a ledger — rewrite history and verification breaks at the exact row.

1. Each row stores sha256(prev_hash ‖ canonical content); /verify walks the chain and pinpoints the first break.
2. Concurrent appends are serialized by a pg_advisory_xact_lock — the chain cannot fork, while reads stay fully concurrent.
3. Append-only is enforced three ways: no mutate paths, revoked grants on a least-privilege role, and a trigger blocking UPDATE / DELETE / TRUNCATE.

Feature flags with deterministic percentage rollout, targeting, and a client SDK that evaluates locally using the same engine as the server.

1. Bucketing is hash(salt ‖ key) → [0,1), depending only on the key — never the weights — so rollouts are monotonic: 10% → 20% only ever adds users. Uniformity verified over 100k keys.
2. The pure evaluation engine is shared verbatim by server and SDK — identical decisions, zero drift.
3. The Redis cache is version-guarded by a Lua version floor; a stale reader can never serve an archived flag as live. Redis down → transparent Postgres fallback.

Notification delivery on a BullMQ worker — at-least-once with a durable dead-letter queue, idempotency, retries with backoff, and timezone-aware quiet hours.

1. An atomic claim (UPDATE … WHERE status claimable RETURNING) means two workers can never both deliver; a lease reclaims a crashed worker's work.
2. The dead-letter transition is DB-authoritative, written before control returns — not a fire-and-forget event — so it survives crashes. A reconciler re-enqueues anything orphaned.
3. Idempotent enqueue (ON CONFLICT) plus a stable deliveryId handed to providers for downstream dedup.