Inputs that must be captured for a reproducible test become visible, including clocks, mutable reads, and external responses.
Apply when
A rule is difficult to test because it implicitly reads a clock, database or external service.
Reconsider when
A trivial adapter with no decision logic has little meaningful calculation to extract.
Costs and failure modes
Moving effects outward introduces explicit data flow and snapshot assumptions.
Case file
A worked decision
A ferry fare calculation quietly reads the current time and exchange rate. Capture both once, then calculate the fare from the trip, timestamp and rate as explicit inputs.
Change the condition
If a function only sends an already prepared passenger notification, no meaningful pricing calculation is hidden in that action.
Check the decision
Using the same captured inputs on another day, does the fare calculation produce the same result without contacting a service?
Collect correlated inputs until an explicit completion condition permits an output.
FamilyMessage routing
ScopeIntegration flow
Editorial statusDraft
What it buys
A downstream client can consume one summary of a correlated group instead of tracking each partial response and its completion state.
Apply when
Partial quotes must be combined into a single response.
Reconsider when
Each arrival can be consumed independently without a joint result.
Costs and failure modes
Missing or duplicate parts require timeouts, durable state and a completion policy.
Case file
A worked decision
A flight-search service combines replies from several carriers for one search ID. It completes on a deadline and marks which carriers did not respond instead of treating silence as an empty schedule.
Change the condition
If the UI can display each carrier's independent result as it arrives, keeping a central result set may add unneeded latency and state.
Check the decision
Deliver a duplicate reply and a late reply after the deadline and verify that the final result remains consistent with its completion rule.
Translate behavior and data at the boundary so an external model cannot dictate local meaning.
FamilyDomain boundaries
ScopeBoundary between unlike models
Editorial statusDraft
What it buys
A partner's renamed status codes can be accommodated in one translator while local business rules keep their established meanings.
Apply when
A legacy or vendor model conflicts with important rules or vocabulary in the new system.
Reconsider when
The two sides already share semantics and translation adds only copying.
Costs and failure modes
The translation layer requires semantic tests and ongoing maintenance as either side changes.
Case file
A worked decision
A new hospital scheduling system translates an old billing code called a visit into the new model's encounter, booking or adjustment before scheduling rules see it.
Change the condition
If both teams already use the same definition and change the schema together, a separate translation layer can distort rather than protect meaning.
Check the decision
Give the adapter a billing adjustment and check that no patient appointment is created.
Provide a backend tailored to one frontend's workflow and delivery needs.
FamilyService architecture
ScopeAPI boundary per client experience
Editorial statusDraft
What it buys
A mobile screen can fetch the fields it needs in one tailored request without forcing desktop clients to adopt the same response.
Apply when
Clients differ materially in payloads, latency budgets, ownership or release cadence.
Reconsider when
Consumers make essentially identical requests under the same team.
Costs and failure modes
Duplicated logic and extra deployables become expensive without firm responsibility boundaries.
Case file
A worked decision
A field technician's phone needs a short offline-ready job summary, while the dispatcher needs a detailed map and staff availability. Give each client a backend that assembles its own response.
Change the condition
When both screens need precisely the same representation and change together, one endpoint is simpler.
Check the decision
Change the mobile summary and check that the dispatch client needs neither a release nor a larger payload.
Knowledge sources contribute partial hypotheses to a common problem state under a control policy.
FamilyStructural architecture
ScopeProblem-solving system
Editorial statusDraft
What it buys
Independent specialists can refine a partial answer as evidence arrives, including when no specialist can solve the whole problem alone.
Apply when
An interpretation or recognition task needs different heuristics whose order cannot be predicted.
Reconsider when
A deterministic sequence of complete transformations already solves the task.
Costs and failure modes
Progress and termination depend on scheduling and conflict resolution.
Case file
A worked decision
A wildlife-monitoring system writes uncertain detections to a common board. Audio, video and location specialists refine a candidate only when new evidence makes their inference possible.
Change the condition
If every recording follows the same fixed sequence of three transformations, a pipeline states the work more clearly.
Check the decision
Can an audio-only sighting later be revised by video evidence without changing the audio specialist?
Define the boundary inside which a domain vocabulary and model have consistent meanings.
FamilyDomain boundaries
ScopeModel and ownership boundary
Editorial statusDraft
What it buys
Teams can model an account differently for billing and authentication while retaining an unambiguous vocabulary inside each boundary.
Apply when
Different teams use the same terms for legitimately different concepts or lifecycles.
Reconsider when
A proposed split cuts a tightly coupled invariant without a workable coordination model.
Costs and failure modes
Interfaces require explicit translation, and context discovery takes domain expertise.
Case file
A worked decision
A marketplace distinguishes a product offered for sale from a product that a warehouse picks. Separate models allow a single offer to refer to a kit containing several stocked items.
Change the condition
If both teams use product with identical identity and invariants, maintaining two translations has little benefit.
Check the decision
Ask both teams what uniquely identifies a product, and test the answer against a bundled kit.
Introduce an abstraction and gradually redirect clients between old and replacement implementations.
FamilyModernization
ScopeInternal component replacement
Editorial statusDraft
What it buys
A replacement implementation can serve a few callers in production while the rest continue using the old implementation.
Apply when
A dependency replacement must span multiple releasable commits.
Reconsider when
A small change can be safely made atomically or the seam would survive without purpose.
Costs and failure modes
Dual implementations and temporary switches add overhead until removal.
Case file
A worked decision
A search service must replace its ranking engine while receiving traffic. Route ranking calls through a narrow interface, compare recorded queries against both engines and switch callers gradually.
Change the condition
If the engine has one offline caller and a short maintenance window, replace it directly behind that caller.
Check the decision
Can one configuration change return all ranking calls to the old engine before its data is removed?
An intermediary locates service providers and mediates remote requests, replies and exceptions.
FamilyStructural architecture
ScopeDistributed object or service invocation
Editorial statusDraft
What it buys
A client can keep using its service contract when the provider moves to another host.
Apply when
Clients must invoke interchangeable or relocatable remote providers through a common interface.
Reconsider when
A small, fixed topology can use direct calls and does not need mediation.
Costs and failure modes
The broker adds latency and a failure dependency and cannot hide remote partial failures.
Case file
A worked decision
A lab workstation requests instrument calibration through a broker which locates an available instrument service and mediates invocation. Drivers can move without changing each client.
Change the condition
For one permanently attached instrument, a local adapter and direct call expose failures more clearly.
Check the decision
Move the service to a new endpoint and test whether an unchanged client can still calibrate and receive a failure reason.
Translate interoperating formats through an agreed intermediate representation.
FamilyMessage contracts
ScopeApplication integration
Editorial statusDraft
What it buys
A newly connected system can translate to a common exchange model instead of implementing a mapping to each peer's format.
Apply when
Many applications exchange overlapping concepts and pairwise mappings proliferate.
Reconsider when
Two applications share a narrow stable contract, or meanings differ by context.
Costs and failure modes
Governing the model and versioning shared meanings can slow independent teams.
Case file
A worked decision
An auction house translates three partners' bid formats into one internal interchange model for lot ID, currency and bid amount. Each consumer reads the canonical message rather than every partner format.
Change the condition
When there are only two partners and their terms differ irreducibly, a narrowly scoped bilateral translation may be more accurate.
Check the decision
Encode a bid in each partner's format and verify the same financial meaning survives translation.
Store a large payload separately and send a reference in the message.
FamilyMessage contracts
ScopeMessage and payload stores
Editorial statusDraft
What it buys
Large attachments can bypass a broker's message-size limit while ordinary routing handles a compact reference.
Apply when
Documents exceed broker limits or make fan-out prohibitively expensive.
Reconsider when
Small messages benefit from carrying all data in one delivery.
Costs and failure modes
Payload lifetime, permissions and message retries must agree or references break.
Case file
A worked decision
A lab sends a blob identifier and integrity digest through its broker while storing the original microscopy image in a protected object store. Consumers retrieve the image only when needed.
Change the condition
If each result is a tiny text observation, inline data avoids an additional storage fetch and expiration policy.
Check the decision
Delay a consumer past its normal processing window and verify that the object still exists and unauthorized consumers cannot fetch it.
Direct source dependencies inward toward business policy and invert dependencies at outward interactions.
FamilyApplication boundaries
ScopeApplication policy and mechanisms
Editorial statusDraft
What it buys
A change to database or UI technology can leave business-policy code and its tests untouched.
Apply when
Business rules must survive changes in storage, delivery or application frameworks.
Reconsider when
The application has little durable policy and most layers merely copy records.
Costs and failure modes
Boundary models and mappings increase work and can drift.
Case file
A worked decision
A scholarship office changes eligibility rules each term and replaces its portal less often. Put the admission use case behind inward-facing contracts so a new portal can submit the same application.
Change the condition
A short-lived sign-up form with no decisions beyond field validation can use a direct handler.
Check the decision
Can the eligibility review run from an in-memory fixture without importing the web or persistence framework?
Processes can obtain a combined statistic without each implementing its own collection and combination protocol.
Apply when
Many partitions independently produce partial aggregates for a total or maximum.
Reconsider when
The calculation depends on an exact evaluation order unsupported by the reduction.
Costs and failure modes
Reordering floating-point sums can change numerical results.
Case file
A worked decision
A scientific simulation reduces each worker's local residual to one designated rank, which checks convergence and communicates the resulting stop decision to the other workers.
Change the condition
If each worker checks only its own independent convergence target, use a local comparison and omit the collective.
Check the decision
Does floating-point aggregation order change the convergence decision across worker counts?
Send a request naming the action an accountable recipient should perform.
FamilyMessage contracts
ScopeService boundary
Editorial statusDraft
What it buys
A caller can delegate a named operation to its responsible service without sharing that service's implementation.
Apply when
A fulfillment service is explicitly asked to reserve a shipment.
Reconsider when
A producer only needs to announce that a sale has already happened.
Costs and failure modes
The sender depends on the recipient’s command contract and eventually needs failure handling.
Case file
A worked decision
A clearance service sends ReleaseContainer to the yard system that owns a container. The recipient can accept, reject or deduplicate the requested action.
Change the condition
If customs has already released the container and several parties only need to learn that fact, publish a release event instead.
Check the decision
Reject the command and verify the sender does not report release as a completed fact.
Maintain a local copy of selected external facts to decide commands without a synchronous call.
FamilyService data boundaries
ScopeService write model
Editorial statusDraft
What it buys
A handler can make a time-sensitive decision from local reference data during an upstream outage when its freshness contract allows that.
Apply when
One service repeatedly needs another service’s slowly changing reference data to act.
Reconsider when
The decision must use an authoritative up-to-the-instant fact.
Costs and failure modes
Stale replicas can approve invalid commands. Rebuild and lag detection are required.
Case file
A worked decision
A shipping service copies product dimensions locally because parcel creation cannot wait for a catalog lookup and slightly stale dimensions are acceptable.
Change the condition
If every label must reflect the latest legally certified weight, obtain an authoritative value before issuing it.
Check the decision
What happens to a label when the product-dimension update arrives after parcel creation?
Separate operations that observe state from operations that change observable state.
FamilyProgramming model and architecture
ScopeMethod or public API
Editorial statusDraft
Also indexed as · Command Query Separation
What it buys
A caller can repeat a preview or validation query without accidentally changing the business state it is inspecting.
Apply when
Callers must be able to inspect state without triggering a mutation.
Reconsider when
An atomic operation that both changes and returns a value is clearer and preserves the invariant.
Costs and failure modes
Splitting an atomic pop or claim can introduce a race or an extra round trip.
Case file
A worked decision
A playlist's current-song display used to advance the playhead every time the UI redrew. Separate observing the current song from advancing to the next track.
Change the condition
A concurrent work queue can reasonably claim and return its next job atomically, since splitting those operations can race.
Check the decision
Redraw the screen repeatedly and verify that the playhead advances only after an explicit advance command.
Additional workers can absorb a backlog from one queue without changing the producer's routing logic.
Apply when
Items can run independently and one worker is falling behind.
Reconsider when
All subscribers need all items, or strict global execution order is required.
Costs and failure modes
Concurrency breaks completion order. A stalled worker can have its job redelivered.
Case file
A worked decision
A print farm has several compatible workers claim the next pending poster job. Each job goes to one available printer, preserving a durable job ID in case a worker disappears.
Change the condition
If accounting and archiving each require a copy of the completed print event, use a separate subscription for each.
Check the decision
Stop a worker after output generation and before acknowledgement and check the policy for preventing or detecting a second print.
Compiler with a shared intermediate representation
Front ends lower languages to a shared representation consumed by optimization passes and back ends.
FamilyCompiler architecture
ScopeLanguage toolchain
Editorial statusDraft
What it buys
A new language frontend can reuse existing optimization passes and machine-code backends.
Apply when
Several languages or targets can reuse analyses and optimizations.
Reconsider when
One small translator has no reuse pressure and direct translation is clear.
Costs and failure modes
Representation changes affect many passes and semantic details can be lost.
Case file
A worked decision
A compiler project adds a second source language and a new processor target. Both front ends emit a shared intermediate representation consumed by optimization passes and both back ends.
Change the condition
For a one-off translator from one tiny input format to one output, direct generation avoids defining a long-lived intermediate language.
Check the decision
Compile equivalent programs from both source languages and verify that the common optimizer preserves each language's overflow semantics.
The downstream context adopts the upstream model and its vocabulary.
FamilyDomain boundaries
ScopeDownstream model boundary
Editorial statusDraft
What it buys
A downstream team can consume an upstream model directly and avoid maintaining a translation whose distinctions serve no local purpose.
Apply when
An influential supplier offers a suitable model and translation has little business value.
Reconsider when
Upstream concepts would distort the downstream team's core domain.
Costs and failure modes
Supplier semantics and incompatible changes flow into the downstream model.
Case file
A worked decision
A small importer adopts an external customs authority's commodity vocabulary exactly because it cannot negotiate changes and the classification is its product's purpose.
Change the condition
If the importer starts using a richer local model for stocking decisions, continuing to conform may spread external assumptions into stock rules.
Check the decision
Change a customs classification in a fixture and locate the business decisions that must be revised.
A planner can explore alternative feasible assignments after a constraint changes without hand-coding every possible combination.
Apply when
Scheduling or allocation has interacting requirements that make greedy choices fail.
Reconsider when
A simple construction always yields a satisfactory answer within budget.
Costs and failure modes
Search time, model fidelity and diagnosis of infeasibility can dominate.
Case file
A worked decision
A clinic must allocate rooms, nurses and equipment subject to time windows, qualifications and cleaning gaps. A solver searches for a feasible assignment and can reject infeasible input.
Change the condition
If every appointment uses an identical room and slots never overlap, a direct slot lookup is simpler.
Check the decision
With the only qualified nurse removed, does the planner distinguish proved infeasibility from an unresolved search that reached its time limit?
Describe existing contexts, their dependencies and the kind of relationship on each boundary.
FamilyDomain boundaries
ScopeRelationships among models and teams
Editorial statusDraft
What it buys
A team planning a contract change can identify which neighboring contexts depend on it and where negotiation or translation is needed.
Apply when
Multiple groups must agree who controls an integration model and how changes propagate.
Reconsider when
A single small context has no external model relationships to explain.
Costs and failure modes
Maps quickly mislead if they document aspirations as current integrations.
Case file
A worked decision
A bank maps the relationships among customer identity, credit assessment and loan servicing before migrating a shared customer table. The map names each owner and each translation boundary.
Change the condition
For a single team with one model and no integration boundary, a short module diagram may answer the same question.
Check the decision
Follow an address change across the map and identify which team can change each representation independently.
Carry an identifier that associates an incoming reply with its original request.
FamilyMessage contracts
ScopeService conversation
Editorial statusDraft
What it buys
A requester can match replies that arrive out of order to the correct outstanding operations.
Apply when
Several requests can be outstanding and replies may arrive out of order.
Reconsider when
A strictly sequential exchange already has an unambiguous pairing.
Costs and failure modes
Identifier reuse or short-lived correlation state can misroute late replies.
Case file
A worked decision
A vessel planner issues many asynchronous tariff requests over one return channel. Each request includes an opaque ID and the responder copies it into its reply.
Change the condition
If a dedicated synchronous connection carries one outstanding request at a time, its call context may already match replies.
Check the decision
Return replies in reverse order and verify that every price lands on the correct sailing.
Both limit producer progress using downstream capacity, while a stream subscriber signals demand in items and a transport defines its own credit units.
Subscriber demand does not imply a limit on every intervening network buffer or on total bytes.
Catalog note · Complements: Congestion Control protects the network path.
The downstream team negotiates needs and acceptance tests with the upstream supplier.
FamilyDomain boundaries
ScopeUpstream/downstream relationship
Editorial statusDraft
What it buys
The supplier can test a contract change against the downstream team's actual needs before the change ships.
Apply when
The upstream team can plan changes around downstream requirements.
Reconsider when
The downstream team lacks bargaining power or the upstream model is externally fixed.
Costs and failure modes
Roadmap negotiation can delay both teams and tests can constrain upstream changes.
Case file
A worked decision
A fraud team needs an additional authorization attribute from payments. The teams agree on a versioned contract and a delivery date, and verify the change with a consumer contract test.
Change the condition
When the upstream supplier cannot be influenced, a conformist model or translation boundary may be more realistic.
Check the decision
Can the downstream team show where it participates in upstream contract changes and acceptance decisions?
A component can change its data representation without requiring its callers to rewrite how they perform a domain operation.
Apply when
State has clear owners whose invariants must survive changes to representation.
Reconsider when
Uniform transformations over many records dominate and object identity adds no value.
Costs and failure modes
Clients must track object collaborators and interactions can hide global control flow.
Case file
A worked decision
A library system makes a loan object responsible for its due date and renewal count. All callers request renewal through that object so a new limit applies consistently.
Change the condition
For a report that only totals immutable rows, a direct transformation avoids creating stateful collaborators.
Check the decision
Can any external caller construct a loan with more renewals than the policy permits?
A domain object's construction and relationships can evolve independently of database records when the mapping absorbs the difference.
Apply when
Business objects and a relational schema need to evolve independently.
Reconsider when
A small CRUD system has a near-perfect row-to-object match.
Costs and failure modes
Mappings can hide expensive loads or duplicate schema knowledge.
Case file
A worked decision
A legal case contains nested claims and parties, yet the inherited reporting database stores them in several normalized tables. A mapper reconstructs the case without making it issue SQL.
Change the condition
For a lookup class matching one table with almost no behavior, active record or a direct query is often easier to follow.
Check the decision
Round-trip a case containing the same party in two claims and verify that shared identity survives the mapping.
Let domain teams publish owned data products backed by lakehouse tables when independent ownership and shared storage capabilities both serve the organization.
Changing table storage does not assign owners, define data product contracts or establish federated governance.
Collect the fields needed for a remote call in a serializable transfer representation.
FamilyEnterprise integration
ScopeProcess or network boundary
Editorial statusDraft
What it buys
A remote client can obtain the necessary fields in one round trip without exposing the server's full object graph.
Apply when
A remote interaction requires a stable payload and fewer round trips.
Reconsider when
Local callers can already share a suitable value type and have no boundary to protect.
Costs and failure modes
Mapping duplication and version skew accumulate.
Case file
A worked decision
A route-planning client needs station names, platform changes and accessible transfers in one response. A DTO carries that shape without exposing the server's database or domain object graph.
Change the condition
For a purely local call within one module, an extra data transfer type can duplicate an existing value for no boundary benefit.
Check the decision
Add a server-only field and check that the serialized public response and compatibility tests remain unchanged.
Isolate databases when tenants need independent restore, residency or capacity policies, and share storage when per-tenant operations would dominate cost.
A shared database requires reliable row isolation, while separate databases add migration and fleet-management work.
A short set of recursive rules can derive indirect relationships such as all resources reachable through nested roles.
Apply when
Recursive reachability or static analysis repeatedly propagates facts across a graph.
Reconsider when
A direct lookup or ordinary nonrecursive query expresses the whole requirement.
Costs and failure modes
Intermediate relation sizes and rule evaluation cost can grow sharply.
Case file
A worked decision
An access auditor derives transitive membership from nested groups and then joins the derived memberships with resource grants. Datalog rules define the relation independently of traversal order.
Change the condition
If every user belongs to a single flat group, a simple relation join already answers the question.
Check the decision
Insert a cycle in the group graph and verify that derived access terminates with the intended set of memberships.
Divert messages that exhaust delivery policy into a separate destination.
FamilyMessage delivery
ScopeFailure handling
Editorial statusDraft
What it buys
Operators can inspect repeatedly failing messages while healthy messages continue through the main delivery path.
Apply when
A poison message keeps blocking or consuming normal worker capacity.
Reconsider when
A rejected request can be reported synchronously and safely discarded.
Costs and failure modes
Unmonitored backlogs bury failures. Replaying after repair can repeat effects.
Case file
A worked decision
An accounting importer sends a malformed batch to a dead-letter channel after bounded failures. An operator inspects the stored cause, repairs the mapping and replays the batch under its original ID.
Change the condition
If failures reflect a brief storage outage and the data is valid, bounded retry or delayed delivery may recover without manual intervention.
Check the decision
Replay a quarantined batch twice and verify recovery produces one ledger effect with an auditable result.
Align services with stable business activities such as billing or fulfillment.
FamilyService architecture
ScopeBusiness and service boundaries
Editorial statusDraft
What it buys
A change to a fulfillment rule can stay with the team responsible for fulfillment, from its API through its storage.
Apply when
Business activities have clear owners, change drivers and interfaces.
Reconsider when
A supposed capability is a temporary org chart box or a technical layer.
Costs and failure modes
Poor boundaries distribute a single business change across many services.
Case file
A worked decision
A manufacturer can identify quoting, scheduling and shipping as enduring capabilities with separate operators. Give each team ownership of one capability's interfaces and release decisions.
Change the condition
If one small team changes all three every time it adjusts order rules, begin with modules in one deployment.
Check the decision
Trace a recent change request and count the teams that must coordinate to ship it.
Use domain analysis to find cohesive business problem areas around which services can form.
FamilyService architecture
ScopeDomain and service boundaries
Editorial statusDraft
What it buys
Policy that changes for one business problem can evolve independently of similarly named concepts with different rules elsewhere.
Apply when
Terms and rules cluster around distinct problems with different models.
Reconsider when
A speculative split needs cross-service transactions for nearly every operation.
Costs and failure modes
Discovering boundaries takes expertise and later repartitioning moves data and contracts.
Case file
A worked decision
A travel platform discovers that a hotel booking and a payments settlement use different models of cancellation. Split the contexts along these domain boundaries to preserve distinct rules.
Change the condition
If both operations refer to the same policy and change as a unit, a new service boundary adds translation work.
Check the decision
Can each side explain a cancellation entirely in its own vocabulary and state its external contract?
Distinct business problems such as booking and settlement are evidence for bounded contexts. The model boundaries still need to be agreed with domain experts.
Optional behaviors can be combined around one object without a subclass for every combination.
Apply when
Logging, validation or buffering must be independently combined for individual instances.
Reconsider when
A single permanent behavior change belongs directly in the implementation.
Costs and failure modes
Wrapper order changes behavior and can make identity and debugging surprising.
Case file
A worked decision
A telemetry exporter wraps the same byte-writer interface with compression and byte counting. Counting inside or outside the compressor measures different quantities.
Change the condition
If one fixed pipeline has an unchanging order, use explicit sequential calls.
Check the decision
With a compressible payload, does the chosen wrapper order report raw input size or actual transmitted bytes as intended?
Later reactions can refer to the business occurrence that triggered them even after the affected entity's current state changes.
Apply when
Other domain behavior needs to distinguish what happened and when.
Reconsider when
A local helper call carries no business meaning or an invariant must be enforced before commit.
Costs and failure modes
Treating every mutation as an event produces noise and brittle consumers.
Case file
A worked decision
A loan emits LoanApproved when its rules approve an application. A notification handler prepares email independently, so a delivery failure leaves the approval intact.
Change the condition
If the UI only needs an immediate success indication and no other behavior observes approval, a direct return value may suffice.
Check the decision
Reject an application and check that neither a durable approval fact nor a notification is produced.
Express a domain operation without forcing it onto a single entity or value object.
FamilyDomain modeling
ScopeDomain operation
Editorial statusDraft
What it buys
A rule involving several domain concepts gains a single named home that callers can exercise without choosing an arbitrary owning entity.
Apply when
A rule spans concepts and no one object naturally owns the operation.
Reconsider when
An entity already owns the invariant and can implement the behavior directly.
Costs and failure modes
Overuse drains behavior from entities and concentrates unrelated logic.
Case file
A worked decision
A shipping service calculates a transfer price using rules applying to both the sending depot and the receiving depot. The rule lives in a named domain service because neither depot owns the whole decision.
Change the condition
If the price depends entirely on one tariff object's internal data, a method on that object keeps the rule closer to its invariant.
Check the decision
Can the price decision be tested using depots and tariffs without web handlers, a database or a clock?
A reader can see a complete frame while the writer assembles the next one, avoiding a mixture of generations.
Apply when
Rendering or simulation updates must appear as a complete frame.
Reconsider when
The consumer can safely process incremental updates or memory is scarce.
Costs and failure modes
Requires extra storage and correct handoff before reusing the old buffer.
Case file
A worked decision
A scoreboard renderer writes the next frame into a private buffer while the display reads the last complete frame. It publishes the new buffer at a synchronization point.
Change the condition
For a single-threaded text render that completes before any reader runs, one buffer is simpler.
Check the decision
Pause the writer halfway through a frame and verify the reader still sees a whole old or new frame.
After safe publication succeeds, the common initialized path can avoid taking the initialization lock.
Apply when
A measured initialization bottleneck justifies a safe memory-model-specific implementation.
Reconsider when
A language-provided once primitive handles initialization.
Costs and failure modes
Unsafe publication may expose partially initialized state despite the second check.
Case file
A worked decision
A serializer lazily builds a costly lookup table, checks an acquire-loaded reference, and checks again under the initialization lock before safe publication.
Change the condition
If the runtime provides a once-initializer, prefer it to hand-written publication logic.
Check the decision
Can a reader observe the table reference before every entry is visible under the memory model?
Keep a subscriber’s position or outstanding messages while it disconnects.
FamilyMessage delivery
ScopeBroker subscription
Editorial statusDraft
What it buys
A subscriber can resume after a deployment and retrieve publications retained during its absence.
Apply when
A billing service must catch up after maintenance.
Reconsider when
Live presence indicators can simply refresh current state.
Costs and failure modes
Inactive subscriptions consume retention capacity and may replay obsolete work.
Case file
A worked decision
A district school's reporting feed must catch up on attendance changes after nightly downtime. The broker retains outstanding messages for its named durable subscription.
Change the condition
A dashboard that only needs a current headcount can discard missed events and fetch a snapshot on restart.
Check the decision
Stop the reporting subscriber, submit an attendance change, restart it and verify receipt within the configured retention window.
A recorded message and its prior model can reproduce a UI transition in a test without driving a browser.
Apply when
State transitions need to be explicit, reproducible and testable.
Reconsider when
A small widget has little meaningful state or expensive redraws dominate without mitigation.
Costs and failure modes
Large message sets, nested state and effect coordination can complicate composition.
Case file
A worked decision
A timetable editor encodes loading, draft changes and save results as messages and derives its screen from the updated model. A late save reply is associated with its revision.
Change the condition
For one read-only arrival display that never accepts edits, rendering fetched data directly may be enough.
Check the decision
Feed an older save reply after a newer edit and check that the displayed model preserves the unsaved revision.
Use shared integration infrastructure to route, translate and mediate calls or messages.
FamilyEnterprise integration
ScopeEnterprise systems
Editorial statusDraft
Also indexed as · ESB
What it buys
Several integrations can reuse the same routing and protocol conversion infrastructure across otherwise incompatible endpoints.
Apply when
Many legacy systems require protocol and format mediation with centralized operating expertise.
Reconsider when
A few peers share clear contracts and can integrate directly.
Costs and failure modes
Shared delivery gates and business logic in the bus can couple unrelated teams.
Case file
A worked decision
A wholesaler connects a mainframe sending fixed-width messages with an ERP using XML and a warehouse accepting broker messages. A bus translates and routes common exchanges with monitored failure queues.
Change the condition
If only two modern applications share a stable contract, use a direct interface and avoid a central integration release dependency.
Check the decision
Change one partner's format and verify whether the bus mapping alone can absorb it without altering unrelated routes.
Bookings, invoices, or audit records can continue to refer to the same customer after the customer's name or address changes.
Apply when
An account or order remains the same business thing as its state changes.
Reconsider when
Two instances are interchangeable whenever their values match.
Costs and failure modes
Identity allocation, lifecycle and reconciliation require explicit rules.
Case file
A worked decision
A rental company tracks a particular van through repairs, plate changes and repainting. A stable vehicle identifier connects the history even when all visible details change.
Change the condition
If the program only compares dimensions of proposed crates, values can be compared by their contents without persistent identity.
Check the decision
Change the van's registration number and verify that the repair history remains attached to the same vehicle.
A system can update only entities with the components it needs and process those components in a cache-friendly order.
Apply when
Many game or simulation entities share component sets and bulk updates dominate.
Reconsider when
A handful of heterogeneous objects have behavior best expressed independently.
Costs and failure modes
Structural changes and system ordering complicate reasoning and may cost more than dispatch saved.
Case file
A worked decision
A particle engine stores positions and velocities as components and updates every moving particle in a focused system. Entities lacking velocity do not join that update.
Change the condition
If a small narrative game has a few actors with highly individual scripts, a compact object per actor may be easier to maintain.
Check the decision
Profile the movement system and confirm that its writes are disjoint before running chunks in parallel.
A new independent reaction can be attached to an existing event channel without revising a central process definition.
Apply when
Subscribers need autonomy and no component owns an end-to-end workflow.
Reconsider when
A regulated sequence needs explicit progress tracking and timed recovery.
Costs and failure modes
Long causal chains hide completion, ownership and failure paths.
Case file
A worked decision
A publisher emits ArticleReleased and leaves search, email and syndication free to add their own reactions. The producer has no definition of a shared completion step.
Change the condition
If publication is complete only after named systems finish in a specified order, introduce an owner for the process.
Check the decision
Disable syndication and verify that search still updates while the failed subscriber's backlog remains visible.
The owner of a multi-step reaction can inspect one coordination policy to determine which step should follow a result.
Apply when
A multistep event flow requires an explicit sequence and recovery owner.
Reconsider when
Independent subscribers need only a notification and no shared completion condition.
Costs and failure modes
The coordinator couples to the process definition and needs durable recovery.
Case file
A worked decision
A grant disbursement coordinator requests eligibility, signed consent and bank approval in order, resuming when each result arrives. The coordinator records the current stage and missed deadlines.
Change the condition
If unrelated consumers only need to know a grant was awarded, directly publishing the event avoids a needless workflow controller.
Check the decision
Interrupt the coordinator after bank approval and verify it resumes without submitting the payment instruction twice.
Publish a fact about something that has already occurred.
FamilyMessage contracts
ScopeService boundary
Editorial statusDraft
What it buys
Several consumers can interpret a completed occurrence according to their own needs without obligating the publisher to direct their work.
Apply when
Independent consumers should decide how to respond to a completed change.
Reconsider when
A sender requires one specific recipient to perform an action and report success.
Costs and failure modes
Implicit workflows become difficult to follow. Schemas must evolve compatibly.
Case file
A worked decision
A theatre emits PerformanceCancelled only after the cancellation commits. Ticketing, signage and marketing receive the fact and make independent decisions about their own work.
Change the condition
If the theatre manager is asking an authority to approve a cancellation, send a command or request rather than declaring a cancellation.
Check the decision
Simulate a rolled-back cancellation and verify that no subscriber receives a committed cancellation fact.
A subscriber can serve local reads from received state even while the publishing service is unavailable.
Apply when
Consumers must keep functioning without synchronous calls back to the source.
Reconsider when
Consumers rarely need the data, must see the latest value immediately, or should not retain copies.
Costs and failure modes
Replication creates lag, privacy obligations, schema evolution and repair work.
Case file
A worked decision
A store receives catalog events carrying the current label and permitted shipping classes. Its checkout service projects this data locally and quotes shipping during a catalog outage.
Change the condition
If checkout requires an immediately revoked safety restriction to take effect everywhere, a possibly stale replica cannot authorize the decision.
Check the decision
Delay a restriction change and measure whether checkout enforces its documented staleness limit.
A producer can record that something happened while several consumers evolve their independent reactions.
Apply when
Independent consumers join over time or work must continue across a time boundary.
Reconsider when
Immediate coordination and a single transaction are the dominant requirements.
Costs and failure modes
Ordering, replay semantics and end-to-end diagnosis need explicit design.
Case file
A worked decision
A rail timetable publisher emits revisions so platform displays and passenger apps can update independently. Consumers tolerate brief lag and reconcile against a current timetable after interruptions.
Change the condition
If a signal interlock needs a synchronous authoritative decision before enabling a route, asynchronous announcements alone cannot grant it.
Check the decision
Deliver timetable revisions out of order and check which version each display finally presents.
Introduce a compatible shape, migrate consumers, then retire the old shape.
FamilyRelease architecture
ScopeSchema, API or protocol
Editorial statusDraft
What it buys
Producers and consumers can migrate at different times while both representations remain supported.
Apply when
A rolling release spans independent clients or a shared database.
Reconsider when
All parties can change atomically and there is no compatibility window.
Costs and failure modes
Dual formats or writes can drift and the old form can linger.
Case file
A worked decision
A shipment service adds a new carrier field, deploys compatible writers and backfills old records. It switches readers after checking parity, then retires legacy writers and removes the old field once rollback no longer needs it.
Change the condition
If all consumers can stop together for a short migration, a coordinated replacement may be simpler.
Check the decision
Which running consumer or rollback version still references the old column?
Rely on an external identity provider and validate its assertions locally.
FamilySecurity architecture
ScopeTrust boundary
Editorial statusDraft
What it buys
Users and relying applications can reuse an established authentication authority across organizational boundaries.
Apply when
Several applications or organizations need shared sign-in across trust boundaries.
Reconsider when
An offline local tool needs no external identity trust.
Costs and failure modes
Provider availability, claim mapping and trust configuration affect every relying service.
Case file
A worked decision
A university accepts signed assertions from configured partner institutions after checking issuer, signature, audience and validity period. It maps the issuer and subject together to the local enrollment.
Change the condition
For an offline tool on one workstation, local authentication avoids an external identity dependency.
Check the decision
Can two institutions issue the same subject value without colliding in the local account map?
Distribute compute, storage and networking to intermediate nodes near data sources.
FamilyClient and edge architecture
ScopeDevice, edge and cloud
Editorial statusDraft
What it buys
A site can react to local measurements without paying the round-trip time or bandwidth cost of sending every sample to the cloud.
Apply when
Bandwidth, locality or latency prevents sending all work to a central platform.
Reconsider when
A reliable low-latency link and cheap centralized processing already meet requirements.
Costs and failure modes
Fleet security, upgrades, physical exposure and intermittent links add cost.
Case file
A worked decision
An offshore turbine gateway aggregates vibration readings and raises local alerts during a satellite outage. It forwards summaries and selected traces to a regional service after reconnection.
Change the condition
A test bench on a stable factory network can send its few readings straight to the central service.
Check the decision
Disconnect the gateway and measure whether the alert still reaches the operator before the defined response deadline.
Route requests through one logical entry for shared handling and dispatch.
FamilyWeb presentation
ScopeWeb application entry point
Editorial statusDraft
What it buys
A new endpoint can inherit the same dispatch and request handling policy as existing endpoints.
Apply when
Authentication, routing and common error behavior need consistent handling.
Reconsider when
Unrelated clients or protocols require fundamentally different entry policies.
Costs and failure modes
Excessive branching turns a dispatcher into a bottleneck for changes.
Case file
A worked decision
A university has dozens of administrative web routes requiring the same authentication, locale selection and error mapping. One front controller applies them before dispatch.
Change the condition
A tiny personal site with two unrelated pages and no common request policy can use page-specific handlers.
Check the decision
Add a new protected route and verify that authentication applies before its handler executes.
A policy change can be tested against plain input values without starting a database, reading a clock, or contacting a remote service.
Apply when
Business rules need deterministic tests independently of clocks, storage or network.
Reconsider when
Most work is simple I/O forwarding and the boundary would add translation without meaningful logic.
Costs and failure modes
Maintaining a pure boundary requires explicit data transfer and effect handling.
Case file
A worked decision
An energy retailer's shell reads meter data and today's published tariff, then calls a pure bill calculator and persists the result. The calculator accepts snapshots of all inputs it uses.
Change the condition
If an endpoint simply forwards an uploaded meter image to storage, creating a pure core may produce an empty layer.
Check the decision
Run a saved tariff and consumption snapshot through the calculator and reproduce the billed amount without infrastructure.
Repeatedly take input, advance simulation and render without waiting for the next input event.
FamilyGame and simulation architecture
ScopeInteractive runtime
Editorial statusDraft
What it buys
Animation and simulation can progress during periods with no user input.
Apply when
The world continues evolving even while players supply no input.
Reconsider when
A turn-based UI can sleep until an event arrives.
Costs and failure modes
Time management and scheduling determine responsiveness and CPU use.
Case file
A worked decision
An arcade cabinet polls input, advances entities and renders the scene repeatedly even if the player presses nothing. Its loop allocates each cycle's time among those tasks.
Change the condition
For an interactive settings form that changes only after a click, a continuously running game loop wastes work.
Check the decision
Leave the controls untouched and verify that autonomous enemies advance and input responsiveness remains within budget.
Represent an external system or resource behind a local access object.
FamilyEnterprise integration
ScopeExternal resource boundary
Editorial statusDraft
What it buys
A change to an external provider's API can often be handled in one place behind a locally meaningful operation.
Apply when
Vendor APIs expose unstable conventions or behavior that recurs across callers.
Reconsider when
One short-lived caller already consumes a stable suitable interface.
Costs and failure modes
A gateway can conceal latency or grow into a vendor-shaped dependency for every consumer.
Case file
A worked decision
A mapping tool wraps a geocoding vendor behind a local operation that returns its own coordinates and ambiguity status. Vendor-specific error codes are translated at that boundary.
Change the condition
If an experimental script uses one vendor call once, a dedicated gateway may add little over a direct call.
Check the decision
Swap in a recorded vendor response with an ambiguous address and verify the caller sees only local types.
One tested search or ordering algorithm can work across unrelated data types that meet the stated behavioral requirements.
Apply when
Different representations can share an algorithm while preserving their own types.
Reconsider when
There is one concrete operation and the type parameters obscure its intent.
Costs and failure modes
Undocumented semantic requirements can defeat type checking and produce incorrect results.
Case file
A worked decision
A merge algorithm handles appointments, ledger entries and log records using their common ordering contract. The caller supplies comparison semantics while retaining its concrete item type.
Change the condition
If a sorting rule is only meaningful for appointment conflicts, a named appointment operation makes that domain constraint clearer.
Check the decision
Give the algorithm a comparator that violates transitivity and check where its precondition is documented or validated.
A generic algorithm can accept any type satisfying its required operations, while an object strategy is useful when the policy must be replaceable at runtime.
The need for generic input types establishes no need for an inheritance hierarchy, and some languages can express runtime choice with a function.
Persist accepted messages across broker or endpoint restarts and redeliver under the channel contract.
FamilyMessage delivery
ScopeMessaging infrastructure
Editorial statusDraft
What it buys
An acknowledged message can survive a supported restart and remain available for the next delivery attempt.
Apply when
Losing an accepted shipment request is unacceptable.
Reconsider when
Transient telemetry expires before a failed service recovers.
Costs and failure modes
Durability adds I/O and storage. A crash around acknowledgement can still duplicate effects.
Case file
A worked decision
A lab instrument keeps each test-completion message until the broker confirms durable acceptance. The broker retains it until the receiver durably accepts it and acknowledges delivery.
Change the condition
Live cursor-position updates have value only while current, so best-effort delivery avoids accumulating stale traffic.
Check the decision
Crash the broker or receiver at each handoff in a test deployment and record where redelivery is possible.
If an acknowledgment is lost, durable handoff can redeliver a message. The receiver must tolerate duplicates wherever repeated processing would change the outcome.
Drive and serve the application through ports implemented by adapters for external technologies.
FamilyApplication boundaries
ScopeApplication core and integrations
Editorial statusDraft
Also indexed as · Hexagonal architecture, ports and adapters
What it buys
The same use case can run behind a web endpoint, a batch import, and a test harness through a common application contract.
Apply when
The same use cases need multiple drivers or fast tests without real external systems.
Reconsider when
An adapter only forwards a stable local call and provides no substitution or isolation.
Costs and failure modes
Poorly chosen ports expose infrastructure details and multiply translation code.
Case file
A worked decision
A baggage-routing engine receives the same routing request from a terminal kiosk and a disruption simulator. Both call a routing port, and separate adapters supply live or simulated flight information.
Change the condition
If the program translates one file format once and directly exits, an adapter per dependency obscures its control flow.
Check the decision
Can a scripted adapter reproduce a cancelled-flight scenario using the exact production routing rules?
Make repeated processing produce the same business effect, by design or durable deduplication.
FamilyMessage delivery
ScopeConsumer boundary
Editorial statusDraft
What it buys
A timeout can be retried without issuing a second refund or otherwise duplicating the business effect.
Apply when
An acknowledgement or response can be lost after the effect commits.
Reconsider when
An operation already has naturally idempotent semantics and no extra side effects, so skip a deduplication store.
Costs and failure modes
Deduplication records need a retention rule and an atomic link to the effect.
Case file
A worked decision
A benefits processor receives the same payment instruction again after its acknowledgement is lost. It records the instruction ID and the local ledger effect atomically and returns the original outcome on redelivery.
Change the condition
If each message simply sets an idempotent local flag, a dedicated duplicate-ID table may be unnecessary.
Check the decision
Race two deliveries of one instruction and verify that one ledger entry commits and both responses refer to the same outcome.
Keep one loaded object per persistent identity within a defined scope.
FamilyEnterprise persistence
ScopeTransaction or session
Editorial statusDraft
What it buys
Two associations resolved in one unit of work can observe changes to the same instance instead of diverging in separate copies.
Apply when
Different paths load and modify the same entity in one operation.
Reconsider when
Reads are stateless projections or the proposed cache outlives the consistency boundary.
Costs and failure modes
Unbounded maps retain memory and stale objects.
Case file
A worked decision
A procurement edit screen loads a supplier via both the order and its contract. One unit-of-work identity map keeps both references pointed at the same supplier instance.
Change the condition
For immutable projections used only to render one report, separate value copies have no conflicting updates to reconcile.
Check the decision
Change the supplier's reference in the order editor and inspect the same supplier through the contract before saving.
A new reaction can be attached to an existing occurrence without editing each place that publishes it.
Apply when
Independent extensions should react to changes without modifying the producer.
Reconsider when
A caller must control execution order, atomic results or a mandatory response.
Costs and failure modes
Hidden execution paths complicate debugging and reentrant updates.
Case file
A worked decision
A CAD editor raises a model-changed signal after a successful edit. The inspector and autosave indicator register separate reactions without putting UI references into editing code.
Change the condition
If exactly one validation must finish before the edit can succeed, call it explicitly.
Check the decision
Can a new panel observe changes without editing the command that changes the model?
An abstract machine evaluates an explicit program representation against its execution state.
FamilyStructural architecture
ScopeExecution engine
Editorial statusDraft
What it buys
Users can run new programs expressed in the supported instruction set without rebuilding the execution engine for each program.
Apply when
Users need a portable evolving rules language or scripted behavior.
Reconsider when
A handful of fixed branches suffices or evaluation overhead violates deadlines.
Costs and failure modes
Language semantics, diagnostics and sandboxing become maintenance obligations.
Case file
A worked decision
A tax tool represents allowance rules as expressions in a small language and evaluates those expressions against a return. The same rules can be traced and changed without rebuilding the tool.
Change the condition
If the only variation is three fixed tax rates, a versioned lookup table is easier to audit.
Check the decision
For an unexpected allowance, can the evaluator identify the exact expression that produced it?
Under its deterministic process and channel assumptions, alternative execution schedules produce the same streams, simplifying reasoning about concurrent transformations.
Apply when
Streaming stages consume ordered inputs and schedule-independent sequences are important.
Reconsider when
The required behavior depends on nondeterministic readiness or wall-clock races.
Costs and failure modes
A finite-buffer implementation needs analysis to avoid artificial deadlock.
Case file
A worked decision
A deterministic decoding pipeline uses blocking reads over FIFO channels to connect independently scheduled transformations.
Change the condition
If every stage consumes the same fixed block sizes, use a statically scheduled pipeline.
Check the decision
Do different legal schedules yield identical decoded output for identical input streams?
Keep separate batch and speed paths when each has a necessary processing model, or replay one retained stream when one pipeline can compute both results.
Two paths can diverge semantically, while a single replay path depends on retained input and tolerable rebuild time.
Group responsibilities into levels with explicit permitted dependencies between levels.
FamilyStructural architecture
ScopeModules and subsystems
Editorial statusDraft
What it buys
A team can replace a layer's implementation and focus compatibility testing on the neighboring contracts it exposes.
Apply when
A protocol stack or application has stable abstraction boundaries with independently changing implementations.
Reconsider when
Most feature edits cross every layer and add forwarding methods without isolating change.
Costs and failure modes
Layer bypasses erode boundaries and strict layering adds hops.
Case file
A worked decision
An imaging tool separates acquisition, reconstruction and presentation so that alternate scanners only alter acquisition. Higher layers depend on declared lower-layer interfaces.
Change the condition
When a small change always touches every layer and the layers only forward calls, a feature module reduces indirection.
Check the decision
Swap the scanner adapter and run reconstruction fixtures without changing the renderer.
Treat a local copy as primary for user interaction and sync changes between replicas.
FamilyClient and edge architecture
ScopeUser devices and collaboration
Editorial statusDraft
What it buys
A user can keep editing during a network outage and synchronize those local edits after connectivity returns.
Apply when
Users need ownership, offline editing or collaboration independent of a reachable central service.
Reconsider when
The product requires centralized, immediate revocation or global serialization of every write.
Costs and failure modes
Identity, conflict policy, synchronization and durable local storage require work.
Case file
A worked decision
A research group edits shared field notes on laptops that may never contact the original hosting provider again. Each user retains a working local copy and syncs changes when peers reconnect.
Change the condition
If the application only displays authoritative train availability and users cannot contribute edits, a read cache may suffice.
Check the decision
Have two researchers edit separate paragraphs offline, then reconnect and check preservation and convergence.
The main routine gives a reader one place to inspect the order of work and the points where errors can interrupt it.
Apply when
A known sequence dominates and readers benefit from seeing the control flow in one place.
Reconsider when
Independent event sources or run-time extensions would force increasingly tangled dispatch.
Costs and failure modes
Central orchestration can accumulate unrelated policies.
Case file
A worked decision
A command-line importer reads a manifest, validates records, applies replacements and writes a report. A main routine owns that fixed order and delegates each step to a procedure.
Change the condition
If third-party extensions must react independently to imported records, a rigid sequence may turn into a growing dispatcher.
Check the decision
Can a maintainer determine the execution order and exit conditions by reading the main routine?
Require an intersecting majority for protocol decisions within a membership configuration.
FamilyCluster coordination
ScopeReplica group
Editorial statusDraft
What it buys
In a fixed voting configuration, any two majorities intersect, giving a correctly designed agreement protocol a place to carry earlier decisions forward.
Apply when
A consensus group must avoid independently confirming conflicting decisions across partitions.
Reconsider when
A disconnected minority must keep accepting independently valid updates.
Costs and failure modes
Progress stops without a majority. Membership changes require a safe protocol.
Case file
A worked decision
Five voters in a fixed consensus configuration require three votes to choose an owner for the next shard epoch.
Change the condition
If losing the only configuration process may halt edits, use a single durable writer.
Check the decision
During a two-versus-three partition, can the two-voter side choose a conflicting owner for the same epoch?
Compose one user experience from independently delivered feature slices.
FamilyPresentation architecture
ScopeBrowser application and team boundaries
Editorial statusDraft
What it buys
A feature team can release its slice of an interface without synchronizing every frontend team's release.
Apply when
Autonomous teams own distinct vertical experiences with independent release needs.
Reconsider when
A single team maintains a cohesive interface with frequent cross-feature edits.
Costs and failure modes
Bundle duplication, accessibility inconsistencies and integration testing grow.
Case file
A worked decision
A rail operator's booking, loyalty and disruption teams release independently into one passenger portal. Each owns its feature UI and agrees on navigation, accessibility and authentication contracts.
Change the condition
If all features are maintained by one small team and deploy together, ordinary front-end modules avoid runtime integration overhead.
Check the decision
Run a loyalty release against the current booking and shell versions and check navigation and keyboard behavior.
A customer-specific extension can ship separately while other installations continue to use the same core.
Apply when
A product supports independently supplied or selectively installed behavior.
Reconsider when
There is one implementation and no credible independent extension schedule.
Costs and failure modes
Compatibility commitments, extension conflicts and trust boundaries constrain the core.
Case file
A worked decision
A music workstation hosts third-party effects behind a versioned processing interface. The core controls routing and timing while installed plug-ins add new transformations.
Change the condition
If all effects ship together and change with the core, ordinary modules avoid plug-in discovery and compatibility work.
Check the decision
Can a plug-in built for the previous supported contract load and process a test buffer safely?
A plug-in core defines extension contracts inside an application, while an OS microkernel moves selected privileged services across isolation boundaries.
Package capabilities in loosely coupled services that can deploy independently.
FamilyService architecture
ScopeDistributed application
Editorial statusDraft
What it buys
A team can ship a compatible change to its service without coordinating a simultaneous release of every other service.
Apply when
Different teams or capabilities need independent release, scaling or isolation.
Reconsider when
Changes repeatedly require coordinated releases or operations cannot support distributed failures.
Costs and failure modes
Network dependencies, tracing and cross-service consistency replace local mechanisms.
Case file
A worked decision
A retailer's catalog search and payment authorization need different release windows, capacity and on-call owners. Separate the two behind versioned interfaces and give each team operational responsibility.
Change the condition
If one small team deploys them together and needs a local transaction across both, keep a modular monolith.
Check the decision
Disable catalog search and verify that already-created orders can still authorize payment.
A different view can present the same domain state without embedding presentation decisions in the model.
Apply when
A model supports multiple views or independent interaction and presentation logic.
Reconsider when
A static or trivial screen gains no independent variation from splitting its responsibilities.
Costs and failure modes
Frameworks assign different meanings to controller and model, obscuring responsibilities.
Case file
A worked decision
A map editor keeps its road model independent of the route-list and canvas views. A controller converts drag gestures into edits and both views render the updated model.
Change the condition
A static information page with no mutable model or user actions can render directly.
Check the decision
Apply an edit through an alternate input controller and verify that both views display the same geometry.
A presenter coordinates interaction between a view and model, with variants differing in view autonomy.
FamilyPresentation architecture
ScopeInteractive user interface
Editorial statusDraft
What it buys
Interaction behavior can be exercised through a presenter and a view contract without repeatedly constructing a full UI.
Apply when
Complex interaction logic must be tested independently of a toolkit.
Reconsider when
The UI has minimal interaction or straightforward bindings already express its behavior.
Costs and failure modes
Presenter and view interfaces can accumulate forwarding methods.
Case file
A worked decision
A handheld inspection app uses a presenter to turn scanned codes and button events into view updates. The display adapter can then be replaced for use on a different scanner.
Change the condition
If all screen behavior is trivial binding to one data object, a dedicated presenter may only repeat field names.
Check the decision
Can a fake view reproduce the sequence of prompts after an unreadable barcode without opening the device UI?
A view binds to presentation state and commands exposed by a view model.
FamilyPresentation architecture
ScopeDesktop, mobile or browser view
Editorial statusDraft
Also indexed as · Presentation Model, MVVM (related terminology)
What it buys
Several controls can reflect the same presentation state through bindings, reducing hand-written synchronization between widgets.
Apply when
Screens have reusable presentation logic and the toolkit supports reliable binding.
Reconsider when
A small screen has no meaningful presentation logic or binding infrastructure is costly.
Costs and failure modes
Binding errors, feedback loops and oversized view models can hide dependencies.
Case file
A worked decision
A reservation form binds date, occupancy and validation messages to a view model. Changing the date recomputes availability status and the enabled state of the submit command.
Change the condition
A static confirmation screen with no derived or editable state needs little beyond a view-data record.
Check the decision
Change occupancy from two to three people and verify the binding refreshes capacity warnings and submit eligibility.
MVVM works well with command and property binding. Supervising Controller leaves uncomplicated synchronization to the view and handles exceptional behavior explicitly.
Partition a single deployment into modules with explicit APIs and controlled dependencies.
FamilyStructural architecture
ScopeSingle deployable application
Editorial statusDraft
What it buys
A team can enforce ownership of internal APIs and still use in-process calls and one deployment when that fits the workload.
Apply when
A team needs enforceable business boundaries while retaining local calls and simple operations.
Reconsider when
Separate release cadence, isolation or elasticity is a proven requirement for one capability.
Costs and failure modes
One deployment remains a shared release and failure boundary, and shortcuts erode modularity.
Case file
A worked decision
A training provider keeps enrollment, billing and scheduling as modules in one deployable product. Module APIs reject direct access to another module's tables.
Change the condition
If billing must deploy during a prolonged outage of the enrollment release pipeline, one deployment boundary can become a liability.
Check the decision
Can one module's persistence schema change without callers importing its tables or internal models?
Package and release application functionality as one deployment unit.
FamilyStructural architecture
ScopeApplication delivery
Editorial statusDraft
What it buys
A cross-feature change can be tested and released as one version without managing mixed-version service interactions.
Apply when
A small team benefits from local calls, one transaction boundary and a single release pipeline.
Reconsider when
Substantial parts need independent failure isolation, scaling or release cadences.
Costs and failure modes
A change to one part can require releasing or scaling the whole application.
Case file
A worked decision
A two-person museum team ships collections, exhibitions and the staff interface together as one application. A release installs one artifact and migrations run in one maintenance window.
Change the condition
If the public search needs an independent release and failure budget, isolate that boundary before splitting unrelated features.
Check the decision
Rehearse a rollback and record which unrelated capabilities must roll back with the changed one.
Place application responsibilities in separately deployed tiers connected over a network.
FamilyStructural architecture
ScopeNetworked application
Editorial statusDraft
What it buys
A team can scale application capacity or restrict database network access independently of the presentation tier.
Apply when
Separate trust zones or independent resource requirements justify process boundaries.
Reconsider when
Logical layers fit one deployment and network round trips dominate useful work.
Costs and failure modes
Each tier adds latency, failure modes and coordinated rollout concerns.
Case file
A worked decision
A bank places the public web tier outside its restricted application tier and permits database access only from the latter. Network policy enforces a trust boundary between the deployments.
Change the condition
If all responsibilities share a host and trust level, logical layers can preserve organization without network hops.
Check the decision
From a compromised web-tier test identity, attempt a direct database connection.
Serve reads from local storage and coordinate synchronization with remote state.
FamilyClient and edge architecture
ScopeDevice and data service
Editorial statusDraft
What it buys
Users can open already-synchronized data promptly on a slow or disconnected network.
Apply when
An application must remain usable across slow, costly or unreliable connectivity.
Reconsider when
Authoritative online verification is mandatory before every action.
Costs and failure modes
Conflicts, stale data, queued writes and credential expiry need explicit policies.
Case file
A worked decision
A meter reader enters readings where cellular coverage is unreliable. The app commits locally, marks each reading pending and retries upload when connectivity returns.
Change the condition
If a technician must receive server authorization before energizing equipment, the authorization action still requires an online decision.
Check the decision
Submit a reading offline, terminate the app, restart it and verify that the pending value and upload status survive.
Put the domain model at the center and let outer infrastructure implement interfaces owned closer to the core.
FamilyApplication boundaries
ScopeDomain-centered application
Editorial statusDraft
What it buys
A domain rule can keep its own vocabulary even when a storage provider requires a different representation of the same data.
Apply when
The domain has a long lifetime and storage or UI adapters need to change independently.
Reconsider when
Simple database maintenance screens have little policy worth isolating.
Costs and failure modes
Mapping and indirection can obscure straightforward workflows.
Case file
A worked decision
A licensing service keeps license terms and renewal decisions in its core. Persistence and vendor adapters depend inward on those contracts, so a move to a new store leaves renewal rules intact.
Change the condition
An internal license spreadsheet with one import and no domain behavior can use simple data access.
Check the decision
Identify every dependency imported by renewal policy and verify that none belongs to persistence.
Both constrain dependencies inward, while Onion emphasizes concentric domain-centered layers and Clean Architecture highlights use cases and boundary crossings.
Both preserve a small core, but an OS microkernel places selected services outside the privileged kernel while a product core defines extension contracts.
Moving a feature into an application plug-in provides no automatic process, privilege or fault isolation.
Catalog note · Alternative: Monolithic Kernel. Distinct from a plug-in application microkernel.
A page-specific validation or redirect can change without expanding a shared dispatcher full of unrelated branches.
Apply when
A small page-oriented application has distinct easy-to-follow actions.
Reconsider when
Controllers repeatedly duplicate dispatch, security or error-handling code.
Costs and failure modes
Inconsistent policies accumulate across pages.
Case file
A worked decision
A historical archive exposes a small set of distinct pages for a person, a place and a document. A separate page handler gathers each page's data and chooses its template.
Change the condition
If shared access and routing rules become duplicated across dozens of handlers, central dispatch can eliminate drift.
Check the decision
Add a new archive page and locate the code responsible for that page's input, model and response.
The presenter reads and updates a deliberately passive view through an interface.
FamilyPresentation architecture
ScopeUI boundary
Editorial statusDraft
What it buys
Tests can observe exactly which values a presenter sends to controls using a simple substitute view.
Apply when
Critical interaction behavior needs automated tests without loading a GUI toolkit.
Reconsider when
Form behavior is simple and supported declaratively by existing bindings.
Costs and failure modes
Writing and maintaining view accessors creates repetitive code.
Case file
A worked decision
A point-of-sale presenter decides which buttons are enabled after a refund scan. The view exposes display operations and reports gestures without deciding refund eligibility.
Change the condition
If every displayed value can be directly and safely bound, manually assigning each field in the presenter adds noise.
Check the decision
Can an automated test assert every displayed button state from a sequence of presenter inputs alone?
A transformation can be tested on recorded input and reused in a second pipeline without reproducing upstream acquisition logic.
Apply when
Stages can be reused or reordered and intermediate representations have stable contracts.
Reconsider when
Multiple stages must coordinate mutable state or provide immediate interactive feedback.
Costs and failure modes
Format conversions, buffering and backpressure can dominate execution.
Case file
A worked decision
A telescope pipeline decodes, calibrates and classifies observation batches. Separate filters consume and emit documented record formats so calibration can be replaced independently.
Change the condition
If stages share a complex mutable object and repeatedly need each other's decisions, one explicit processing module may be clearer.
Check the decision
Reprocess a recorded batch through the replacement calibration filter and compare the downstream classifications.
Direct each delivery to one consumer of a shared channel.
FamilyMessage delivery
ScopeBroker channel
Editorial statusDraft
Also indexed as · Work queue
What it buys
A producer can direct a work item to one processing role while the channel selects an available instance.
Apply when
A job should be claimed by one of several interchangeable workers.
Reconsider when
Independent applications each need their own copy of the event.
Costs and failure modes
A consumer crash can cause redelivery after an acknowledgement timeout.
Case file
A worked decision
A transcription company puts each recording on a work queue for one available transcriber. After completion it emits a separate fact for any interested systems.
Change the condition
If both an auditor and an analytics service must process every recording, sharing a single work queue would drop each other's copies.
Check the decision
Connect two worker instances, enqueue two uniquely tagged jobs and verify how redelivery behaves when one worker stops.
Independent choices such as allocation and locking can be combined without defining a bespoke subclass for every pairing.
Apply when
Several compile-time behavior dimensions vary independently and their combinations are useful.
Reconsider when
Variation must be selected at runtime or one concrete policy suffices.
Costs and failure modes
Combinatorial type complexity and unclear diagnostics can outweigh reuse.
Case file
A worked decision
A firmware packet writer assembles checksum and buffer policies at build time for a fixed device profile. Unsupported combinations fail validation before deployment.
Change the condition
If operators select a checksum per connection at runtime, injected behavior is easier than multiplying prebuilt writer types.
Check the decision
Compile every supported device profile and verify its packet bytes against an independent decoder.
Organize a hierarchy of cooperating agents, each with presentation, abstraction and control components.
FamilyPresentation architecture
ScopeInteractive application
Editorial statusDraft
What it buys
A complex interface can coordinate independently interactive regions while preserving local responsibility for each region's presentation and data.
Apply when
Several interdependent views or tasks need local behavior and explicit coordination between levels.
Reconsider when
A small screen with one state owner is simpler with a single presentation model.
Costs and failure modes
Inter-agent coordination creates extra indirect paths and can distribute UI state awkwardly.
Case file
A worked decision
A control-room application has a site map, an alarm panel and drill-down equipment panels. Each PAC agent manages its own presentation and abstraction, and its control component communicates with neighboring agents.
Change the condition
If one document and one view owner can coordinate the whole screen, a hierarchy of agents adds message paths without useful autonomy.
Check the decision
Open an alarm for a newly selected site and trace which agents resolve or reject stale selections.
A new rule can be introduced alongside existing rules while the engine determines which conditions match the current facts.
Apply when
Many interacting policies change independently and need an explicit rule vocabulary.
Reconsider when
A few stable conditions are clearer in direct control flow.
Costs and failure modes
Rule order, interaction and explanations become difficult to debug.
Case file
A worked decision
A customs workflow evaluates independently maintained export restrictions against shipment facts. Each rule explains which restriction flagged a shipment for review.
Change the condition
When the policy is one threshold and a single exemption, a direct predicate is easier to review and test.
Check the decision
Enter a shipment matching two restrictions and verify the resulting actions and justification are independent of accidental rule order.
Use a documented shared language for exchanging information across contexts.
FamilyDomain boundaries
ScopeInterchange contract
Editorial statusDraft
What it buys
Consumers can implement exchange contracts independently and test examples against a shared interpretation of the fields.
Apply when
Several parties need a stable format whose business meaning is explicit.
Reconsider when
A private two-party exchange changes so frequently that standardizing has no return.
Costs and failure modes
Version drift and superficially compatible semantics can compromise interoperability.
Case file
A worked decision
Several logistics providers publish the meaning and units of package dimensions in a versioned interchange specification. Each carrier translates its own scan records to that language.
Change the condition
If two components share one release cycle and one representation, a separate published schema may add unnecessary translation.
Check the decision
Ask two partners to encode the same irregular parcel and compare interpretations of its units and orientation.
A new subscriber can receive its own copy of future publications without disrupting existing subscribers.
Apply when
Billing and inventory independently react to the same sale.
Reconsider when
There is one job and five workers available to do it.
Costs and failure modes
Slow subscribers accumulate separate backlogs. Each needs delivery and replay policies.
Case file
A worked decision
A sports league publishes ScoreCorrected to scoreboard, standings and broadcast subscriptions. The standings subscription can add multiple workers while the others keep receiving their own copies.
Change the condition
If one operator must handle a single repair ticket, a work queue avoids creating independent copies for every worker.
Check the decision
Disconnect the standings worker and verify the scoreboard continues while the standings subscription follows its retention policy.
Choose readiness dispatch when a handler should attempt I/O after notification, or completion dispatch when the runtime can finish a submitted operation and report its result.
Treating readiness as completion can lead to partial reads or writes and lost progress.
Have the application explicitly signal completion of essential initialization.
FamilyDaemon lifecycle and supervision
ScopeService / manager boundary
Editorial statusDraft
What it buys
A manager can delay dependent startup or routing until an application reports that its initialization is complete.
Apply when
Dependents must wait for the service to be usable after launch.
Reconsider when
Startup has no meaningful work beyond launching the executable.
Costs and failure modes
A missing or premature notification stalls dependents or releases them too early.
Case file
A worked decision
A search daemon signals readiness only after its index is loaded and it can answer queries.
Change the condition
If the service performs no initialization and its only startup dependency is a listening socket already owned by its manager, socket activation may suffice.
Check the decision
Can an orchestrator route a query during index loading after process launch but before the daemon signals readiness?
A serializer can discover declared fields at runtime, reducing hand-written wiring as supported model types evolve.
Apply when
The required runtime extensions include changing how objects, calls or types are interpreted.
Reconsider when
A fixed extension interface handles every supported variation.
Costs and failure modes
Changes at the metalevel can bypass invariants and make performance and behavior harder to predict.
Case file
A worked decision
A modeling tool lets customers describe new entity types and validation operations at runtime. Its metamodel is inspectable, and changes to it alter how the tool interprets entities.
Change the condition
If the supported variations are a fixed set of validators, a plug-in interface can expose just those hooks.
Check the decision
Can a tenant's metamodel add a valid field while still rejecting edits that violate protected invariants?
Present coarse-grained remote operations over a finer-grained local interface.
FamilyEnterprise integration
ScopeRemote API boundary
Editorial statusDraft
What it buys
A client can complete one business operation in a single remote call and leave fine-grained interaction on the server.
Apply when
Remote clients otherwise make many small network calls per use case.
Reconsider when
The interface is used solely in process or already offers suitable coarse-grained operations.
Costs and failure modes
Remote contracts can become broad and lose flexibility.
Case file
A worked decision
An overseas depot needs to reserve all items for a repair order. A coarse reserve-order operation performs local checks together instead of issuing one remote call per stock line.
Change the condition
If the caller runs in the same process and needs independent item operations, a coarse facade may obscure useful granularity.
Check the decision
Use a network trace to count the round trips required to reserve a multi-line order and examine its failure semantics.
A signer that atomically associates the request ID with a durable signing outcome can return that outcome on retry. An ID alone cannot prevent a duplicate side effect.
Catalog note · Contrast: publish–subscribe decouples senders from individual responders.
Callers can express a domain query once and reuse it across workflows while the backing query plan or storage technology changes.
Apply when
Aggregates need a domain vocabulary for loading or saving and query rules recur.
Reconsider when
A generic wrapper only duplicates a capable query API or conceals essential query costs.
Costs and failure modes
An oversized repository leaks storage semantics or produces inefficient loads.
Case file
A worked decision
A loan analyst requests delinquent accounts in a specified risk band. A domain-facing repository expresses that query and reconstructs accounts without exposing SQL joins to the analyst workflow.
Change the condition
If every screen needs a different read projection and has no domain behavior, direct query objects may keep the use cases clearer.
Check the decision
Can the analyst ask for the intended set without importing persistence-specific predicates or knowing table names?
Combine client–server, stateless interaction, caching, layering and a uniform interface for resources.
FamilyNetwork architecture
ScopeDistributed hypermedia system
Editorial statusDraft
What it buys
Independently developed clients and intermediaries can reuse standard resource, representation and cache semantics where the interface honors them.
Apply when
Independent clients and intermediaries need evolvable representations of network resources.
Reconsider when
A private specialized operation has tight round-trip or binary efficiency requirements.
Costs and failure modes
Uniformity constrains application-specific shortcuts and stateless requests can carry more context.
Case file
A worked decision
A document service exposes addressable resources, cacheable representations and links for allowed transitions so clients can navigate evolving workflows.
Change the condition
If both ends implement a tightly controlled operation such as invoking a compiler, expose a direct procedure call.
Check the decision
Can a client locate the permitted next transition from the response without constructing a private URL?
Return a reply message for a specific request message.
FamilyMessage contracts
ScopeService conversation
Editorial statusDraft
What it buys
A client can receive the result of a particular operation across messaging infrastructure without sharing a call stack with the worker.
Apply when
A caller needs a decision from a separate participant over messaging.
Reconsider when
Fire-and-forget event notification has no meaningful reply.
Costs and failure modes
The caller must track deadlines and distinguish late replies from retries.
Case file
A worked decision
A diagnostics client requests a machine's current vibration sample over a broker and waits for the corresponding reply until a deadline. It distinguishes timeout from a reported machine fault.
Change the condition
For periodic fleet telemetry with no individual caller waiting for an answer, publish observations independently.
Check the decision
Return the sample after the deadline and verify the client neither blocks indefinitely nor attaches it to a later request.
Coordinate a series of local commits, with business-specific compensations or forward recovery for failures.
FamilyWorkflow coordination
ScopeBusiness process
Editorial statusDraft
What it buys
Services can complete a multi-step business operation using local commits and explicit recovery actions without holding one distributed transaction open.
Apply when
A long-lived business transaction spans independently owned resources.
Reconsider when
One short database transaction already covers the invariant.
Costs and failure modes
Intermediate states are visible. Some real-world effects cannot be undone.
Case file
A worked decision
A marketplace reservation spans inventory and payment services that can reverse holds after partial success.
Change the condition
If both resources share a database and owner, reserve them in one local transaction.
Check the decision
What state does the customer see when releasing an inventory hold itself fails?
Choose explicit coordination when a long-running business transaction has several compensations, deadlines or participants that require a visible sequence.
A centralized coordinator adds coupling and recovery work when two parties can handle the exchange directly.
Catalog note · Can use Choreography or a Process Manager.
Arrange local data and processing so the critical request path avoids synchronous downstream dependencies.
FamilyService architecture
ScopeSynchronous service request path
Editorial statusDraft
What it buys
A request can complete from local state while a downstream service is temporarily unavailable, within the agreed freshness limit.
Apply when
Availability or latency budgets cannot tolerate the combined risk of a dependency chain.
Reconsider when
A decision requires fresh authoritative remote data that cannot safely be replicated.
Costs and failure modes
Local projections, lag and reconciliation must be managed.
Case file
A worked decision
A fulfillment service keeps a local copy of shipping eligibility rules from its supplier, allowing dispatch while the supplier's API is temporarily unavailable.
Change the condition
If dispatch requires the supplier's authorization at that instant, a local copy cannot replace the synchronous decision.
Check the decision
Disconnect the supplier and check the oldest rule version the service will act on.
Allow contexts to solve their needs independently where integrating offers little return.
FamilyDomain boundaries
ScopeInter-context choice
Editorial statusDraft
What it buys
One team can deliver a local solution without waiting for a cross-team interface whose coordination would outweigh its value.
Apply when
Sharing a small capability would cost more than duplicating it locally.
Reconsider when
A common legally binding record or cross-context workflow requires coordination.
Costs and failure modes
Duplicate work and divergent behavior can accumulate.
Case file
A worked decision
A theatre's reservation system and payroll tool independently maintain their holiday lists. Sharing a library would save little and would couple a public booking release to payroll changes.
Change the condition
If both lists become the authoritative basis for contractual pay calculations, divergence may justify a shared governance boundary.
Check the decision
Introduce a holiday applying only to seasonal staff and check whether public booking behavior ought to change.
A reader can obtain a consistent snapshot of several fields without taking the writer's lock when retries are affordable.
Apply when
Readers copy a small state while writes are brief and infrequent.
Reconsider when
Readers must follow unstable pointers or writes could starve readers.
Costs and failure modes
A preempted writer or a write burst can cause repeated reader retries.
Case file
A worked decision
A timekeeper publishes a pair of scalar counters using its platform's sequence-lock primitives. Readers copy both fields and retry if the sequence value changed or was odd.
Change the condition
If readers may follow pointers to reclaimed objects, use lifetime protection such as RCU.
Check the decision
Can continuous writes starve a reader that needs a bounded response time?
Provide application operations that coordinate domain behavior and transaction boundaries.
FamilyEnterprise application
ScopeUse-case interface
Editorial statusDraft
What it buys
A CLI and a web endpoint can invoke the same business operation with the same transaction and orchestration rules.
Apply when
Several clients need identical use-case orchestration or transaction policy.
Reconsider when
One delivery adapter calls a single simple domain operation directly.
Costs and failure modes
Pass-through wrappers proliferate or domain rules migrate into a giant service.
Case file
A worked decision
A customer-support portal and a nightly fraud job both need to freeze accounts. A service-layer operation loads the account, invokes the rule and commits an audit record in the same unit of work.
Change the condition
If a program has a single trivial caller that only reads a record, a pass-through service adds another stop to trace.
Check the decision
Can both entry points obtain the same authorization, transaction and audit behavior from one operation?
Deploy a small number of coarse-grained business services behind a UI, optionally retaining a shared database.
FamilyService architecture
ScopeApplication and domain services
Editorial statusDraft
What it buys
A business unit can release or scale a large cohesive capability while keeping most of its internal calls in process.
Apply when
Distinct domain areas need separate deployment while workflows still benefit from local transactions inside each service.
Reconsider when
All work belongs to one release or small sub-capabilities truly need independent ownership and scaling.
Costs and failure modes
Services remain coarse scaling units and shared-schema changes may require coordinated releases.
Case file
A worked decision
A publishing company deploys editorial, subscriptions and distribution as a few coarse services. Each groups operations usually changed and released together.
Change the condition
If one subscription function alone has a materially different scale profile and a clear owner, it may deserve a narrower boundary.
Check the decision
Count independent feature releases blocked on deploying another coarse service.
Expose capabilities via services with explicit descriptions, contracts and interaction policies.
FamilyService architecture
ScopeCapabilities across ownership boundaries
Editorial statusDraft
What it buys
Several business processes can consume the same capability and rely on a documented interaction contract across platforms.
Apply when
Independent parties need to access reusable capabilities across technology or ownership boundaries.
Reconsider when
All behavior changes and deploys together and a local interface suffices.
Costs and failure modes
Contract governance, service discovery and ownership coordination add cost.
Case file
A worked decision
Three public agencies offer address verification through a documented contract with explicit owners and usage policies. A new licensing system consumes the shared capability.
Change the condition
A calculation used solely in one application needs no organizational service contract.
Check the decision
Can a new agency integrate through the documented policy and interface without gaining access to internal records?
Teams jointly own a deliberately small slice of model and implementation.
FamilyDomain boundaries
ScopeTwo collaborating contexts
Editorial statusDraft
What it buys
A jointly owned invariant can be specified and tested once across the teams that must implement it identically.
Apply when
Two teams genuinely agree on stable shared semantics and can coordinate changes.
Reconsider when
The teams need independent delivery or use superficially similar terms differently.
Costs and failure modes
Every shared change can force cross-team testing and negotiation.
Case file
A worked decision
Two divisions share a small versioned money-and-rounding model because invoices and settlements must reconcile to the cent. Changes require approval from both domain owners.
Change the condition
If each jurisdiction has legitimately different rounding rules, independently translated models avoid joint release negotiations.
Check the decision
Run both divisions' published rounding examples against a proposed kernel change before release.
Independent components coordinate by reading and writing a common representation.
FamilyStructural architecture
ScopeSubsystems sharing data
Editorial statusDraft
Also indexed as · Repository architectural style
What it buys
A new analysis tool can consume another tool's results without a direct adapter between every pair of tools.
Apply when
Compilers or analysis tools must operate on the same evolving body of data.
Reconsider when
Participants require conflicting schemas, isolated failures or independent data ownership.
Costs and failure modes
The shared schema becomes a compatibility contract for every writer.
Case file
A worked decision
A chemical analysis suite lets a fitter, plotter and report writer share the same governed experiment model. A saved fit becomes available to the other tools without pairwise integrations.
Change the condition
If tools evolve independently and require incompatible representations, versioned messages may isolate them better.
Check the decision
Change the stored result format in a staging workspace and identify every tool that must migrate together.
Keep working data and processing together in an in-memory grid of processing units.
FamilyStateful architecture
ScopeDistributed application
Editorial statusDraft
Also indexed as · Space-based architectural style
What it buys
Partition-local processing can relieve a shared database bottleneck on a high-volume request path.
Apply when
Bursty transactional workloads hit a shared database bottleneck and state can be partitioned.
Reconsider when
Durability or cross-partition constraints dominate and an ordinary database meets latency goals.
Costs and failure modes
Consistency, persistence and grid recovery become explicit design duties.
Case file
A worked decision
A ticket exchange partitions active offers by venue into processing units with local working state. Each unit can match orders without repeatedly fetching each offer from a central store.
Change the condition
If one authoritative database already handles the burst and matches frequently span venues, keep the centralized transaction.
Check the decision
Fail a processing unit mid-match and verify the recovered offer, reservation and durable sale agree.
Index objects by location so neighborhood queries examine a limited region.
FamilyGame and simulation architecture
ScopeWorld model / spatial queries
Editorial statusDraft
What it buys
A collision or proximity query can skip distant objects before running expensive intersection tests.
Apply when
Collision or proximity lookups dominate scans in a populated scene.
Reconsider when
Small object counts or highly volatile positions make index upkeep more expensive than scanning.
Costs and failure modes
Moving objects require index maintenance; skew can overload a region.
Case file
A worked decision
A drone simulator places obstacles into grid cells so a drone checks nearby candidates instead of every obstacle. A moving obstacle updates its occupied cells.
Change the condition
For a test map with a handful of obstacles, a linear scan is simpler and may already meet the frame budget.
Check the decision
Repeat proximity queries while moving an obstacle across a cell boundary and compare the candidates against a full scan.
Route behavior to new implementations in slices as the legacy footprint shrinks.
FamilyModernization
ScopeIncremental application replacement
Editorial statusDraft
What it buys
One customer journey can move to a replacement system while other journeys continue to run on the legacy system.
Apply when
A large system must remain operational and has separable entry points or responsibilities.
Reconsider when
A small replaceable system can be cut over simply or there is no interceptable seam.
Costs and failure modes
Coexistence, data ownership and retiring old pathways can outlast the rewrite.
Case file
A worked decision
An insurer moves claim-status reads off a legacy module ahead of claim submission. Route only status requests to the new implementation and preserve the old submission route.
Change the condition
If the legacy program runs once a month and can be replaced in one rehearsed cutover, incremental routing adds an unnecessary coexistence period.
Check the decision
After one migrated route fails, can it return to the old handler without losing claims written during coexistence?
A parent operation can account for its child tasks at exit, reducing abandoned work after cancellation or failure.
Apply when
Concurrent subrequests serve one parent operation and must not leak after it finishes.
Reconsider when
The task is a durable job meant to continue after the initiating request or process exits.
Costs and failure modes
Cancellation remains cooperative and cleanup or simultaneous failures still need handling.
Case file
A worked decision
A product page fetches price and stock as child tasks in a request-owned scope. The HTTP handler forwards cancellation to the scope and waits for both tasks to finish cleanup.
Change the condition
An accepted video-transcoding job must survive the parent request. Persist it for a worker instead.
Check the decision
When one lookup fails or the client disconnects, which tasks remain alive after the scope closes?
Let the first finishing branch trigger the continuation once, then consume remaining completions before resetting.
FamilyWorkflow control flow
ScopeBusiness process instance
Editorial statusDraft
What it buys
A process that can accept any one valid response can continue as soon as the first arrives without starting a second continuation for later replies.
Apply when
Any one of several concurrently running checks suffices to advance a case.
Reconsider when
All answers or a specified number of approvals are required, or unfinished work must be cancelled immediately.
Costs and failure modes
Remaining branches still consume resources and complete after the decision. Reentry before reset breaks the structure.
Case file
A worked decision
A dispatch workflow pages three response desks and proceeds on the first response while the remaining branches finish without triggering dispatch again.
Change the condition
If every desk must approve, wait for all three.
Check the decision
Does the second desk response start another dispatch before the group resets?
Allow simple model-to-view binding while a controller handles complex presentation behavior.
FamilyPresentation architecture
ScopeUI boundary
Editorial statusDraft
What it buys
Simple fields can follow standard bindings while the controller handles the interactions that actually need imperative coordination.
Apply when
Bindings cover ordinary fields and selected interactions need explicit orchestration.
Reconsider when
All behavior must be testable outside the concrete view.
Costs and failure modes
Binding plus imperative updates can obscure which mechanism owns a field.
Case file
A worked decision
A product editor binds ordinary name and price fields directly. A supervising controller handles conditional promotion fields and validation that spans several widgets.
Change the condition
If a safety audit requires every visible state transition to be testable without a UI toolkit, move toward a passive view.
Check the decision
Verify that a simple price change needs no controller code but an invalid promotion produces the prescribed widget states.
Coordinate independently useful systems through interfaces to deliver a larger capability.
FamilySpecialized architecture
ScopeOperationally and managerially independent systems
Editorial statusDraft
What it buys
Existing systems can contribute to a coordinated capability while remaining independently useful to their own users.
Apply when
Separate organizations retain operating authority but must interoperate toward a shared outcome.
Reconsider when
One owner can design, release and operate the components as a single system.
Costs and failure modes
Contract evolution, incentives and behavior across independent participants resist central control.
Case file
A worked decision
A regional emergency network coordinates ambulance dispatch, hospitals and traffic control. Each organization retains its own mission and can continue operating when the shared coordination platform is unavailable.
Change the condition
If one owner controls every component's requirements, release schedule and recovery, conventional system decomposition may suffice.
Check the decision
Disconnect one participant and verify both its independent mission and the coordination system's degraded operating policy.
A column rename or database-specific query change can be handled at one access boundary for that table.
Apply when
SQL needs containment and callers already operate on record sets.
Reconsider when
Users need aggregate-level semantics spanning several tables.
Costs and failure modes
The schema surfaces in callers and table-at-a-time access can inflate round trips.
Case file
A worked decision
A ledger import has several callers that read and update one settlement table. A gateway centralizes the SQL used by all of them without assigning one persistence object per row.
Change the condition
For one short-lived report query with one caller, a named query may be sufficient.
Check the decision
Change the settlement column name and count the modules that require a SQL edit.
A calculation over an entire record set can live beside the other operations for that table without allocating an object per row.
Apply when
Calculations naturally work on tabular sets and identity-specific behavior is limited.
Reconsider when
Rich entity lifecycles span multiple tables and need individual behavior.
Costs and failure modes
Database structure can dominate business terminology and coupling.
Case file
A worked decision
A benefits administrator recalculates payroll deductions for rows in a pay-period dataset. A table module owns operations on that row set, keyed by employee number.
Change the condition
If each benefit election develops independent lifecycle rules and collaborators, a domain object can express behavior more directly.
Check the decision
Can a correction target the right rows for one pay period without creating an object graph per employee?
Ask every participant to prepare, then record and distribute a common commit or abort decision.
FamilyConsensus and commit
ScopeTransaction participants
Editorial statusDraft
Also indexed as · 2PC
What it buys
Participating resource managers can recover one shared commit-or-abort decision for changes that must be atomic across them.
Apply when
Supported transaction managers must atomically change multiple resources.
Reconsider when
Participants cannot hold prepared state, or a business workflow lasts minutes or days.
Costs and failure modes
Prepared participants can block awaiting a decision after coordinator failure.
Case file
A worked decision
A clearing operation must commit in both transactional resource managers or in neither. Both support durable prepare, and the transaction coordinator records its decision so recovery can finish it.
Change the condition
If both changes can reside in one database, use a local transaction.
Check the decision
If the coordinator disappears after prepare, what blocks, and where can a participant recover the authoritative decision?
A generic function can demand ordering or serialization while unrelated types supply their own implementations of that capability.
Apply when
An algorithm needs an operation such as ordering across unrelated types.
Reconsider when
A single callback already states the only capability and is chosen at runtime.
Costs and failure modes
Instances can clash or violate semantic laws that the compiler cannot check.
Case file
A worked decision
A sorting library accepts any type with a lawful ordering. Measurements supplied by different libraries can participate without inheriting a shared base class.
Change the condition
If one screen chooses a different order for every request, pass a comparator directly.
Check the decision
Does the ordering satisfy transitivity across actual domain values?
When a view displays a bad value, a developer can trace the action and state transition that produced the rendered input.
Apply when
Multiple user actions or data sources must update displayed state consistently.
Reconsider when
A single isolated widget has no shared state or coordination pressure.
Costs and failure modes
Every update needs an explicit path and high-frequency updates can trigger excessive rendering.
Case file
A worked decision
An image editor routes tool selections and document actions to a state owner. Toolbar and canvas read that state, preventing each view from writing changes directly into the other.
Change the condition
For two unrelated local inputs with no shared state, forcing both through a central store adds routing without coordination value.
Check the decision
Can the toolbar and canvas disagree about the active tool after replaying the same action sequence?
Track changed objects and coordinate writes at completion of a business operation.
FamilyEnterprise persistence
ScopeBusiness transaction
Editorial statusDraft
What it buys
A use case can stage several related changes and flush them together within the intended transaction boundary.
Apply when
Several object changes must be persisted consistently and efficiently.
Reconsider when
The operation is one atomic statement or an existing persistence context already supplies this behavior.
Costs and failure modes
Long-lived units accumulate stale state, memory use and contention.
Case file
A worked decision
A repair order edit adds parts, changes labor and removes an obsolete fee. A unit of work tracks these changes and writes them at one transaction boundary.
Change the condition
If a command changes one field with an atomic database statement, change tracking adds little value.
Check the decision
Inject a failure while saving the fee change and confirm that the parts and labor edits also roll back.
Issue a narrowly scoped, short-lived token for direct client access to a resource.
FamilySecurity architecture
ScopeClient and storage
Editorial statusDraft
What it buys
A client can transfer a large object directly with narrowly scoped authorization, avoiding an application data relay.
Apply when
Large uploads would otherwise pass through an application purely for authorization.
Reconsider when
Each byte requires synchronous inspection that direct access would bypass.
Costs and failure modes
An overbroad or leaked token remains usable until expiry or revocation.
Case file
A worked decision
A video portal issues a short-lived signed upload URL scoped to a particular staging object. Its upload workflow tolerates overwrites until that URL expires.
Change the condition
For small uploads that need inline inspection before any storage write, proxy the bytes through the application.
Check the decision
Can a holder write outside the assigned staging key, and can the release step be tricked into publishing bytes uploaded after validation?
Equivalent amounts or ranges compare by content and can carry their own validation wherever they are used.
Apply when
Currency, units or intervals need value equality and locally enforced invariants.
Reconsider when
The business tracks identity and history independently of current attribute values.
Costs and failure modes
Equality, normalization and precision choices become part of the domain contract.
Case file
A worked decision
A geofence represents a radius as a distance with explicit units. Two independently created distances representing the same length compare equally and can be substituted.
Change the condition
If the business tracks calibration, custody and lifetime history of a particular measuring instrument, that instrument needs identity.
Check the decision
After unit conversion, do equivalent distances compare consistently and preserve the geofence's inclusion rule?
Accept a request in a front end, enqueue deferred work and let separate workers process it.
FamilyApplication topology
ScopeRequest path and background work
Editorial statusDraft
What it buys
The web tier can acknowledge accepted work promptly and scale worker capacity independently when jobs accumulate.
Apply when
An expensive task can finish after the caller receives acknowledgment.
Reconsider when
The caller must receive the final result synchronously and the work is quick.
Costs and failure modes
Queue delays, retries and reporting completion become application responsibilities.
Case file
A worked decision
A video editor accepts an upload and returns a job identifier while a worker generates a preview. A status endpoint shows completion or failure for that identifier.
Change the condition
If a preview is a tiny precomputed asset, a direct synchronous response avoids tracking a job.
Check the decision
Kill the worker after it saves a preview but before acknowledgement and verify that redelivery creates no duplicate asset.
Compare the approaches that address the specific constraint you face.
The import routine is five branches deep. Where can I cut it safely?
Mark the branch exits. An exit that only rejects bad input can become a guard, while a block that finishes building input for the next block suggests a phase boundary.
Is our nested generic type buying us anything when all callers use one concrete type?
Inspect what actually changes across callers. A change of element type supports a type parameter, a change of operation can be passed as a function, and identical uses support a concrete type.
Our checkout has one subclass for every combination of discount and tax rule. How can we stop multiplying classes?
List the combinations requested by real callers. Independently selected rules can be passed as policies, while one fixed sequence with a single variation point may only need a hook.
Does a quote preview that changes the invoice mean we need CQRS?
Identify the smallest boundary where change is needed. A side effect in arithmetic, a mutating preview method, and independently evolving read and write models point to three different entries.
Why does adding a second matching permission row duplicate a person in my report?
Check the required output grain. One row per qualifying person needs only an existence test, while one row per permission match needs the matching rows themselves.
Can the database stop double-bookings, or do we need a scheduling engine?
Observe where the failure occurs. Rejecting one conflicting assignment at commit needs an authoritative invariant, while finding a feasible combination for the entire roster needs a search over choices.
An import fails opening the fifth file. Who closes the first four?
Count acquisitions on each execution path. A known set of owners fits fixed scopes, while a runtime-sized set benefits from registering each successful acquisition as it occurs.
Our dashboard shows stock levels from two different ticks. Where should we fix it?
Capture the first inconsistent snapshot. A mixed snapshot at publication points to producer buffering, while competing updates inside the view point to its state transition path.
A fast producer keeps exhausting memory when the consumer pauses. How should it slow down?
Check whether the producer can honor a pause. A blocking handoff or demand protocol needs a cooperative producer, while expendable work may need an explicit drop rule.
An order is marked paid but its event never arrives, and our retry sometimes credits the account twice. Which boundary failed?
Locate the failure relative to publication. A crash between commit and publish exposes the dual write, while two deliveries reaching the same side effect expose duplicate processing.
Can two people edit the same offline note without silently losing one person's work?
Write the expected outcome for two concurrent edits. Detecting a conflict for a person to resolve and automatically merging operations require different guarantees.
One team wants to split billing out of our application. Which boundary should we test first?
Try shipping a billing change through an internal module boundary and record what still forces a coordinated release. That remaining coupling determines what an independent deployment could buy.
Two teams mean different things by “customer.” Should they share a model?
Inspect one real translation between the teams. Collapsing two identities or lifecycle rules loses meaning, while a genuinely identical and jointly maintained subset may be shared.
Why are users refused connections just after the service manager says the daemon started?
Identify who owns the listener during startup. An unopened application socket, a manager-owned listening socket, and a bound but unready application call for different lifecycle contracts.
A network transfer slows down. Should the sender wait for the receiver or for the network?
Measure where the first queue builds. Receiver buffer exhaustion calls for receiver feedback, while growing queues along the path call for congestion control.
One broken dependency consumes every request worker. Should we divide capacity or stop calling it?
Find the resource exhausted first. A shared pool needs isolation, while repeated calls to a dependency with a sustained failure rate can be interrupted at the call boundary.
How can we try a new search service with production traffic without affecting every reader?
Decide whose response users receive. Shadow requests can test behavior with discarded results, while candidate responses for a limited cohort expose actual user impact.
A code rollback still leaves the old service unable to read new records. What must change?
Run the old reader against an actual record written by the candidate. A failed compatibility check requires a data transition in addition to any traffic or replica switch.
A manager could open a record yesterday but moved departments today. Where should access change?
Name the fact that revokes access. A change of job role can drive a role grant, while the relationship between the current department and a particular record requires request context.
A territory reassignment changes last year's sales totals. Which version should reports use?
Ask whether the report promises historical or current territory membership for the same invoice. That choice determines which dimension row each fact must join.
Our model scored well in training and poorly online. Are we retraining the wrong thing?
Reconstruct the feature vector available at prediction time for one known case. A mismatch directs attention to feature construction before another round of training.
We scan millions of particles each frame. Should we change the data layout or parallelize the loop?
Profile the stalled part of a representative frame. Fetching unused fields points to layout, while independent compute-heavy updates may benefit from parallel execution.
A workflow charges a card, books a courier, then loses its worker. Where should it resume?
Check the durable evidence for the last external action. A recorded outcome permits resumption, an uncertain outcome needs safe retry or reconciliation, and a known completed action may need business compensation.
Choose explicit coordination when a long-running business transaction has several compensations, deadlines or participants that require a visible sequence.
A centralized coordinator adds coupling and recovery work when two parties can handle the exchange directly.
A generic algorithm can accept any type satisfying its required operations, while an object strategy is useful when the policy must be replaceable at runtime.
The need for generic input types establishes no need for an inheritance hierarchy, and some languages can express runtime choice with a function.
Both preserve a small core, but an OS microkernel places selected services outside the privileged kernel while a product core defines extension contracts.
Moving a feature into an application plug-in provides no automatic process, privilege or fault isolation.
Choose readiness dispatch when a handler should attempt I/O after notification, or completion dispatch when the runtime can finish a submitted operation and report its result.
Treating readiness as completion can lead to partial reads or writes and lost progress.
Let domain teams publish owned data products backed by lakehouse tables when independent ownership and shared storage capabilities both serve the organization.
Changing table storage does not assign owners, define data product contracts or establish federated governance.
Keep separate batch and speed paths when each has a necessary processing model, or replay one retained stream when one pipeline can compute both results.
Two paths can diverge semantically, while a single replay path depends on retained input and tolerable rebuild time.
Isolate databases when tenants need independent restore, residency or capacity policies, and share storage when per-tenant operations would dominate cost.
A shared database requires reliable row isolation, while separate databases add migration and fleet-management work.
Both limit producer progress using downstream capacity, while a stream subscriber signals demand in items and a transport defines its own credit units.
Subscriber demand does not imply a limit on every intervening network buffer or on total bytes.
A valid manifest can still fail halfway through parsing, leaving its file handle open.
Try it
Bind the open file to a scope that releases it on normal return and exceptional exit. Inject a parse failure on line three and try to reopen the file exclusively.
Stop here when
One scoped owner suffices while reading and closing happen in the same operation.
A new checksum helper closes the caller's stream, so the parser fails on the next record.
Try it
Give the helper temporary access to one record buffer. State who owns that buffer, and demonstrate that a retained view would become invalid when the next record reuses it.
Stop here when
Keep the buffer borrow synchronous if the helper can finish before reuse. Copy a small record if it must outlive the owner's scope.
The importer becomes a daemon. Deployment can interrupt one manifest while others are queued.
Try it
Stop accepting new imports, let one in-flight import finish to a deadline, then cancel and clean up. Interrupt it during a write and verify recovery from the last committed checkpoint.
Stop here when
A single bounded run already owned by its caller can use its existing cancellation and cleanup path.
Learning path
Choose how a reusable algorithm receives its policy
A hiring campaign chooses a selection policy at runtime and each policy needs independently configured scoring behavior.
Try it
Install two interchangeable policies behind the same selection contract. Show that callers can switch policies without changing traversal, and compare a function implementation with a state-owning object.
Stop here when
Keep the function when one callable expresses the whole policy. Introduce an object when shared policy state or multiple operations justify it.
Learning path
Find a valid assignment and keep it valid at commit
A training center needs a report pairing instructors with the course sessions they are certified to teach.
Try it
Join sessions to certifications on course identity. Hand-check a tiny fixture containing two certified instructors and one session without any qualifying instructor.
Stop here when
Stop at the query for a planning report that people review and assign manually.
The coordinator now needs one row per session that has any available certified instructor. Multiple matches currently duplicate sessions.
Try it
Rewrite the eligibility test as an existence query and add a second matching instructor. Confirm the session appears once, even before anyone is assigned.
Stop here when
Keep a join when the output needs each instructor's name. Use existence when only eligibility matters.
Two coordinators can book the same instructor into the same fixed time slot after both screens report availability.
Try it
Put uniqueness on instructor and slot in the authoritative assignment table and require non-null keys. Try two concurrent inserts and decide how the losing caller gets an updated choice.
Stop here when
For fixed slots, let a local uniqueness rule enforce this invariant. Variable-length overlapping intervals would require a different rule.
Finding a whole day's feasible assignments by hand becomes difficult when some sessions have only one qualified instructor.
Try it
Represent each session's eligible instructors as a finite domain. Fix a mandatory assignment and remove incompatible choices from overlapping sessions until nothing more is forced.
Stop here when
If propagation assigns every session, verify the resulting schedule and skip branching.
Several feasible candidates remain after propagation, and picking the first one can leave another session unstaffed.
Try it
Encode qualification and slot conflicts as hard constraints. Construct a case where a greedy choice fails, find a feasible assignment, and rerun after removing the only substitute.
Stop here when
Use the solver for candidate schedules and recheck invariants when committing. Keep the manual assignment and database constraint while they meet planning needs.
Profiling shows the simulator scans the position and velocity of every carrier while fetching cold maintenance fields.
Try it
Create separate position and velocity arrays keyed by a stable carrier index. Compare one simulation tick on the same input, including the cost of updating indices after a carrier is removed.
Stop here when
Keep ordinary records if field separation gives no material benefit under representative access patterns.
A dashboard now observes some carriers before a tick and others after the same tick.
Try it
Write the next tick into a spare buffer, then publish the completed buffer in one synchronized handoff. Hold a reader across a later tick and specify when a buffer may safely be reused.
Stop here when
With one synchronous reader already scheduled between ticks, the timing guarantee may remove the need for a second buffer.
Two sensor adapters sometimes update the same carrier during a tick, even with front and back buffers.
Try it
Route inputs to one simulation owner. Define the tie-break for simultaneous events and test it by interleaving sensor arrival with dashboard publication.
Stop here when
Keep one writer while it meets the tick deadline. Additional writers need a partition or synchronization rule.
A live display and a recorder need different reactions each time the simulation publishes a complete tick.
Try it
Expose completed ticks as a subscription and give each consumer an unsubscribe path. Disconnect and reconnect the display, then count callbacks and check buffer lifetimes.
Stop here when
A direct callback is enough for one synchronous observer with the same lifetime as its publisher.
A recorder stalls during disk rotation and a fast simulation accumulates unbounded queued snapshots.
Try it
Build a demand-aware subscription and test a subscriber that requests two items and then pauses. State where unrequested ticks go and whether the source can pause, the display can skip frames, or the recorder needs durable buffering.
Stop here when
Use explicit demand only when its contract fits the producer. A loss-tolerant dashboard can keep just the latest snapshot.
Practice
Casebook
Work through one design as the requirements change. Each case ends with an observable check.
A label finalizes a recording release. Accounting must open a royalty account and independent partners want a release notice. What happens if a process crashes between those actions?
A label-print daemon for a sorting line receives print requests over a network socket. How should it start, admit work and stop without silently losing jobs?
A tactics game starts with a few movement rules and later adds mods, replays and large crowds. Which requirements affect rule representation and which affect runtime data layout?
Python 3 and SQLite
Two buyers see the last seat
Two readers see an available seat. Observe the difference between a valid preview and an atomic reservation.
Try it
Save the program as last_seat.py, or use the ready-made file in the downloadable package.
python3 last_seat.py
Expected behavior
Two previews see 1. A succeeds, B is rejected, and one committed booking remains.
View program
"""Two observed reads, followed by two competing claims in a fixed order."""
import sqlite3
from pathlib import Path
from tempfile import TemporaryDirectory
def preview(conn):
return conn.execute("SELECT remaining FROM showing WHERE id = 1").fetchone()[0]
def claim(conn, buyer):
with conn:
changed = conn.execute(
"UPDATE showing SET remaining = remaining - 1 WHERE id = 1 AND remaining > 0"
).rowcount
if changed:
conn.execute("INSERT INTO booking(buyer) VALUES (?)", (buyer,))
return bool(changed)
def main():
with TemporaryDirectory() as tmp:
path = Path(tmp) / "cinema.db"
a = sqlite3.connect(path)
b = sqlite3.connect(path)
try:
a.executescript("""
CREATE TABLE showing(id INTEGER PRIMARY KEY, remaining INTEGER NOT NULL CHECK(remaining >= 0));
CREATE TABLE booking(buyer TEXT PRIMARY KEY);
INSERT INTO showing VALUES (1, 1);
""")
seen = (preview(a), preview(b))
assert seen == (1, 1)
print(f"Preview A={seen[0]} B={seen[1]}")
claims = (claim(a, "A"), claim(b, "B"))
assert claims == (True, False)
print(f"Claim A={claims[0]} B={claims[1]}")
bookings = a.execute("SELECT COUNT(*) FROM booking").fetchone()[0]
assert preview(b) == 0 and bookings == 1
print(f"Remaining={preview(b)} bookings={bookings}")
finally:
a.close()
b.close()
if __name__ == "__main__":
main()
Compare a closed switch, function registration and an object-based policy before and after a new mod adds a piece.
Worked case
Is reading a seat count a query, an action, or a reason to use CQRS?
A venue exposes a seat count, sells reservations and sends availability to partner venues. Which distinctions actually change the design?
Starting design
For a small booking desk, one transactional booking model can serve both edits and the seating screen. Reading the current stock is a query in the API's command–query vocabulary. It is also an action in functional reasoning because another purchase can change the result between calls. These two labels describe different properties of the same operation.
01
The desk introduces a standby quota, and the rule is hard to test against a changing clock and database.
Read inventory and policy once in the shell. Pass those snapshots and the requested party size into a calculation that decides whether a reservation fits. Revalidate at the transaction boundary before committing.
A deterministic calculation is easy to replay, but an earlier availability snapshot cannot guarantee that the sale will succeed.
02
A reservation claim must both change the seat allocation and return a confirmation.
Make the claim atomic and return its receipt. Keep a separate side-effect-free operation for previewing eligibility.
Splitting the claim into an availability check followed by an unguarded write would let simultaneous buyers claim the same seat.
03
Partners require a zone-by-zone summary while booking rules change on a different schedule.
Consider a distinct read model over the same database. Introduce asynchronous projection only when measured pressure and a freshness agreement justify it.
A request dispatcher supplies neither a distinct model nor a freshness guarantee.
Check the decision
Hold one seat, place two competing claims, and change the clock between previews. Verify one confirmed sale, repeatable pure calculations for the same inputs, and the documented behavior of any stale partner display.
When should a generic abstraction survive a design review?
A permit office proposes a repository with type parameters for the entity, key, filter and projection. Which parts genuinely vary?
Starting design
Begin with the actual call the office needs: find permits expiring before a supplied date. A named query returning permit summaries expresses its intent, authorization scope and ordering. Four type parameters allow numerous combinations the office has never requested and may never want to support.
01
Permit and inspection screens need the same continuation-token protocol while returning different item types.
Share a typed page and its continuation-token rules. Each query keeps its own authorization and filter semantics.
The abstraction earns its parameter by preserving item types. A token meaningful to one query must still be rejected by the other.
02
Three screens need to sort different records according to caller-supplied rules.
Keep the sorting algorithm generic and pass the comparison function as an argument. Document required ordering properties.
A type checker may verify the comparison signature while accepting an inconsistent ordering rule.
03
One ranking policy now has dependencies, keeps explanatory evidence and is selected for an entire review session.
Give that policy an object with a small contract. Keep the ordinary named permit query and the reusable page type.
Object-based Strategy makes the session's behavior explicit, but a class per trivial comparison would obscure the common path.
Check the decision
Ask the reviewer to name one invalid use prevented by each proposed type parameter. Run paging tests for both record types, exercise an unreliable comparator, and inspect whether the permit use case is still recognizable at the call site.
When should a committed release create a durable event?
A label finalizes a recording release. Accounting must open a royalty account and independent partners want a release notice. What happens if a process crashes between those actions?
Starting design
If publication only updates a screen inside the editor, a direct in-process notification after a successful change may meet the requirement. There is no need for a durable subscriber merely to refresh a screen that can reload the release on startup.
01
Several partner systems now require independent copies of every release.
Publish a release fact to separate subscriptions. Competing workers can share the work within a subscription that processes recordings independently.
Subscriber progress and retention must be monitored separately. Parallel workers may complete recordings in a different order.
02
Accounting may miss a fact if the publishing process crashes between committing the release and sending the message.
Store an outbox record in the same local transaction as the release. A relay retries publication after the process recovers.
A relay crash after sending but before recording success can produce a duplicate. Downstream consumers must expect redelivery.
03
Royalty account creation includes a call to a partner outside the accounting database.
Deduplicate the local change atomically with the message ID. Use the partner's idempotency contract or reconcile the partner operation by a durable business key before retrying.
A local deduplication table cannot make an external action atomic. Without partner support, an uncertain outcome needs reconciliation or manual handling.
Check the decision
Crash the publisher before and after commit, crash the relay immediately after send, and drop the partner response after the partner accepts the operation. Count durable releases, outbox entries, local royalty accounts and actual partner accounts separately.
A label-print daemon for a sorting line receives print requests over a network socket. How should it start, admit work and stop without silently losing jobs?
Starting design
For an attended printer, a foreground process can serve requests and exit on failure. For an unattended sorting line, start it under a supervisor and let the supervisor own restart policy and process identity. The mere existence of its PID shows only that the executable has begun.
01
Clients can send jobs as soon as the line starts, but the daemon still needs to check its spool and attach the printer.
A service manager can own the listening socket and pass it to the daemon. Advertise application readiness only when the daemon can apply its stated acceptance policy.
A queued connection proves neither that a job has been accepted nor that paper can be printed. Define whether durable spooling counts as acceptance.
02
The process remains alive while its worker loop is stuck.
Drive a service watchdog from meaningful progress of the monitored loop, and keep hardware or downstream reachability separate from process liveness.
A heartbeat emitted by an unrelated thread can hide deadlock. Restarting every process during a shared printer outage can worsen recovery.
03
Rolling upgrades interrupt in-flight labels.
Withdraw readiness, stop admission, drain until a deadline, and persist or explicitly reject outstanding jobs before exit.
A printed label followed by a lost acknowledgement creates uncertainty about the physical effect. Record job identity and plan operator reconciliation.
Check the decision
Start the daemon with an unavailable printer, freeze its worker, and send a stop signal during a print. For each run, compare connection status, readiness, durable job status, actual labels and restart behavior.
Does changing a game's movement model require an object hierarchy?
A tactics game starts with a few movement rules and later adds mods, replays and large crowds. Which requirements affect rule representation and which affect runtime data layout?
Starting design
For a closed set of pieces, a direct function taking a piece kind, a position and a proposed destination can be easy to inspect. The baseline can expose a complete list of cases and return an explanation for an illegal move. Keep it while this representation makes changes inexpensive and stays inside the measured frame budget.
01
Mods must supply new movement behavior independently of the base game.
Let mods register a movement function or Strategy object under a stable contract. Choose an object when a policy has its own configuration, state or several related operations.
Loading untrusted or incompatible extensions requires an explicit compatibility and isolation policy.
02
A replay diverges when drawing the same match on slower hardware.
Advance simulation with explicit, fixed-duration steps and recorded input ordering. Make random seeds and other nondeterministic inputs reproducible.
A fixed timestep alone cannot guarantee deterministic replay across different numeric implementations or nondeterministic iteration orders.
03
Profiling shows that updating independent crowd positions dominates simulation time.
Group position and velocity data for batch updates, and consider an ECS movement system. Keep mod policy decisions and high-volume integration separate where their workloads differ.
Component storage and scheduling bring structural-change and ownership costs. Interactions crossing entities can prevent safe parallel writes.
Check the decision
Replay a captured input stream at different render rates and compare simulation state at fixed ticks. Profile an agreed crowd scene before and after the storage change, including memory, update time and cost of adding one new rule.
Source links identify literature for the underlying concepts. Retrieval labels describe the supplied source ledger, whose check dates are unavailable; they do not establish review of each claim. Scenarios, countercases, design comparisons and exercises are authored teaching examples, not production case reports or benchmarks.