ARCHITECTURE REVIEW: SENIOR ENGINEER ASSESSMENT

DESIGN SUMMARY (3-tier)
• Read path: Web → CDN → Origin (database direct)
• Write path: Web → API → Queue → Worker → Database
• Assumption: separation improves write throughput (worker async)

SCRUTINY (Deep dive)

✗ ISSUE 1: No backpressure on queue
• Problem: If workers slow (database contention), queue grows unbounded → memory leak
• Risk level: HIGH (could lose messages after 7-day retention)
• Fix: Add circuit breaker (stop accepting writes if queue depth > 100k)
• Estimate: 2-4 hours (add monitoring + handler)

✗ ISSUE 2: CDN cache invalidation not defined
• Problem: How long do reads stay cached? What triggers purge on write?
• Risk level: MEDIUM (data freshness gaps possible)
• Fix: Define TTL (60s for user-specific data; 1h for public data) + purge on write
• Estimate: 1-2 hours (cache headers + invalidation webhook)

✓ GOOD: Database connection pooling mentioned
• Evidence: Uses PgBouncer; avoids connection exhaustion (solid)

✓ GOOD: Separation of concerns (read vs write)
• Benefit: Allows independent scaling; read replicas can be added later

FAILURE MODES ANALYSIS
1. Database down → Reads fail (expected); writes queue → acceptable
2. Queue worker down → Backlog accumulates → triggers circuit breaker → acceptable
3. CDN down → Origin traffic spikes 10x → may overload → ADD fallback (cache on origin)

RECOMMENDATION
Ship with circuit breaker + cache invalidation strategy. Monitor queue depth + p99 write latency for first 2 weeks. If CDN failure tests show origin saturation, add origin cache layer (Redis 10GB, ~$500/mo).

CONFIDENCE: 7/10 (solid foundation; 2 gaps need filling before 9/10)