Soft delete and name reuse: make restore conflicts explicit
Run nine SQLite checks for tenant-scoped names, renamed restoration and unchanged IDs. Turn delete, recreate and restore into an acceptance brief.
Blog
Find a check for the system you are building
Explore SaaS engineering through runnable examples and decision worksheets. Browse by topic or search all articles.
JSON IDs: preserve identity across a JavaScript client
Eight IDs reveal four altered numeric round trips in Node. Strings and Python integers preserve all eight; test Map collisions and a strict decimal contract.
Outbound webhooks: pin the checked destination
Run 16 offline URL cases and a DNS rebinding counterexample. Inspect the connection plan, redirect boundary and tests the real worker still needs.
OIDC account linking: keep identity separate from email
Six lookups and eight link decisions separate issuer-subject identity from email, explicit account ownership and workspace connection policy.
Worker shutdown: stop taking jobs before draining
Four shutdown policies finish different sets of work. Run a two-slot queue simulation and separate admission, in-flight completion and cleanup.
Invoice rounding: preserve the total and the line identity
Compare independent rounding with a deterministic allocation. Run 3,750 exact-arithmetic cases and preserve line amounts through reversals.
LLM timeouts: keep uncertain usage reserved
Releasing an unresolved LLM request admits 120 credits under a 100-credit cap in this model. Compare retained reservations and duplicate settlement.
OAuth refresh token races: trace the lost response
A local model separates duplicate exchanges, stale writes and a lost response. Inspect six traces before retrying a rotating refresh token.
SaaS resource quotas: protect the last slot
Run eight SQLite cases: stale checks admit six projects under a cap of five. Inspect atomic reservation, retry receipts, rollback and duplicate release.
RAG access revocation: invalidate derived answers
A clean retrieval index can coexist with an unsafe answer cache. Test ten reads after revocation, deletion, missing sources and version changes.
JSON Merge Patch: null is a delete instruction
An empty update can delete a nickname when an adapter converts omission to null. Reproduce eight merge cases and inspect the client-server boundary.
SaaS custom domains: verify every reassignment
Separate domain disconnection from reassignment. Run eight routing cases that reject old ownership proof and keep tenant bindings explicit.
Cache stampede: 12 misses, one cache fill
Three coordination scopes produce different source-load counts. Run nine deterministic cases for tenant keys, failed fills and warm-cache reads.
Feature flag retirement: remove the old behavior safely
A proposed retirement memo checks five deployed-consumer cohorts, missing-flag behavior and rollback builds before temporary configuration is removed.
Data migration: equal row counts can hide different data
Six target fixtures all match the source row count, but only two reconcile by key and value. Run the comparison and inspect every discrepancy list.
CSV export: separate cell quoting from formula safety
Run 12 harmless CSV cases: five accepted values round-trip unchanged and seven are rejected. Inspect the bounded text and numeric policies and their limits.
API deprecation: make customer migration verifiable
A proposed 5-cohort matrix separates API migration from missing traffic, delivered notices and unknown callers. Define the evidence each consumer needs.
Why a redriven message returns to the dead-letter queue
Four executed event fixtures show why a schema fix improves redrive without repairing malformed messages. Inspect 16 attempts and cohort review decisions.