Offline work, distributed boundaries and operations
Problem and decision
A field engineer edits a note while connectivity is unreliable. The app must preserve intent, reconcile it under current permissions and explain conflicts. “Retry when online” is incomplete: online status does not prove the API is reachable or that the user's permissions are unchanged.
Durable local queue
The workbench stores pending edits in IndexedDB under tenant/user scope. A write resolves after its transaction completes, not merely after the request reports success. Reloading preserves pending intent. Synchronization sends the edit ID and base revision; only a confirmed server result removes the queued record. A conflict remains visible and durable.
The initial application shell still requires loading. This lab does not claim a service-worker installation, background sync guarantee or cross-device conflict-free collaboration. Browsers can evict storage; choose a recovery/export story for high-value drafts and communicate pending versus accepted work clearly.
Architecture at team scale
A modular monolith provides explicit feature ownership without independent runtime composition. Move to micro-frontends when independent delivery and organizational boundaries justify duplicated infrastructure, version skew and cross-application coordination. A shared event bus can couple independently deployed teams more tightly than a stable API.
BFFs tailor contracts and aggregate reads, but can become an availability bottleneck or a domain-logic dumping ground. Define which service owns business truth. Use bulkheads for optional integrations, timeout budgets across nested requests and graceful degradation that preserves the primary task.
Capacity and reliability reasoning
Queue growth is arrival rate minus completion rate. If a hypothetical system receives 100 jobs per second and completes 80, it accumulates 72,000 jobs per hour. More retries increase arrivals during an outage. Bound queues, reject or defer work deliberately, and expose backlogs instead of hiding them behind spinners.
For external side effects, a local transaction cannot atomically commit with an arbitrary remote service. Use the remote service's idempotency capability, an outbox and recovery process where appropriate. “Exactly once” must name the boundary. Compensation is a new business operation that may fail; it is not a universal rollback button.
Incident exercise and evidence
Disable one optional dependency, revoke permission with a pending edit, and restart the server after a committed run. Confirm that accepted work survives, denied edits remain unaccepted, and the primary journey has a usable fallback. Correlate browser, BFF and storage events using safe IDs and release attribution.
A strong postmortem distinguishes trigger, latent design weakness and detection gap. Assign an owner and a measurable follow-up, such as an assertion against discarding conflicted edits. Roll out queue/schema migrations with compatibility for older open tabs; rollback must continue reading already-created records.
Executable reference and sources
Implementation · Behavioral evidence · Primary source.
Run the projects and assessment. Human review is pending.