Section 12: Doors Already in the Wall - Follow-up Feature Evolution

Executive Summary: The platform has shipped. The interviewer asks for what owners want next: monthly quotas, health-reactive limits, priority shedding, per-user fairness inside a tenant, cost weights for expensive calls, and fast SKU upgrades. For each we say what changes, what stays, and which earlier decision left room for it. Only one feature gets a new stateful service, the monthly quota. Everything else is a new input to the allocator, a new level of bucket, or a value the hot path already accepts.

The interviewer's tone changes. "Owners love it. Here's the backlog. Evolve the design without rebuilding it."

You: "Three openings already exist. Section 4's decide() takes a cost argument. The allocator re-divides a quota every second, so the quota can move. And Section 5's runtime key hashes whatever dimensions a rule names. Most of the backlog fits through those. One item doesn't."

Monthly Quotas: A Second Service, Not a Longer Bucket

"Contoso's contract says 5B calls a month (≈ 1,900/s on average). Can the bucket do that?"

You: "It could, and it shouldn't. That's D10. A monthly bucket would live in the allocator's soft state, so a restart would forget the month, and 10% overshoot on a monthly allowance is money. D4 named this as its flip trigger: long windows need persisted state."

So monthly quotas get their own durable quota service. It keeps one exact counter per (tenant, API, month), reads the per-key, per-minute admitted counts the telemetry pipeline already produces (D9), and applies each batch as a transactional decrement keyed by key and minute, so a replayed batch is never charged twice. That's D2's flip trigger, durable counters with transactional decrement, placed off the hot path.

The quota service never answers "may I?" Its only output is a derived per-second ceiling. While allowance remains, the ceiling is the SKU's normal rate. As the allowance runs low, the ceiling shrinks so the rest of the month can only spend what is left, reserving at least two rollup intervals of headroom (lag × rate) so telemetry lag can't overspend it. The ceiling feeds the allocator's quota input exactly as adaptive caps do (below), so no rule changes. Contoso's decisions still take about 2 µs; they just meet a lower number.

Quick check before moving on: