Section 9: The Escalation Gauntlet - Interviewer Deep-Dive Challenges

Executive Summary: With the baseline defended and the hot path built, the interviewer stops asking you to design and starts trying to break what you designed. This section walks six escalations in the order a real Staff panel tends to fire them — money, abuse, deletion, a count that visibly shrinks, multi-region, and 10× growth. Every answer lands with the same two-step cadence: right-size the problem first, then name the mechanism. Each challenge probes whether the ledger-as-truth architecture from Section 5 was a conviction or a slogan.

An hour in, the interviewer puts the marker down and switches registers. No more "walk me through" — now it's "what if." The phase has a rhythm worth learning before any individual answer: the interviewer names a scenario, weak candidates respond by adding a component, and strong candidates first ask how big the problem actually is. The Citadel is usually built right here, one panicked "we'd add a service for that" at a time.

Key Insight: Every escalation has the same hidden structure: a scary-sounding event whose correct answer is small because the design already paid for it. If your answers keep tracing back to "the ledger is the truth and the counter is derived," you are not repeating yourself — you are demonstrating that the architecture has one load-bearing idea, and you know which one it is.

Challenge 1: "Creator payouts will pay per like. Still comfortable with approximate?"

Right-size first: this is not a request to make the display exact — it is a second product sharing a noun with the first. The number on the post is an engagement signal rounded to "42.3K"; the number on a payout statement is an accounting figure with legal weight. Conflating them is the mistake.

Name the mechanism: the count forks. The display keeps its approximate, cache-served value and its rounding rules. The accounting number is computed from the likes ledger by the reconciliation pass — recounted from source rows, bot-filtered, timestamped "as of." This is exactly the flip trigger written into the consistency decision in Section 8: the moment the count becomes money, exactness moves to the reconciled ledger-derived figure — never to the live counter, which by design may lag and drift until reconciliation. You never pay from a cache.

What they're probing: whether you know which numbers in a system are money. "We'd tighten the pipeline to exactly-once" volunteers every post for the accounting tax. The Staff answer keeps the hot path sloppy and makes the slow path authoritative.

Quick check before moving on: