Section 11: The Escalation Gauntlet - Interviewer Deep-Dive Challenges

Executive Summary: The topology survived its deep dives; now the interviewer tries to break it. Seven challenges follow, each leaning on an earlier decision. Each answer names what's being tested, puts a ledger number on it, gives the mechanism and the rejected alternative, and ends with the senior line. The numbers are still this interview's assumptions: 600,000 posts/s at peak, 1.2 M hashtag tuples/s, about 100 executors on 12 machines.

Interviewer: "Good. Now I'm going to try to break it."

You: "Please do. I'll name the decision each one stresses."

Challenge 1: "Same pipeline, but it bills advertisers per impression"

What they're testing: whether you think acking gives you exactly-once. It doesn't.

Section 8's duplicate bound, a fraction of a percent of a window, is fine for a ±1% panel and an overcharge on an invoice. The acker doesn't remove duplicates; its replay creates them. Billing needs exactly-once state (Section 9): Trident stores each count with the txid of the batch that last wrote it and skips a replayed batch with the same txid, at the cost of batch latency and throughput. The sink must be idempotent too: upsert by impression id, or write count and txid atomically. And billing gets its own topology. Decision 3's flip applies to the money path, not to the panel.

The senior line: "Exactly-once lives in the state and the sink, not in the acker. I'd pay for it only where money moves."