#payments

3 articles

backendpayments

Shadow Mode: Proving New Code Before You Trust It

New payment confirmation code ran in production on Joytop for a week in shadow mode — deciding nothing, only watching. Tomorrow it becomes the one that decides. What shadow mode actually does, what it protects against, and why you can't turn it on without watching it.

September 13th, 20263 min read

system-designbackend

The Payment That Charged Twice

A retry is not a duplicate request — until it is. How idempotency keys actually work, why the naive version still double-charges, and the exact Postgres constraint that makes the guarantee real.

September 9th, 20268 min read

architecturepayments

Idempotency Is Not a Header. It Is a Contract.

Every payment provider tells you to make your webhook idempotent. Almost nobody tells you what that actually requires — which is a decision about identity, a decision about state, and a place to put the evidence.

September 2nd, 20266 min read