How Wain was built
Three numbers summarising what the buying screens never show — each measured by a command you can re-run.
AED 1.90
financial error caught by arithmetic before a line of code
The brief assumed a margin of 8.00 per order. Re-deriving it gave 3.10. The gap is not an arithmetic slip: it is exactly the total VAT — the brief counted tax collected for the state as platform profit. The identity now enforced by a database constraint: buyer paid minus organiser payout minus platform margin minus total VAT equals zero.
20
concurrent buyers on two tickets — exactly two won
Reservation is one atomic conditional UPDATE, not read-then-write. Twenty parallel attempts against a capacity of two: two succeeded, eighteen were refused, zero oversell, zero negative stock. Overselling on a ticketing platform is not a technical fault — it is a buyer at the door holding a paid ticket with no seat.
118
money tests at 100% branch coverage — proven by mutation
Coverage alone proves nothing: tests can pass over wrong logic. So VAT derivation by subtraction was replaced with re-multiplication — the classic way to lose a fils on an invoice — and three tests failed immediately. A test that does not fail when you break what it guards is not a test.
Eight CI gates — each proven to fail
A gate that has never failed is not a gate. Every one below was deliberately broken once to confirm it catches.
| Gate | How it was proven |
|---|---|
| Money coverage at 100% branches | one uncovered branch → 50% → build failed |
| Contract drift | changed a version in the document → exit code 1 |
| Import boundaries | money package imported from an app → refused |
| Colour contrast | weakened a muted colour → 2.86:1 below 4.5 → build failed |
| Secret scan over history | a fake key in a commit → leaks found: 1 |
| Dead token syntax | restored Tailwind 3 syntax → lint failed |
| Physical properties in RTL | added ml-4 → lint failed |
| Performance budgets | failed on SEO 92 and TBT 238 before the fixes |
Traps enumerated before building — and where each was caught
Six of twenty-six closed with evidence. What matters is not the count but the last column: a trap caught at decision time is far cheaper than one caught in production.
| Trap | Where it was caught |
|---|---|
| Reconciliation identity does not balance | at decision time — before any code |
| UAE weekend definition | at decision time — from an official source |
| Last ticket under concurrency | at test time — 20 concurrent |
| Webhook arriving twice or early | at test time — found a real defect |
| Tenant isolation | at test time — proven by mutation |
| Ticket forgery | at design time — Ed25519 signature |
And a backup that was actually restored
Continuous WAL archiving moved worst-case data loss from 24 hours to seconds. The drill is not paperwork: it restores into a separate instance and verifies every table count and the reconciliation identity. It passed on production, and failed deliberately when the archiver was stopped. A backup never restored is not a backup.
And what is not real here
The payment gateway is simulated and email does not actually leave. Everything else runs: atomic reservation, signed webhook, double-entry ledger, refunds, organiser cancellation, ticket signing. The data is seeded with real venue names and realistic price ranges, but these are not live events.