~learn.
0:00 / 1:31
W02 · Failure-first design

A flash sale that quietly loses a unit with every abandoned cart

transcript

A shopper claims a flash-sale unit. Then walks away without paying. That unit should go back on sale. With the obvious code, it never does.

MegaMart's lightning deal. 10,000 units, 90 percent off. Claim one, and it's yours for 180 seconds. Pay, or it goes back. About 30 percent never pay. Around 3,000 units should flow back for a second wave.

The claim key lives in Redis, with its own 180 second TTL. So the expiry worker asks: does the claim key still exist? Gone? Then it was checked out. Paid. Leave it. But here's the catch. The key also vanishes when its TTL runs out. Unpaid looks exactly like paid.

By the time the worker checks, the key has usually expired already. So every abandoned claim leaks its unit. Forever. Your sale ends with stock nobody can buy.

The fix: every claim also goes into an expiry set. Scored 60 seconds past its TTL, as grace. A successful checkout removes the claim from that set. The worker tries to remove it too, atomically. If that removal works, nobody paid. Put the unit back.

A missing key can mean two opposite things. So never treat absence as proof. Make the success path leave a mark.

Full breakdown in the lecture.