01
Fail closed on moderation
Chose Refusing the write with a 503 when the moderation model can’t be reached over letting unchecked content through.
On an app that introduces strangers, an unscreened photo costs more than a retry.
Trade-off: An OpenAI outage blocks profile, photo and venue edits until it recovers.
02
Ticks mean the phone has it
Chose Marking a message delivered only when the recipient’s device acknowledges its ID over inferring delivery from socket presence or an accepted push.
Presence isn’t receipt: senders kept a single tick after the recipient’s push had already arrived.
Trade-off: Every app build must send acknowledgements, over HTTP or the socket, before ticks turn double.
03
Keyset paging for chat history
Chose A keyset cursor on sent time and message ID over offset paging or a timestamp-only cursor.
Offsets skip or repeat messages while new ones arrive, and timestamps can tie. A chat now opens on its newest 40 messages.
Trade-off: Clients lose total message counts and can’t jump to an arbitrary page.