Model entrances, spots, tickets, pricing, and concurrent allocation across floors.
Choose a path, then play or step through exactly how the call moves between components.
The caller starts the operation at Driver / Attendant with a stable request and retry identity.
The design separates the latency-sensitive online path, the correctness-critical durable transition, and asynchronous projection or repair work. Each chapter below explains one decision shown in the diagrams.
State assumptions before choosing technology. The supplied workload is 10K spots · multiple gates · real-time availability. Convert it into peak throughput, retained records, bandwidth, and failure budget; then connect each number to a component.
| Dimension | Working estimate | Design implication |
|---|---|---|
| Traffic | 10K spots · multiple gates · real-time availability | Separate online compute, durable state, and asynchronous consumers. |
| Peak factor | 5–10× average | Admission control, autoscaling headroom, and hot-key protection. |
| Stored state | write rate × retention × record bytes | Partition count, indexes, compaction, backup, and archival tier. |
| Network | peak operations × payload size | Batching, compression, edge placement, and egress budget. |
| Availability | 99.9–99.99% | Multi-zone replicas, tested failover, and dependency error budgets. |
| Recovery | RPO/RTO by invariant | Ack boundary, replay retention, reconciliation, and operator runbooks. |
POST /v1/entriesissue ticket and allocate spotPOST /v1/exits/quotecalculate feePOST /v1/tickets/{id}/paysettlePOST /v1/sensors/eventsreconcile occupancyspot(spot_id PK, floor, type, state, version, ticket_id) ticket(ticket_id PK, plate_hash, spot_id, entered_at, state) payment(payment_id, ticket_id, amount, method, state) sensor_event(event_id, spot_id, occupied, observed_at)
# Command envelope
operation: POST /v1/entries
request_id: req_01J...
idempotency_key: idem_7f2...
aggregate_key: parking-lot_123
expected_version: 17
payload: {...}
# Durable event
event_id: evt_01J...
aggregate_key: parking-lot_123
event_type: parking_lot_committed
schema_version: 3
trace_id: tr_8ac...The authoritative aggregate and idempotency record share a transactional or conditional-write boundary. Event streams, search indexes, caches, analytics, and dashboards are rebuildable projections.
↑ topThe boxes are not a shopping list. Each boundary exists because it owns a different invariant, scaling dimension, data lifecycle, security policy, or failure domain. The table makes those choices explicit and shows when the design should remain simpler.
| Component | Owned responsibility | Why separate it | Rejected alternative | Cost and evolution trigger |
|---|---|---|---|---|
| Driver / Attendant | Owns client protocol, request identity, retry, and resume behavior. In this design it participates in: Classify vehicle and query the floor/type availability index. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents the external caller from also owning the contract and failure behavior of Entry Gate. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Two entry gates choose same spot” to the external caller. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Driver / Attendant boundary before extracting or scaling it. |
| Entry Gate | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Spot strategy selects candidate; conditional transition AVAILABLE→HELD prevents double assignment. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Driver / Attendant from also owning the contract and failure behavior of Ticket Kiosk. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Sensor says occupied before ticket commit” to Driver / Attendant. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Entry Gate boundary before extracting or scaling it. |
| Ticket Kiosk | Owns authentication, validation, quotas, deadlines, and routing. In this design it participates in: Commit ticket and spot occupancy, then open gate and update display projection. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Entry Gate from also owning the contract and failure behavior of Vehicle Classifier. | Put protocol, authentication, quotas, and business transitions in one process. Acceptable at low scale, but it couples external traffic risk to domain releases. Here that simpler choice would couple “Payment succeeds but exit gate fails” to Entry Gate. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Ticket Kiosk boundary before extracting or scaling it. |
| Vehicle Classifier | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: At exit price from entry time/rules, settle idempotently, and mark ticket paid. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Ticket Kiosk from also owning the contract and failure behavior of Parking Service. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Lost ticket has no entry evidence” to Ticket Kiosk. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Vehicle Classifier boundary before extracting or scaling it. |
| Parking Service | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Open exit, release spot, and reconcile sensor disagreements into an operator queue. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Vehicle Classifier from also owning the contract and failure behavior of Spot Strategy. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Accessible/EV policy changes while held” to Vehicle Classifier. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Parking Service boundary before extracting or scaling it. |
| Spot Strategy | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Classify vehicle and query the floor/type availability index. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Parking Service from also owning the contract and failure behavior of Floor Availability Index. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Two entry gates choose same spot” to Parking Service. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Spot Strategy boundary before extracting or scaling it. |
| Floor Availability Index | Serves a low-latency, disposable projection with authoritative fallback. In this design it participates in: Spot strategy selects candidate; conditional transition AVAILABLE→HELD prevents double assignment. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Spot Strategy from also owning the contract and failure behavior of Spot Aggregate. | Read authoritative storage for every request. Simpler initially, but latency and source-of-truth load scale together and a hot key becomes a database incident. Here that simpler choice would couple “Sensor says occupied before ticket commit” to Spot Strategy. | Costs invalidation, staleness, stampede protection, and memory. Add or split it only after the workload (10K spots · multiple gates · real-time availability) proves repeated reads dominate. Measure the latency, saturation, lag, or mismatch at the Floor Availability Index boundary before extracting or scaling it. |
| Spot Aggregate | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Commit ticket and spot occupancy, then open gate and update display projection. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Floor Availability Index from also owning the contract and failure behavior of Ticket Store. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Payment succeeds but exit gate fails” to Floor Availability Index. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Spot Aggregate boundary before extracting or scaling it. |
| Ticket Store | Owns authoritative versioned state or immutable evidence. In this design it participates in: At exit price from entry time/rules, settle idempotently, and mark ticket paid. | Defines the source of truth and commit boundary. It prevents Spot Aggregate from also owning the contract and failure behavior of Sensor Gateway. | Let each service persist its own interpretation. That removes one clear commit boundary and makes retries, support, and reconciliation ambiguous. Here that simpler choice would couple “Lost ticket has no entry evidence” to Spot Aggregate. | Costs schema migration, replication, backup, and shard ownership. Split storage only when access patterns, retention, or compliance boundaries materially differ. Measure the latency, saturation, lag, or mismatch at the Ticket Store boundary before extracting or scaling it. |
| Sensor Gateway | Owns authentication, validation, quotas, deadlines, and routing. In this design it participates in: Open exit, release spot, and reconcile sensor disagreements into an operator queue. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Ticket Store from also owning the contract and failure behavior of Exit Gate. | Put protocol, authentication, quotas, and business transitions in one process. Acceptable at low scale, but it couples external traffic risk to domain releases. Here that simpler choice would couple “Accessible/EV policy changes while held” to Ticket Store. | Costs another hop, policy distribution, and a high-blast-radius fleet. Introduce it when many clients or services need one protocol and protection boundary. Measure the latency, saturation, lag, or mismatch at the Sensor Gateway boundary before extracting or scaling it. |
| Exit Gate | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Classify vehicle and query the floor/type availability index. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Sensor Gateway from also owning the contract and failure behavior of Pricing Strategy. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Two entry gates choose same spot” to Sensor Gateway. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Exit Gate boundary before extracting or scaling it. |
| Pricing Strategy | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Spot strategy selects candidate; conditional transition AVAILABLE→HELD prevents double assignment. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Exit Gate from also owning the contract and failure behavior of Payment Adapter. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Sensor says occupied before ticket commit” to Exit Gate. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Pricing Strategy boundary before extracting or scaling it. |
| Payment Adapter | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Commit ticket and spot occupancy, then open gate and update display projection. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Pricing Strategy from also owning the contract and failure behavior of Display Boards. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Payment succeeds but exit gate fails” to Pricing Strategy. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Payment Adapter boundary before extracting or scaling it. |
| Display Boards | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: At exit price from entry time/rules, settle idempotently, and mark ticket paid. | Separates a distinct scale, ownership, policy, or failure boundary. It prevents Payment Adapter from also owning the contract and failure behavior of Reconciliation. | Keep this behavior inside an adjacent service. Prefer that simpler option until independent scale, ownership, policy, or failure isolation is measurable. Here that simpler choice would couple “Lost ticket has no entry evidence” to Payment Adapter. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Display Boards boundary before extracting or scaling it. |
| Reconciliation | Owns one bounded domain decision, transition, or operational capability. In this design it participates in: Open exit, release spot, and reconcile sensor disagreements into an operator queue. | Proves correctness and supports controlled recovery. It prevents Display Boards from also owning the contract and failure behavior of operators and repair tooling. | Infer correctness from request logs. Logs do not prove durable business state, detect silent drift, or safely repair ambiguous outcomes. Here that simpler choice would couple “Accessible/EV policy changes while held” to Display Boards. | Costs an interface, deployment, telemetry, ownership, and failure mode. Keep it in-process first; extract when independent scale or reliability pays for the boundary. Measure the latency, saturation, lag, or mismatch at the Reconciliation boundary before extracting or scaling it. |
Use spot and ticket state machines; transitions must be explicit and validated.
A single deployable with one transactional store is the right starting point for a small parking lot workload. The proposed boundary becomes justified when use spot and ticket state machines; transitions must be explicit and validated. Separating it contains the named failure “Two entry gates choose same spot” without placing unrelated work on the critical path.
Select spots through a strategy interface so vehicle type, accessibility, and proximity policies can evolve.
The design coordinates only where every object transition is legal and atomic at one aggregate boundary. Everywhere else it accepts bounded staleness or asynchronous propagation. The alternative—strong coordination for every projection—simplifies the mental model but increases tail latency and turns partitions into broad write unavailability.
Protect allocation with optimistic versions or per-floor locks; publish availability after commit.
This choice adds dashboards, ownership, schema compatibility, capacity planning, and recovery runbooks. Start with the minimum topology that supports “Commit ticket and spot occupancy, then open gate and update display projection.” and extract another service only when measured throughput, blast radius, data lifecycle, or team ownership changes independently.
Use spot and ticket state machines; transitions must be explicit and validated.
Select spots through a strategy interface so vehicle type, accessibility, and proximity policies can evolve.
Protect allocation with optimistic versions or per-floor locks; publish availability after commit.
Classify vehicle and query the floor/type availability index.
Spot strategy selects candidate; conditional transition AVAILABLE→HELD prevents double assignment.
Commit ticket and spot occupancy, then open gate and update display projection.
At exit price from entry time/rules, settle idempotently, and mark ticket paid.
Open exit, release spot, and reconcile sensor disagreements into an operator queue.
identity = authenticate(request) prior = idempotency.get(identity, request.key) if prior: return prior.result current = authoritative_store.read(partition_key) next_state, events = domain.transition(current, request) authoritative_store.compare_and_set(current.version, next_state) idempotency.commit(request.key, next_state.result) outbox.append(events) return next_state.result
Cache immutable or slowly changing reads with versioned keys, TTL jitter, short negative entries, and request coalescing.
Measure per-key and per-tenant skew. Replicate safe reads, isolate the offender, salt only when ordering permits, and enforce budgets.
Bound queues, buffers, connection pools, and concurrency. Shed low-priority work and scale from lag/oldest-item age rather than CPU alone.
Use single-flight/coalescing, jittered expiry, bounded retries, exponential backoff, and circuit breakers so one dependency failure does not multiply traffic.
partition = stable_hash(primary_or_aggregate_key) → shard owner write = conditional_update(expected_version) read_projection = versioned and rebuildable
every object transition is legal and atomic at one aggregate boundary. Use a uniqueness constraint, serializable/conditional write, expected version, or fencing token at this boundary.
Analytics, notifications, search, read models, and operational dashboards may lag when freshness is observable and replay exists.
| Operation | Consistency | Reason |
|---|---|---|
| Authoritative mutation | Conditional / serializable | Protect uniqueness, ownership, money, inventory, order, or legal state transition. |
| Read after own write | Primary, session token, or cache warm | The caller must observe the result it just committed. |
| Ordinary read projection | Bounded stale where safe | Replicas and caches improve latency when version/freshness is visible. |
| Analytics and operations | Eventual + replay | Freshness is less important than isolating the online path. |
| Failure | Runtime behavior | Recovery proof |
|---|---|---|
| Two entry gates choose same spot | Resolve at source of truth with uniqueness, expected version, lease generation, or monotonic cursor. | Reconciliation returns zero invariant gaps; lag/replica health and user-visible SLO return to baseline. |
| Sensor says occupied before ticket commit | Stop unsafe progress, serve only explicitly safe degraded behavior, and recover from durable state. | Reconciliation returns zero invariant gaps; lag/replica health and user-visible SLO return to baseline. |
| Payment succeeds but exit gate fails | Stop unsafe progress, serve only explicitly safe degraded behavior, and recover from durable state. | Reconciliation returns zero invariant gaps; lag/replica health and user-visible SLO return to baseline. |
| Lost ticket has no entry evidence | Stop unsafe progress, serve only explicitly safe degraded behavior, and recover from durable state. | Reconciliation returns zero invariant gaps; lag/replica health and user-visible SLO return to baseline. |
| Accessible/EV policy changes while held | Stop unsafe progress, serve only explicitly safe degraded behavior, and recover from durable state. | Reconciliation returns zero invariant gaps; lag/replica health and user-visible SLO return to baseline. |
# Recovery checkpoint scenario: Two entry gates choose same spot operation_id: op_01J... aggregate_key: parking-lot_123 last_durable_version: 18 projection_checkpoint: partition-07@offset-482901 retry_policy: same_identity / bounded_backoff reconciliation_status: pending owner: Reconciliation
Every dependency needs a timeout, retry budget, circuit policy, and explicit fail-open, fail-closed, stale, or read-only mode. “Highly available” is incomplete until degraded behavior is named.
↑ topUse spot and ticket state machines; transitions must be explicit and validated. Walk the concrete lifecycle step “Classify vehicle and query the floor/type availability index.” Then test it against “Two entry gates choose same spot”. State the retry identity, durable checkpoint, recovery signal, and cost of the alternative.
Select spots through a strategy interface so vehicle type, accessibility, and proximity policies can evolve. Walk the concrete lifecycle step “Spot strategy selects candidate; conditional transition AVAILABLE→HELD prevents double assignment.” Then test it against “Sensor says occupied before ticket commit”. State the retry identity, durable checkpoint, recovery signal, and cost of the alternative.
Protect allocation with optimistic versions or per-floor locks; publish availability after commit. Walk the concrete lifecycle step “Commit ticket and spot occupancy, then open gate and update display projection.” Then test it against “Payment succeeds but exit gate fails”. State the retry identity, durable checkpoint, recovery signal, and cost of the alternative.
Use spot and ticket state machines; transitions must be explicit and validated. Walk the concrete lifecycle step “At exit price from entry time/rules, settle idempotently, and mark ticket paid.” Then test it against “Lost ticket has no entry evidence”. State the retry identity, durable checkpoint, recovery signal, and cost of the alternative.
Select spots through a strategy interface so vehicle type, accessibility, and proximity policies can evolve. Walk the concrete lifecycle step “Open exit, release spot, and reconcile sensor disagreements into an operator queue.” Then test it against “Accessible/EV policy changes while held”. State the retry identity, durable checkpoint, recovery signal, and cost of the alternative.
| Time | What to cover |
|---|---|
| 0–5 min | Clarify scope, workload, SLOs, and the correctness invariant. |
| 5–10 min | Estimate throughput/storage and define concrete APIs and records. |
| 10–20 min | Draw online, durable-write, and asynchronous/repair paths. |
| 20–30 min | Explain the exact lifecycle, partition key, and concurrency control. |
| 30–38 min | Discuss caching, hot keys, replication, and backpressure. |
| 38–43 min | Run failure drills, security, observability, and regional evolution. |
| 43–45 min | Summarize the five most important choices and trade-offs. |
| Invariant | every object transition is legal and atomic at one aggregate boundary. |
|---|---|
| Partitioning | Stable aggregate/key hash with versioned ownership and measured hot-key isolation. |
| Commit | Expected version or uniqueness at the authoritative state boundary. |
| Async work | Durable outbox/log, idempotent consumers, checkpoints, and replay. |
| Recovery | Same operation identity, durable truth lookup, and business reconciliation. |