The final architecture
The last consolidation. One picture of everything, then the course's ideas ranked by transfer value — what you should carry to systems that have nothing to do with rides.
A first pass might summarize the final system as a large inventory of services and technologies. That works only while the failure case is absent. The final architecture must explain the critical synchronous path, the owner of each invariant, every asynchronous boundary, and behavior under control and regional failure.
flowchart TB
APPS["📱 Rider + driver apps — local replica, offline queue, hedging (3.6)"]
PROBE["🤖 Synthetic probes (3.8)"]
APPS --> EDGE["Global edge — anycast, city-to-home routing (3.2)"]
PROBE --> EDGE
EDGE --> R1
EDGE --> R2
EDGE --> R3
subgraph R1 ["Region A — active"]
direction TB
RT1["Cell router (3.3)"]
RT1 --> CA1["Cell A1: gateway, realtime, dispatch, trip, pricing, location — own shards + quorum groups (3.4)"]
RT1 --> CA2["Cell A2"]
RT1 --> CAN["Canary cell — deploys + chaos land first (2.8, 3.7)"]
end
subgraph R2 ["Region B — active"]
RB1["Cells ×N"]
end
subgraph R3 ["Region C — active"]
RC1["Cells ×N"]
end
R1 <-. "cross-region replication (3.2)" .-> R2
R2 <-. " " .-> R3
R1 <-. " " .-> R3
subgraph ASYNC ["Asynchronous planes — shared, tier-isolated"]
K[["Event backbone — outbox, idempotency law (2.4)"]]
OBS["Observability — burn rates, correlator, auto-remediation (2.9, 3.8)"]
LAKE[("Streaming lakehouse — surge v2, live ops, feature store, warehouse (2.10, 1.13)")]
PAYP["Payments + ledger + fraud (1.8, 2.11) — T1, async from T0"]
end
R1 -.-> ASYNC
R2 -.-> ASYNC
R3 -.-> ASYNC
subgraph CTRL ["Control plane — data plane survives its death (3.5)"]
DEPL["Progressive delivery"]
FLAGS["Flags + config"]
HOMES["Home map + leases"]
end
CTRL -- "signed proposals, last-known-good adoption" --> R1
CTRL -- " " --> R2
CTRL -- " " --> R3
The ideas worth transferring, in rough order of generality: (1) Availability is arithmetic — serial chains multiply failure, so the deepest lever is always removing synchronous edges, not strengthening boxes (0.3 → 2.4 → 3.1). (2) Match guarantees to data value — at-most-once pings and exactly-once ledger effects in one system, each correct (1.4 vs 1.8). (3) State is quorum truth or rebuildable ephemera; the middle is where outages live (3.4). (4) Blast radius is a design axis you can buy by construction — shards, tiers, cells (2.3 → 3.3). (5) Recovery has a speed limit; past it, be already running (2.7 → 3.2). (6) The system that configures the system is the residual risk — fail static (2.8 → 3.5). (7) Claims about failure behavior decay; only continuously rehearsed claims stay true (3.7). (8) Each nine is an economic purchase; the tier lattice is the budget (2.1 → 3.9).
The final transferable idea is about construction order. Complexity remained manageable because it arrived in dependency order: each layer reused established guarantees, and each simplification named what it deferred. Large systems become explainable when every step introduces one new relationship and preserves the invariants already earned. Draw the skeleton from memory one last time, then build from those guarantees rather than from the final inventory of boxes.
Now consider what happens when one region fails while control services are dark and an asynchronous consumer is hours behind. If the central guarantee disappears here, the design has confused an optimization with a correctness boundary.