Cumulative checkpoint: systems and engineering evidence

The representation is part of the specification

Mathematical integers are unbounded abstractions. Unsigned C++ arithmetic is reduced modulo the type’s range size. Signed overflow is not a defined wraparound operation in ordinary C++ semantics. A sanitizer can reveal selected executed violations, but it cannot decide whether the application intended exact arithmetic, checked bounded arithmetic, saturation, or modular behavior. Define that domain first, then choose types and checks that implement it. Unexecuted boundary inputs remain outside a particular run’s evidence.

Recheck the state under the lock

A wake can be spurious, or another consumer can acquire the lock first and remove the available item. Use a loop or predicate wait that resumes only when the queue is nonempty or a closed-state condition permits termination. Then handle closure and draining explicitly. Notification announces that something may have changed; it does not reserve an element for the awakened thread. The predicate must be inspected under the same synchronization protecting the queue state.

A key identifies one logical payload

Return a conflict and do not apply another stock change. The key already identifies a committed operation with a stored payload and result. Changing quantity under the same key would make the retry’s meaning ambiguous: it could no longer be a safe repetition of the original operation. A genuinely new reservation needs a new key and is separately subject to stock and authorization rules. This preserves identity; it does not guarantee every new reservation succeeds.

Selection can hide the worst outcomes

Failed requests may be disproportionately slow, so excluding them changes the population and can improve the percentile while user experience worsens. Report latency for all relevant completed attempts or logical requests under a defined timeout convention, together with failure and timeout rates. A separate successful-request latency distribution can be useful if labeled, but should not replace the full outcome picture. Keep workload and counting rules consistent between versions, especially when retries create multiple attempts per logical request.

A valid representation can contain an unauthorized claim

JSON validation establishes a syntactic and structural input shape. It does not establish who the caller is or whether their asserted role is trustworthy. Authentication must establish identity, and authorization must consult trusted policy and resource ownership rather than accepting self-declared administration. TLS protects the connection and can authenticate endpoints under a configured trust model, but does not automatically make an application-supplied role authoritative. These layers solve different problems.

Scope every claim to its evidence

An accurate report says that the documented tests passed on the specified Linux/compiler environment under the named sanitizers and that a specified single-threaded workload showed an observed speed ratio under stated timing boundaries and repetitions. Cross-platform validation requires actual builds and tests on additional platforms. Race-freedom requires a sound synchronization/ownership argument and appropriate analysis; stress or sanitizer evidence alone is not a universal proof, and address/undefined-behavior sanitizers are not ThreadSanitizer. A general 100-fold performance claim requires representative workloads, equivalent validated outputs, environment details, uncertainty, and integration costs. The bounded result may still be valuable when described honestly.