The incident
Harbor’s published January net order value is 375 at the February 1 cutoff. A refund of 25 for o1 arrives on February 2. A manager wants to overwrite January immediately; a pipeline retry also delivers the same refund event twice. You must define behavior before proposing tools.
Your task
Distinguish a frozen as-of report from a restated report. State the event key and a retry-safe rule. Describe validation before promotion and how you would recover from a failed release without silently losing a legitimate refund.
Worked solution
The original cutoff view remains 375 because the February 2 event is excluded. A separately labelled restated January-order view including that event is 350. Subtract the refund once, never twice: a duplicate retry must not produce 325. Neither view is universally “correct”; the contract and as-of label determine the answer.
A reliable design
Retain the raw event and ingestion timestamp, identify a stable provider refund_id, and enforce uniqueness on that identity in the validated event layer. An identical retry is a no-op; the same ID with conflicting content should be quarantined and investigated rather than silently overwritten. Recompute the affected partition from validated inputs and publish a version only after controls pass.
Controls and recovery
Check event uniqueness, unmatched order IDs, currency consistency, refund totals and order/report grain. Keep the previous published version available; if promotion fails, serve that version while investigating and replay from retained inputs. Record watermark, cutoff, build version and reconciliation totals. Do not promise exactly-once behavior without explaining the boundary and failure cases.
Interview defense
Explain your design in three minutes without naming a cloud product first. Then handle: “What if the ID is reused?”, “What if the amount is corrected?” and “What would users see during recovery?” Score contract clarity, idempotency, validation, recovery and communication 0–2 each. This is an architectural teaching scenario, not an instruction to edit an employer’s production data.
Try the activity before reading its reference. Keep your sources, commands and assumptions with your work. Companion activities are unsaved self-practice and do not award a certificate or change lesson progress.