05 · Architecture · Review
Working through once does not mean this document may enter main
The tech lead does not redraw module boundaries. This role stops a commit that has gone out of bound: a list writing inventory directly, an integration module changing a balance. A demo that works is not enough to enter main.
Dev: Change a quantity on the to-do list and save. Inventory matches at once. The demo is fast.
Tech lead: The list is a read model. Who allowed it to issue a command? An out-of-bound commit does not merge yet.
The tech lead holds an engineering bar, not a schedule slogan
The Senior architect wrote the boundary. The tech lead makes sure the code has not crossed it, and does not draw another module diagram. The job turns review into a gate: which module-owned data this command changed, and what rolls back on failure. If those two sentences cannot be written, it does not get sign-off because Friday needs a demo. The demo can be shown to the customer on a branch. Main only takes a version that is not out of bound. This role splits “it runs” from “it can be delivered.” If the project manager needs a demo, that uses branch time. It does not borrow quality from main.
The review list also has idempotency, transactions, and privilege. Those are the floor, not the main experiment on this page. How the local transaction closes is for backend to prove. That the outside is posted only once is for integration to prove. The tech lead looks for a shortcut: a query API that writes, an integration module that changes a balance directly, a frontend that posts the stock balance back in the request body. Style can be logged as debt. Out-of-bound cannot.
How review is run so it does not become theater
He requires the author to write three lines first: which data this command changes, which module owns that data, and what rolls back on failure. A request that cannot write three lines does not enter formal review, so the room is not used to invent the answer. Review outcomes are only pass, change and come back, or reject and redo. There is no “merge first and patch later.” A boundary merged first and patched later is already a second set of books in production.
The tech lead also keeps the team from being pierced by a verbal request. When business goes straight to development for a button, this role requires it back through product and change. It is not added privately on a branch. A privately added button, even a useful one, distorts the test scope. He aligns with the QA lead: an API that has not passed review does not enter test.
The commit where a list page wrote inventory directly
One merge request let inline save on the to-do list UPDATE the inventory balance directly. The author proved that after save the number matched at once. The tech lead pointed out: the inventory module is the owner; the list should only submit an intent to “change quantity.” The same week, a piece of integration code changed the local balance directly after a successful write-back, without going through an inventory command. Both patches read clean. Both were out of bound. The request was sent back: the list only sends a command; integration only publishes a confirmed event; the balance is still updated by the inventory module.
That day's demo moved to the next afternoon. The project manager told the customer “the write is still out of bound,” not “development is slow.” That sentence is cheaper than going live with a second set of books. Main must be able to be pulled up in the test environment at any moment, without a manual table change on the author's machine. A merge that needs a manual step is written as a script before it is looked at again. Memory is not a release note. Cleanliness is not the first bar of this gate. Whether it is out of bound is. Idempotency and transactions remain two lines on the floor list, proved by backend and the database with their own evidence. The main experiment on this page is whether someone took a shortcut and let a read model issue a command. If the author asks to merge so the customer can “see the effect first, then split it,” the tech lead only allows that commit to stay on the demo branch. List save on main must still be a command. It must not enter carrying an UPDATE of the inventory balance. The review record states the return reason as out-of-bound, not style.