# Senior platform add-ons playbook

Compressed reference for the senior-only platform-add-ons extension. Pair with [cheat-sheet.md](./cheat-sheet.md), [GLOSSARY.md](./GLOSSARY.md), and [repo-toolkit-map.md](./repo-toolkit-map.md).

## The senior shift
Intermediate understanding is: "I know the repo’s migrations, lint/hooks, secrets, build model, reliability tools, delivery paths, and CronJob/runtime setup."

Senior understanding is: "I can explain which of those safeguards are hard or soft, where guarantees are real or partial, what blast radius each choice creates, and how to review the platform honestly rather than optimistically."

## Six senior lenses
1. **Fix-forward is a philosophy** — recovery motion matters as much as migration tooling.
2. **Presence is not enforcement** — configured checks and true guardrails are different things.
3. **Secrets are boundary systems** — explain who can decrypt what, where plaintext appears, and what compromise domain that creates.
4. **Reliability is layered and uneven** — outbox, compensation, retries, dedup, and swallowed failures do not all provide the same guarantee level.
5. **Runtime shape changes semantics** — CronJobs, one-off jobs, and long-running consumer deployments are different operational beasts.
6. **Review is about truthfulness** — ask what failure is being defended against and how strong that defense really is.

## Senior review checklist
- Is this migration plan safe in a fix-forward world, or is it implicitly assuming rollback exists?
- Is this safety check actually enforced on product code, or mostly expressing intent?
- Where does decryption happen, and what blast radius follows if that boundary is compromised?
- Which delivery claims are guaranteed, which are best-effort, and which risks are consciously accepted?
- Does this runtime description distinguish CronJobs, one-off jobs, and long-running consumers clearly?
- Is the platform story honest about imperfections, or inflated by optimistic wording?

## Interview answer shapes
### Why can a fix-forward migration model be defensible?
Because live rollback is often messy in real systems, so the team chooses one predictable recovery motion: ship a corrective forward migration, with stronger review and additive-change discipline.

### What makes a check a real guardrail?
It must reliably run in the right path and be able to block a bad change, not just exist in configuration or source code.

### Why is “we use SOPS” incomplete?
Because the real operational question is where decryption happens, who can unwrap keys, and what compromise domain that creates.

### What is the honest difference between outbox and publish-after-commit?
Outbox closes the dual-write gap with stronger durability; publish-after-commit is cheaper and faster but accepts a crash gap managed through compensation or caller retry.

### What is the real job of a senior platform reviewer?
To ask what exact failure the add-on protects against, how strong that protection really is, and where false confidence or hidden operational risk still remains.