Freeze the evidence boundary first
This curriculum teaches the durable host workflow around reviewed Mappls surfaces. It does not manufacture provider endpoints, callbacks, resource states, entitlement, or completion evidence.
Model the lifecycle before the UI
Turn the device release blueprint into an explicit aggregate boundary owned by the application.
Build
Prove before continuing
Implement every command and event pair
Make intent, actor authority, allowed source state, committed state, and emitted fact reviewable together.
Build
Prove before continuing
Persist restart-safe records
Separate business identity, provider evidence, command receipts, immutable facts, audit, and downstream delivery.
Build
Prove before continuing
Make concurrency and replay deterministic
Apply optimistic expected versions and aggregate-scoped idempotency before executing effects.
Build
Prove before continuing
Control effects and unknown outcomes
Commit outbox intent atomically, execute effects outside the transaction, and reconcile ambiguous results.
Build
Prove before continuing
Run all hostile fixture scenarios
Exercise the success path plus replay, concurrency, state, and response-loss failures without an account.
Build
Prove before continuing
Trace the Offline Release Control capstone
Follow the maintained source through domain rules, adapter seam, repository transaction, HTTP boundary, UI evidence, and restart test.
Build
Prove before continuing
Qualify the real integration boundary
Replace only reviewed adapter seams and collect independent production evidence without weakening application invariants.
Build
Prove before continuing
Application-owned reliability scaffolds
The aggregate and SQL examples implement host truth; the fixture clients call the credential-free Journey Lab. Replace only the separately reviewed provider adapter seam.
type State = "manufactured" | "activated" | "installed" | "operational" | "updating" | "recovering" | "retired";
type CommandName = "register_device" | "activate" | "stage_base_release" | "qualify" | "start_update" | "rollback" | "retire";
type Command = {
name: CommandName;
aggregateId: string;
expectedVersion: number;
idempotencyKey: string;
};
const transitions = {
"register_device": { from: [null], to: "manufactured", event: "device.registered" },
"activate": { from: ["manufactured"], to: "activated", event: "license.activated" },
"stage_base_release": { from: ["activated"], to: "installed", event: "release.installed" },
"qualify": { from: ["installed", "recovering"], to: "operational", event: "release.qualified" },
"start_update": { from: ["operational"], to: "updating", event: "release.update_started" },
"rollback": { from: ["updating", "operational"], to: "recovering", event: "release.rollback_started" },
"retire": { from: ["manufactured", "activated", "installed", "operational", "recovering"], to: "retired", event: "device.retired" },
} as const;
export function decide(current: { state: State | null; version: number }, command: Command) {
const rule = transitions[command.name];
if (command.expectedVersion !== current.version) throw new Error("version_conflict");
if (!rule.from.includes(current.state as never)) throw new Error("invalid_transition");
return {
state: rule.to as State,
version: current.version + 1,
event: rule.event,
idempotencyKey: command.idempotencyKey,
};
}
// Persist the result, immutable event, audit row, and outbox intent atomically.
// Store the first result by idempotencyKey before executing another effect.Exit with reviewable evidence
Workshop completion proves an application-owned reliability design only. Production still requires issued entitlement, exact adapter contract tests, regional and quota validation, security/privacy review, operational drills, and independent release approval.
Trace every external claim to an indexed source
Break the application before connecting the provider.
Run all five hostile scenarios and the maintained capstone test suite. Then qualify the exact provider seam under independently reviewed non-production entitlement.