Design Shopify's Payment Resilience & Black Friday Flash Sale Architecture

1. Problem Statement & Scope Clarification

System Mission

Design Shopify's high-concurrency payment resilience and flash sale checkout infrastructure. The platform powers over $1\text{M}+$ global merchants and processes tens of billions in Gross Merchandise Volume (GMV) during Black Friday / Cyber Monday (BFCM). The system must handle $100\times$ sudden traffic spikes on high-demand celebrity merchant flash sales (e.g., Gymshark, Kylie Cosmetics), guarantee absolute zero inventory overselling, and maintain $100\%$ payment durability despite flaky third-party Payment Service Provider (PSP) gateway timeouts.

Functional Requirements

1. Virtual Waiting Room & Fair Queuing (QueueCheckout): Queue and throttle surges of $100,000\text{ buyers/minute}$ waiting to check out without crashing core databases.
2. Atomic Inventory Reservation (HoldInventory): Reserve stock with a temporary 10-minute lock; automatically release if the buyer abandons checkout.
3. Idempotent Multi-PSP Payment Processing (ChargePaymentIntent): Coordinate transactions across Stripe, PayPal, and Adyen with automated fallback routing and zero double-charging.
4. Order State Machine Orchestration: Ensure transactions commit consistently across inventory, billing, tax, and fulfillment domains.

Non-Functional Requirements (SLAs & SLOs)

• High Availability: $99.999\%$ uptime during BFCM peak week.
• Zero Overselling Invariant: An item with $100$ units in stock MUST NOT be sold $101$ times under any concurrency level.
• Payment Durability: $100\%$ audit trail durability ($0\%$ lost payments).

2. Capacity & Scale Estimation (Back-of-the-Envelope Math)

Flash Sale Peak Scale

• Global Merchant Fleet: $1,000,000+$ storefronts.
• BFCM Peak Platform Volume: $100,000\text{ Peak Checkouts/Minute} \approx \mathbf{1,667\text{ Checkouts/sec}}$.
• Flash Sale Ingress Surges: A single merchant drop generates up to $50,000\text{ QPS}$ against a single product SKU.
• Database Write Invariant: A single MySQL primary row (product_id = 9981) can sustain at most $\approx 2,000\text{ pessimistic row locks/sec}$ before lock contention collapses the engine.

3. High-Level Architecture & Component Mapping

Interactive Architecture Diagram
100%Fit100%
Synthesizing vector architecture diagram...