Backend Architecture
DI as a testing seam: fakes, mocks, and the boundary that matters
A team is proud of their OrderService test suite: 100% coverage, every dependency mocked, all green. Then a refactor that changes nothing about behavior — splitting one repository method into two — turns forty tests red. The tests were not checking that orders get placed. They were checking that repo.save was called exactly once with exactly these arguments. The seam DI gave them was real; they just pointed it at the wrong thing.
The seam is the payoff
Everything in this unit — constructor injection, the composition root, abstractions instead of new — pays off here. Because OrderService receives a PaymentGateway rather than constructing a StripeClient, a test can pass in a substitute. That substitute is a test double, and the injection point is the seam: the join where production wiring is swapped for test wiring. No seam, no isolated unit test. This is why “is it testable?” and “are the dependencies injected?” are nearly the same question.
Two doubles, opposite purposes
The word “mock” is used loosely for every substitute, but the distinction is the whole lesson:
- A stub / fake stands in for a dependency and provides state. A fake
UserRepositorybacked by an in-memoryMapbehaves like the real thing: you save a user, you can read it back. Your assertions check the result — the order ended up persisted, the returned total is correct. - A mock is programmed with expectations about calls. It asserts that
payment.charge(amount)was called once with this argument. Your assertions check the interaction, not the outcome.
The first verifies what the system did; the second verifies how it did it. Both are legitimate, but they fail differently — and the Hook is what happens when you use mocks for something a fake should have covered.
Classicist vs London, and why it matters
This is the classicist vs mockist (“London school”) split. Mockists mock every collaborator and assert interactions, so each unit is tested in total isolation. Classicists use real objects or fakes for collaborators they own, and reserve mocks for awkward boundaries. The practical consequence is coupling to structure: a fully-mocked test knows the exact call shape of its dependency, so any refactor that preserves behavior but changes call shape breaks the test. That is the forty-red-tests bug. Tests that assert through state survive refactors because they only care about the observable result.
Why this works
Why do interaction tests break on refactors that change nothing? Because a mock expectation is an assertion about the implementation. expect(repo.save).toHaveBeenCalledTimes(1) encodes “the production code calls save exactly once.” Split that into two saves inside a transaction — identical behavior, identical final state — and the expectation is now false even though nothing a user could observe changed. The test was measuring the code’s internal moves, not its output. State-based tests don’t have this problem: they ask “after running, is the order persisted and the total right?”, which is invariant under any refactor that preserves behavior. Mocks are not wrong — they are the right tool for verifying an effect you cannot observe through state, like “an email was sent” — but every mock is a small bet that this particular call shape is part of the contract.
Mock at the boundary, fake what you own
The discipline that avoids over-mocking: mock at the edges of your system, use real objects or fakes inside it. Code you own and control — domain services, your own repositories — can be wired together with real instances or in-memory fakes, so tests exercise actual collaboration. The things worth mocking are the boundaries you do not control or cannot afford in a test: the payment gateway, the email sender, the clock, the third-party HTTP call. These are exactly the dependencies where you want to assert “we called Stripe with this amount” because the call itself is the externally-visible effect. The seam is most valuable precisely at the system boundary — which is also where DI matters most.
Over-mocking is a design smell
When a unit test needs ten mocks to construct the subject, the test is not the problem — the design is. A class that requires ten collaborators is doing too much, and the painful test is the messenger. The reflex of a senior engineer is to read test pain as feedback about coupling, not as a reason to reach for more mocking machinery. Hard-to-test usually means hard-to-change.
| Double | Provides | You assert | Breaks on |
|---|---|---|---|
| Fake / stub | Realistic state | The result/outcome | Behavior change only |
| Mock | Recorded expectations | The interaction (calls) | Any call-shape change |
| Real object | Actual behavior | The result/outcome | Behavior change only |
A behavior-preserving refactor splits one `repo.save()` into two saves inside a transaction, and dozens of tests go red. What does this reveal about those tests?
Which dependency is the best candidate to replace with a mock that asserts the call, rather than a fake that provides state?
A unit test needs ten mocks just to instantiate the class under test. What is the senior reading of this pain?
- 01What is the test seam, and how does DI create it?
- 02What is the difference between a fake/stub and a mock, and how do they fail differently?
- 03What is the 'mock at the boundary, fake what you own' rule and why does over-mocking signal a design problem?
The seam that dependency injection creates is the entire reason testability and injection are the same conversation: the injection point is where production wiring gives way to a test double. But “double” hides a fork. A fake or stub supplies realistic state and lets assertions check the outcome, so it only breaks when behavior truly changes; a mock records call expectations and asserts interactions, so it breaks on any refactor that alters call shape — the cause of a behavior-preserving change turning dozens of tests red. The classicist discipline keeps tests robust: mock the boundaries you do not own (payment, email, clock, external HTTP), where the call itself is the visible effect, and wire real objects or fakes for the code you control, asserting through state. And when a test needs ten mocks just to stand the subject up, the pain is the design talking — too many collaborators, too much responsibility. With the seam understood, the last lesson turns to what a real DI container does in production: resolution graphs, circular dependencies, eager startup, and when not to use one at all.
appears again in185
- Tasks, microtasks, and scheduler.yield()middle
- Timer accuracy, throttling, and idle workmiddle
- Node.js event loop: phases, nextTick, and loop lagsenior
- Rendering strategies: SSG, SSR, ISR, streaming, and hydrationjunior
- SSG, SSR, ISR, streaming, and RSC — how each worksmiddle
- Hydration cost: selective, progressive, islands, resumabilitymiddle
- Core Web Vitals: what LCP, INP, and CLS measurejunior
- LCP: four phases, one dominant costmiddle
- INP: input delay, processing, presentationmiddle
- Lab vs field: why the two disagree and how to use eachmiddle
- Metric tradeoffs, RUM attribution, and the CI+field loopsenior
- The full picture: URL to LCP to INP as a relay racejunior
- Eight layers traced: from the service worker to the second navigationmiddle
- Five canonical breaks: where production reliably diessenior
- The three-track method: reading traces and building a monitored systemsenior
- What an index is and how it speeds up queriesjunior
- The leading-column rule and composite index designmiddle
- Partial, expression, and covering indexesmiddle
- Index types: GIN, GiST, BRIN, Hash, Bloom, and HOT updatesmiddle
- Index-only scans, the Visibility Map, and INCLUDEsenior
- Production failure modes and the index audit playbooksenior
- Index design exercise: full-text search strategysenior
- EXPLAIN and execution plans: what the planner decides and whyjunior
- Scan types: Seq, Index, Bitmap, Index-Onlymiddle
- Join algorithms and the row-estimate cascademiddle
- pg_statistic, ANALYZE, and production observabilitymiddle
- Extended statistics: fixing correlated-column estimate failuressenior
- Plan cache, cost-constant tuning, and planner internalssenior
- Production failure modes and plan stabilitysenior
- Connection pools: amortising the cost of a Postgres backendjunior
- PgBouncer session, transaction, and statement modesmiddle
- Pool sizing: the (cores × 2) + spindles formula and the two-layer stackmiddle
- Pool exhaustion and idle-in-transaction: the 3 AM failure modemiddle
- Migrating to transaction mode: rollout playbook and PgBouncer 1.21 prepared statementsmiddle
- The Postgres process model and why raising max_connections degrades throughputsenior
- Pooler landscape 2026, serverless connection storms, and the full failure-mode taxonomysenior
- ADD COLUMN: instant in PG 11+ vs rewrite in older Postgresjunior
- The lock-queue failure mode: why instant DDL can freeze the databasemiddle
- Safe DDL patterns: NOT VALID, CONCURRENTLY, and unsafe-op fixesmiddle
- Migration failure taxonomy and production disciplinesenior
- Shard-key selection: hash, range, list, and directory strategiesmiddle
- Co-location and Citus: the invariant that makes sharding usablemiddle
- The hot-shard failure mode: detection, isolation, and durable policymiddle
- Online resharding, 2PC, and the operational cost of shardingsenior
- The seven acts: from CREATE TABLE to Citusjunior
- Acts 1–3 in depth: schema, indexes, and planner statisticsmiddle
- Acts 4–6 in depth: MVCC bloat, connection pooling, and safe migrationsmiddle
- Act 7 in depth: sharding, co-location, and the seven-tier tradeoff cascademiddle
- Observability, anti-patterns, and production triagesenior
- Bits on the wirejunior
- Latency mathmiddle
- Bufferbloat and congestionsenior
- The physical frontiersenior
- Sequence numbers and connection statemiddle
- Flow control and congestion controlmiddle
- BBR, production observability, and beyond TCPsenior
- CDN: putting content next doorjunior
- Anycast and GeoDNS: routing to the nearest edgemiddle
- Tiered cache and Cache-Controlmiddle
- Vary header and cache keysmiddle
- Stale-while-revalidate and cache stampedesenior
- Edge workers and edge-side compositionsenior
- CDN operations and observabilitysenior
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket vs SSE vs long-polling: choosing the right transportmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Balancing algorithms: round-robin to power-of-two-choicesmiddle
- L4 vs L7 load balancing and client-IP preservationmiddle
- Health checks, connection draining, and slow startmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- QUIC streams and head-of-line blockingjunior
- Integrated handshake and 1-RTTmiddle
- Connection IDs and network migrationmiddle
- Loss detection and congestion controlmiddle
- 0-RTT resumption and packet encryptionsenior
- Deployment tradeoffs and CPU costsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- The twelve layers: one URL, seven actorsjunior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Critical render path and Core Web Vitalsmiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- What the three signals are: logs, metrics, and tracesjunior
- Metrics and cardinality: the cost model of a time-series databasemiddle
- Logs and volume: the cost model of structured loggingmiddle
- Traces and sampling: the cost model of distributed tracingmiddle
- Join keys and exemplars: making the three signals composemiddle
- Observability 2.0: wide events and the cost shiftsenior
- Failure modes and engineering practice: cardinality budgets, PII, and samplingsenior
- Why structured logs exist: the diary vs the spreadsheetjunior
- The production log schema: fields every line must carrymiddle
- Log levels and alert routingmiddle
- Sampling strategies and log costmiddle
- PII redaction and log injectionsenior
- Trace context propagation in logssenior
- OTel Logs Data Model and audit logs as a subsystemsenior
- OTel signals, Semantic Conventions, and the OTLP wire formatmiddle
- Auto-instrumentation and manual spans: the 80/20 of OTelmiddle
- The OTel Collector: receivers, processors, exporters, and deployment patternsmiddle
- Sampling strategies: head, tail, and parent-basedmiddle
- Vendor neutrality, eBPF instrumentation, the Operator, and browser/serverless OTelsenior
- Operating the OTel Collector: reliability, version skew, failure modes, and governancesenior
- RED and USE: two checklists, one triage disciplinejunior
- Instrumenting RED in Prometheus: counters, histograms, and cardinality disciplinemiddle
- USE on Linux: CPU, memory, disk, network, and PSImiddle
- Golden signals, dashboard layout, and service mesh auto-REDmiddle
- Cardinality as a cost driver: labels, PII, exemplars, and samplingmiddle
- Native histograms, SLO tie-in, and production failure patternsmiddle
- Choosing SLIs and SLO targets: ratios, not feelingsmiddle
- Multi-window multi-burn-rate alerting: why AND beats ORmiddle
- Error budget policy, latency SLOs, and composite journeysmiddle
- Iceberg SLIs, composite SLO math, and SLA vs SLOsenior
- Flame graphs: reading the picture that shows where time goesjunior
- Sampling vs instrumentation profiling: why 99 Hz wins in productionmiddle
- Profile types: CPU, memory, off-CPU, mutex — which one to reach formiddle
- Continuous profiling: always-on flame graphs with eBPF and trace-id correlationmiddle
- How flame graphs are built from samples, and the production workflows that use themmiddle
- Linux perf, eBPF internals, PGO, and the limits of samplingsenior
- Profiling in production: security, war stories, OTel profiles, and the infrastructure designsenior
- The debugging funnel: SLO → RED → trace → profilejunior
- OTel architecture: one SDK, four signals, one wire formatmiddle
- Cost discipline: keeping observability under 5% of infra spendmiddle
- Scale, security, and the ROI of observable systemssenior
- Why profile first: measure where time actually goesjunior
- Amdahl''''s law and self-time: the ceiling on every speedup you can shipmiddle
- The measurement loop: microbench, macrobench, prod profile, observer effectmiddle
- Reading flame graphs: shapes, per-language profilers, and the 60-second scanmiddle
- Statistical baselines: why one run is not a measurementmiddle
- Profiler history and microbenchmark pitfalls: Knuth to GWPsenior
- Hardware counters, cold-start profiles, and profile securitysenior
- Continuous profiling at scale: costs, CI gates, trace correlation, and anti-patternssenior
- What makes a hot path: symptom vs causejunior
- Five shapes of hotspot: CPU, alloc, cache, lock, syscallmiddle
- Reading parent and child chains: where to apply the fixmiddle
- JIT deopt, the fix-and-verify loop, and PR-time profilingmiddle
- Hardware counters and Intel TMA: sub-category diagnosissenior
- False sharing and native-bridge hot pathssenior
- Hot paths in production: security, tail latency, and tooling lineagesenior
- Memory hierarchy: why the same O(N) loop can be 17x slowerjunior
- Row-major vs column-major: access order and the 9x gapjunior
- Branch prediction and branchless codemiddle
- Hardware prefetcher, TLB, and memory-level parallelismsenior
- GC basics: what the runtime taxes you forjunior
- GC algorithms: generational, concurrent, and per-runtimemiddle
- GC tradeoffs: pause, throughput, heap — and object poolingmiddle
- GC tuning: pacing, heap shape, and allocation observabilitymiddle
- GC internals: tri-color invariant, write barriers, and per-runtime deep-divessenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- N+1: one logical operation, many round-tripsjunior
- Fix families: JOIN, IN, preload, and DataLoadermiddle
- Detecting N+1: query logs, APM traces, and CI gatesmiddle
- DataLoader: batching across resolver treesmiddle
- Cross-protocol N+1: HTTP fan-out and Redis MGETmiddle
- N+1 at scale: pool exhaustion, plan changes, and denormalisationsenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- What a bundle actually costs: download, parse, compile, executejunior
- Core Web Vitals: LCP, INP, and CLSmiddle
- Code splitting: route-level, component-level, vendor splittingmiddle
- Tree shaking and compression: removing what you don''''t usemiddle
- Third-party scripts: the silent budget killermiddle
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior