Zulu

The prototype left separation to the database's row policies, and six of its twelve meeting operations matched on an id alone. One of its four memory searches read across workspaces.

One workspace walled off from the next

Zulu's workspace boundary now lives in the application, where the unsafe query cannot be written by accident. Every read and write goes through one object that adds the workspace to the condition itself, and bypassing it takes a named call that can be found and reviewed. 67 of the 70 tables carry their workspace directly. The other three sit above any one workspace: the workspaces table itself; users, who can belong to several; and incoming payment events, recorded before their workspace is known. A test lists the 67 from the schema, fills two workspaces with the same data and proves one cannot read, change or delete the other's rows. A foreign id answers not found.

Captions reach every browser in a call. The prototype let the browsers elect a writer among themselves, so two could write every sentence, one bad id silenced the room, and one dropped message deleted a line for everyone.

A transcript written once, without holes

Zulu's server elects the writer under a lock and gives it a lease that expires, so if the writer's laptop closes, the next person to ask takes over with no tiebreak. Each line has a natural key of speaker, time and text, which makes a retry after a network drop safe: a duplicate cannot land. Lines carry the speaker's name rather than six digits of a hash, and a late joiner is shown the latest lines, not the first ones.

A booking page that offers a time its host cannot keep puts a stranger in front of an empty room.

Booking times that survive daylight saving

Zulu does all its booking clock arithmetic in PostgreSQL, which carries the time-zone database. Days are generated as calendar dates, never as 24-hour steps, so a 23- or 25-hour day can neither skip nor repeat a slot. The host's preview and the visitor's page run the same query, which subtracts bookings, live holds and the host's own meetings, and applies buffers, minimum notice and the daily limit when it is read.

Two people can reach for the same half hour at once, and the prototype's booking check never consulted the schedule: a request for 03:00 on a Sunday was accepted.

Two visitors, one slot, one booking

In Zulu, holding a slot takes a transaction lock keyed on the host's schedule rather than the instant, so overlapping times on sibling pages queue behind each other too. Inside it the whole availability check runs again for that one instant before a ten-minute hold is written, and abandoned holds are reclaimed on the next attempt. A unique index lets only one confirmed booking exist per page and start time, whatever the application does.

Guest invites, booking links and recording URLs are credentials. Two of the prototype's signers fell back to a public key or a fixed string when a secret was missing, so every token they minted could be forged.

Links nobody can forge

Every signed link Zulu mints now comes from one signer, tested in one place. Keys live on a ring, so a new key signs while the old one still verifies and rotation is a window, not an outage. Links kept in the database are stored only as hashes, and a leaked guest link can be revoked before it expires. The server refuses to boot on a missing, short or placeholder secret, and names every one at once. The prototype's seven competing settings for the app's own address, each with its own fallback, became one, checked at boot.

The prototype's instant booking confirmations were queue rows drained by a job nobody ran, and saving a weekly schedule deleted the old hours before writing the new ones, outside a transaction.

Saves that finish, emails that arrive

Zulu sends a confirmation as soon as the booking commits, and a mail outage cannot roll back an appointment that already exists. A schedule's week is replaced in one transaction, so a failed save leaves the old hours standing rather than an empty calendar. The background-jobs service checks at boot that it serves no public routes, so an unwatched second copy of the API cannot appear by accident.