# Elvis Sautet > Elvis Sautet is a Node.js and full stack engineer in Nairobi, Kenya. He is the sole engineer on a multi-tenant school management platform used daily by 112 schools, covering roughly 50,400 learners and 86,184 contactable parents and guardians. Every figure on this site has its arithmetic published at /about#how-i-count. Nothing on the site describes the internal architecture of any client system, by policy. Pages state their answer in the first forty words. ## Work Case studies. Problem, constraint, the wrong turn taken first, decision, outcome. - [A dealership platform the owner could run without me](https://elvissautet.com/work/charlies-motors): A public inventory site with real search and real leads, built so the owner could run it alone. Handover is a design requirement, not a document. - [Early work, kept on the site deliberately](https://elvissautet.com/work/early-work): Small business sites from the start of my career. They are here on purpose, because the trajectory is more informative than any single project. - [Sole engineer on a school platform used by 112 schools](https://elvissautet.com/work/enaton-school-platform): Zero customers to 112 schools, one engineer. What being the only person who can fix it forces you to design differently, and what it costs. - [When one number has four owners, three of them are wrong](https://elvissautet.com/work/financial-correctness): Four subsystems each calculated the same financial figure and three disagreed. Making them agree failed. Removing their right to an opinion worked. - [Screens for people with a queue standing in front of them](https://elvissautet.com/work/operations-interface): Dense operational software used all day by staff under pressure. Where clarity beats beauty, where it does not, and how the two get measured. - [The second dealership, and what I reused rather than rebuilt](https://elvissautet.com/work/lamad-motors): The second build of a similar thing is where you find out which decisions were principles and which were accidents that happened to work once. - [A scheduler holding ten million future jobs on flat memory](https://elvissautet.com/work/scheduling-and-automation): Every pending job in Redis is the default design and it does not survive scale. Three tier time routing cut memory by about ninety percent. - [An internet provider site where the first question is coverage](https://elvissautet.com/work/tabasamu-fibre): Every visitor arrives with one question, can I get this at my address. Answering it in the first screen changed what the whole site was for. ## Engines How to design engines that run unattended. Patterns, not client implementations. - [How to design a notification engine with one ledger and real lanes](https://elvissautet.com/engines/designing-a-notification-engine): Many channels, one message ledger, and priority lanes so a one time password never waits behind a bulk send of forty thousand messages. - [How to design a reconciliation engine that assumes the worker died](https://elvissautet.com/engines/designing-a-reconciliation-engine): Money arrives over a network you do not control, twice, out of order, or not at all. A reconciler is the component that assumes all three happened at once. - [How to design a rules engine, and when not to build one](https://elvissautet.com/engines/designing-a-rules-engine): A rules engine is how you stop shipping a release for every policy change. It is also how you build a programming language by accident. Here is the line. - [How to design an approval engine that survives an audit](https://elvissautet.com/engines/designing-an-approval-engine): Permissions decide who gets the screen. They must never decide who has authority. Here is the separation, and the guarantees an engine owes you. - [How to design a scheduler engine that holds ten million future jobs](https://elvissautet.com/engines/designing-a-scheduler-engine): Most schedulers put every pending job in Redis and fall over. Three tier time routing keeps memory flat while the table grows into the millions. ## Interface Interface craft for dense operational software used all day. - [Designing dense screens for people who use them all day](https://elvissautet.com/interface/designing-dense-operational-screens): Software used all day by somebody with a queue in front of them obeys different rules from software used once a week. Whitespace is not always kindness. - [Forms that do not lose work, and errors people can act on](https://elvissautet.com/interface/forms-that-do-not-lose-work): Surface every error in three places, validate when it helps rather than when it is easy, and never punish somebody for a slow network they did not choose. - [Tables people actually use, and the four rules behind them](https://elvissautet.com/interface/tables-people-actually-use): One search per table, search where the data lives, keep the previous page while the next loads, and let the table own its empty state. Four rules. - [Loading, empty and error, the three states every demo skips](https://elvissautet.com/interface/loading-empty-and-error-states): A demo shows the filled state. Real users meet the other three on day one, and those are the ones that decide whether a product feels solid or broken. ## Solutions Direct answers to specific backend problems, each backed by production work. - [How to build an approval workflow an auditor cannot break](https://elvissautet.com/solutions/approval-workflows-that-survive-audit): Snapshot the policy at filing, make the decision log the truth, fingerprint the intent, and never let a timeout count as agreement. - [How to fix a queue that is slower after you added workers](https://elvissautet.com/solutions/background-jobs-and-queue-throughput): Concurrency only helps when the workers are waiting. When they are competing, more workers buy contention. Here is how to tell which one you have. - [How to build for connections that drop, on devices that are old](https://elvissautet.com/solutions/building-for-low-bandwidth-markets): The primary answer must survive the worst connection your users have. Everything visual is an enhancement on top of it, and the ordering is not negotiable. - [Database per tenant against a shared schema, decided properly](https://elvissautet.com/solutions/database-per-tenant-vs-shared-schema): The choice is not about isolation, both can be safe. It is about how many tenants you will have and what a migration across all of them costs you. - [How to move off a legacy system without a big bang](https://elvissautet.com/solutions/legacy-system-migration): Run both, compare in production, and move traffic one surface at a time. The comparison log is the most valuable artefact in the whole project. - [How to make a payment webhook safe to receive twice](https://elvissautet.com/solutions/idempotent-payment-webhooks): A step by step build of a webhook that survives retries, crashes and duplicates, with the failure each step exists to prevent and how to verify it. - [How to build multi-tenant SaaS where isolation cannot be forgotten](https://elvissautet.com/solutions/multi-tenant-saas-architecture): Isolation as a structural property rather than a filter somebody remembers. Six layers, in the order to build them, with the test that proves each one. - [How to make a system explain itself when you are the only one asking](https://elvissautet.com/solutions/observability-when-you-are-the-only-engineer): Not dashboards. Four questions the system must answer without you reading logs, and the cheapest way to make each one answerable. - [How to make a slow Postgres query fast, in order](https://elvissautet.com/solutions/postgres-query-and-index-tuning): Read the plan before changing anything. Then fix the access path, then the join, then the index, and measure the tail rather than the average. - [How to add realtime without four sockets per browser tab](https://elvissautet.com/solutions/realtime-without-websocket-sprawl): One connection per application, events multiplexed by type, and a resume token so a reconnect does not lose the events that happened while you were away. - [How to build role based access that survives five years](https://elvissautet.com/solutions/role-based-access-that-scales): Permissions on actions rather than roles, checked in one place, with the interface derived from the same source. The four rules that stop it rotting. - [How to ship alone without the wheels coming off](https://elvissautet.com/solutions/shipping-alone-without-a-team): With no reviewer, correctness has to be structural rather than checked. Six practices that replace the things a team does for you. - [How to make a site that ranks, verified against the output](https://elvissautet.com/solutions/ssr-seo-and-core-web-vitals): Read the served HTML rather than the source, make the invariants structural, and fail the build on the mistakes that quietly cost you every ranking. - [When to build an API and when to build the web app](https://elvissautet.com/solutions/when-to-build-an-api-vs-a-web-app): Building an API first for a single web client is a cost with no buyer. Here is the test for whether a second consumer is real or imagined. - [How to change a database schema while people are using it](https://elvissautet.com/solutions/zero-downtime-migrations): The expand, migrate, contract sequence, what each phase must never do, and why the dangerous migration is the one that looks trivial. ## Decisions Technical forks, each committed to, with the cost of the choice stated. - [Astro against Next for content sites, dogfooded on this one](https://elvissautet.com/decisions/astro-vs-nextjs-for-content-sites): This site is the argument. Zero JavaScript on every content page, a canonical that cannot be got wrong, and a build that fails on SEO mistakes. - [Postgres against Mongo for multi-tenant systems](https://elvissautet.com/decisions/postgres-vs-mongodb-for-multi-tenant): The question is rarely the data model. It is whether the system has money in it, because money means constraints, and constraints are what Postgres is for. - [Queues against cron, and when cron is still the right answer](https://elvissautet.com/decisions/queues-vs-cron): Cron is not obsolete and a queue is not always an upgrade. The line is whether you need to know what happened, and whether a failure can be retried. - [Server sent events against WebSockets, and why I usually pick SSE](https://elvissautet.com/decisions/sse-vs-websockets): Most realtime features only need the server to talk to the browser. That is one direction, and SSE does it over plain HTTP with no new infrastructure. ## Roles The same evidence framed for a specific job, with a scenario from that role. - [Backend engineer, for the parts that have to be correct](https://elvissautet.com/roles/backend-engineer): Money, state and scheduled work. The parts of a system where being approximately right is the same as being wrong, and where the fix has to be structural. - [Full stack engineer who owns the feature, not a layer](https://elvissautet.com/roles/full-stack-engineer): One person from the query to the screen removes the handoff where most product time is actually lost. Six years doing exactly that. - [Product engineer, for software people use all day](https://elvissautet.com/roles/product-engineer): Users report symptoms in the vocabulary of speed. The system is slow usually means the workflow is long, and telling those apart is most of the job. - [Remote engineer on East Africa Time, and why that overlap works](https://elvissautet.com/roles/remote-engineer-eat-timezone): Nairobi is UTC plus three. That overlaps a full European working day and most of a US morning, which is unusually good coverage for one hire. - [Senior Node.js engineer, six years, all of it in production](https://elvissautet.com/roles/senior-nodejs-engineer): Six years of Node in production, currently sole engineer on a platform used by 112 schools. Every requirement answered by the system where I met it. - [Platform engineer for multi-tenant SaaS](https://elvissautet.com/roles/saas-platform-engineer): Tenant isolation is the one invariant that cannot be got wrong, because getting it wrong is not a bug, it is an incident with legal consequences. - [Technical lead, for a team that needs decisions made](https://elvissautet.com/roles/technical-lead): Leading is mostly deciding under incomplete information and writing down why, so the decision can be revisited rather than relitigated every quarter. ## Writing Longer notes from production. - [At least once is the only honest guarantee](https://elvissautet.com/writing/at-least-once-is-the-only-honest-guarantee): Nobody can sell you exactly once across a network. Stop trying to buy it and make running twice harmless, which is a problem you can actually solve. - [Dense screens are a different craft](https://elvissautet.com/writing/dense-screens-are-a-different-craft): I made an operational screen prettier and it tested worse. Whitespace pushed content below the fold and added a scroll to a constant task. - [Migrations while people are using it](https://elvissautet.com/writing/migrations-while-people-are-using-it): The migration that took the system down was one line and looked completely safe. Here is what I actually check now, before running anything. - [Measure the tail, not the average](https://elvissautet.com/writing/measuring-the-tail-not-the-average): The average said the page was fast. One request in twenty took two seconds, every day, and nobody reported it because complaining requires a comparison. - [Read the output, not the source](https://elvissautet.com/writing/reading-the-output-not-the-source): The source is what somebody intended. The output is what is true. Stuck debugging is usually time spent in the first when the answer is in the second. - [Snapshot the approver, not the role](https://elvissautet.com/writing/snapshot-the-approver): An auditor asked who was allowed to approve a payment in March. The system answered with who is allowed today, which is a different question entirely. - [The alias you forgot](https://elvissautet.com/writing/the-alias-you-forgot): Soft deletes are convenient until you write raw SQL. One join without the predicate and deleted records reappear in a report somebody will sign. - [The two minute rule that decides whether a site survives](https://elvissautet.com/writing/the-two-minute-rule-for-client-work): Most small business sites die the same way. If a routine update cannot be done on a phone in two minutes, the content goes stale and starts doing harm. - [Three correct fixes that all failed](https://elvissautet.com/writing/three-correct-fixes-that-all-failed): A site ranked as one page. Three commits added the right tag and changed nothing, because everybody read the source and the truth was in the output. - [What I write down, and why](https://elvissautet.com/writing/what-i-write-down-and-why): Two documents, doing different jobs. A plan that tracks reality while work is in flight, and a handoff that records what surprised me once it ships. - [When one number has four owners](https://elvissautet.com/writing/when-one-number-has-four-owners): Four subsystems each computed the same balance and three disagreed. I spent two weeks making them agree, which held for a month. - [Why adding more workers made it slower](https://elvissautet.com/writing/why-more-workers-made-it-slower): I doubled the workers and throughput fell. The work was contention bound, so every additional worker was buying lock contention instead of capacity. ## Key pages - [How I work](https://elvissautet.com/how-i-work): the process behind unsupervised work. - [About](https://elvissautet.com/about): the arc, and the arithmetic behind every number. - [CV](https://elvissautet.com/cv): experience and skills, each answered by a system. - [Contact](https://elvissautet.com/contact): open to senior backend and full stack roles.