Joseph Swager

In OTP, a crash is the recovery strategy: the process dies, the supervisor restarts it, nobody writes defensive code. Joseph carried that instinct into ractor, where a ? inside an actor handler turns a transient database error into actor death. The catch is what dies with it: the auth actor kept every admin session in its own state, so one flaky query would have logged out every admin at once.

The fix was to split failures by kind. The Settings, Content, and Contact actors now send expected errors back through the reply port and keep crashing for actual bugs. Session expiry moved from lazy on-access checks to a send_interval timer that sweeps the map, and unknown usernames are verified against a dummy hash so login timing does not leak which accounts exist.

An OTP child spec is plain data, module plus arguments, so restarting a child is trivial. In ractor, re-spawning a crashed actor means storing a boxed async factory with exact Send + Sync + 'static bounds, or an enum that couples the supervisor to every child type. Worse, the re-spawned actor gets a new id, so every ActorRef held elsewhere goes stale.

Joseph made the call a senior engineer should make: the root supervisor terminates on any child panic and lets the process orchestrator restart the service in under a second. Same user impact as an in-process restart, without ChildSpec machinery or a name registry. LiveSession actors get the opposite policy. Each one owns a WebSocket write half that cannot be cloned or rebuilt, so restarting it is meaningless: the supervisor only logs, and htmx reconnects to spawn a fresh session.

Elixir lets any process receive any term, and Phoenix LiveView computes DOM diffs for you. In Rust, every ActorRef is typed on its message, and the htmx layer is hand-rolled, so both conveniences had to become explicit design decisions.

For PubSub, type erasure through ActorCell was on the table; Joseph kept it concretely typed to LiveSession messages because those are the only subscribers, and documented the swap path for later. Without process monitors, a failed cast is the only signal a subscriber died, so dead entries are evicted on the next publish. And since each Askama fragment type must match its hx-swap-oob target id by convention, a drift renders fine and silently updates nothing.

When the project pivoted to multi-tenant SaaS, Joseph did not thread a tenant_id filter through every query and hope nobody forgot one. He put Postgres row-level security on every tenant table, with a policy that reads the tenant from the transaction itself. A query that forgets the tenant returns nothing instead of another nonprofit's donors.

The detail that matters: the tenant is set per transaction with set_config('app.tenant_id', $1, true), not SET LOCAL, because SET LOCAL cannot take a bind parameter and string-formatting a tenant id into SQL is exactly the bug RLS exists to prevent. Transaction scope also means a pooled connection can never carry one tenant's context into the next request.

With the SaaS pivot, rendering moved into a separate publisher Lambda. Shortly after, Joseph reverted it to an in-process library crate. At nonprofit traffic, the split bought nothing and cost a custom Docker runtime, HMAC-signed transport, a second deploy pipeline, and dev/prod divergence. The render job types stayed as the function-call boundary, so a future re-split does not redo the type design.

Inside that boundary the pipeline got serious: tenants render in parallel on a JoinSet capped by a semaphore, assets go through a content-hashed manifest, uploads to object storage skip unchanged files by comparing the stored MD5 ETag from a HEAD request, Cache-Control is set per call through a CachePolicy, and the CDN cache is purged explicitly after publish.