Chapter 18 · Capstone: Design a Production-Ready Database

Test, Document, Defend, and Present the Design

Test, document, review, and present the finished database design using traceability, workload evidence, migration plans, quality checks, failure scenarios, and a structured design defense.

Beginner80–120 minutesTesting + documentation + defenseLast reviewed: August 2026

Learning outcomes

A professional database design is not complete when DDL runs successfully. It must be tested, documented, observable, evolvable, and defensible. This final lesson turns the capstone into a design package another engineering team could review and operate.

01

Test structural, transactional, security, and workload behavior.

02

Document schema semantics and operational decisions.

03

Build a traceable design-defense narrative.

04

Complete Course 02 with a production-readiness checklist.

Test categories

CategoryExamples
Schema integrityPK, FK, UNIQUE, CHECK
Business invariantsownership overlap, active primary assignment
Transactionsatomicity, retries, idempotency
Concurrencylost update, write skew, deadlock retry
Securitytenant isolation, least privilege
Performanceplans, p95/p99, write throughput
Migrationexpand/backfill/contract

Constraint tests

Attempt invalid writes:

model · example
duplicate tenant + work_order_numberPartUsage quantity = 0closed_at before opened_atAsset references Customer from another tenantnegative inventory

Tests should prove the database rejects or safely handles them.

Temporal tests

Validate:

  • adjacent ownership intervals allowed;
  • overlapping ownership rejected;
  • future ownership if supported;
  • backdated correction path;
  • current owner query.

Concurrency tests

Run concurrent sessions for:

model · example
consume last inventory unitassign two primary techniciansclose WorkOrder while another assignment startsedit same WorkOrder version twice

Idempotency tests

Replay the same request_id:

model · example
RecordPartUsage request 8c31...retry request 8c31...expected: one business effect

Tenant isolation tests

Create tenant A and tenant B with overlapping local IDs. Attempt cross-tenant:

  • reads;
  • updates;
  • FK creation;
  • search/projection access;
  • support/admin operations.

Performance tests

Use representative data volumes and distributions. Capture:

sql · example
EXPLAIN / execution planrows estimated vs actualrows scanned vs returnedp50 / p95 / p99throughputlock waitsI/Oindex size

Workload benchmark

Create a small benchmark suite:

model · example
Q1 WorkOrder lookupQ2 Asset historyQ3 Technician scheduleC1 Open WorkOrderC3 Record PartUsageR1 Monthly report

Use it before and after physical-design changes.

Migration tests

For every major schema change:

  1. apply to empty database;
  2. apply to production-like snapshot;
  3. run mixed old/new application versions;
  4. run backfill;
  5. validate;
  6. contract;
  7. test recovery/roll-forward.

Core documentation set

  • conceptual diagram;
  • logical ER diagram;
  • physical schema/DDL;
  • data dictionary;
  • business-rule catalogue;
  • access-pattern catalogue;
  • index rationale;
  • transaction catalogue;
  • security/tenant model;
  • migration strategy.

Data dictionary example

ColumnMeaningRule
work_order.status_codeCurrent operational stateMust reference allowed status
work_order.versionOptimistic concurrency versionIncrement on mutable update
asset_ownership.valid_toExclusive interval endNULL means current
part_usage.charged_unit_pricePrice charged at usage timeHistorical snapshot, non-negative

Decision log

sql · example
D-01 Use surrogate PKs + tenant-scoped alternate keys.D-02 Keep AssetOwnership temporal history.D-03 Keep DiagnosticCapture payload JSON with typed envelope.D-04 Use normalized OLTP source + derived list projection.D-05 Use expand-and-contract for destructive changes.

Record alternatives and reasons.

Traceability

Every important design choice should point backward to a requirement and forward to a test:

model · example
R-08 Tenant isolation -> tenant-aware keys/RLS -> TEST-SEC-004 cross-tenant FK rejected

Design defense structure

Present in this order:

  1. domain and scope;
  2. core entities and grain;
  3. key relationships/time semantics;
  4. normalization rationale;
  5. transaction/invariant design;
  6. indexes/workload evidence;
  7. security/governance;
  8. evolution strategy;
  9. known tradeoffs and future work.

Defend tradeoffs, not perfection

A strong design says:

model · example
We chose adjacency list because hierarchy moves are frequentand subtree reads are not a hot path.We chose JSON for diagnostic vendor payloads because shape varies,but promoted severity and timestamps for operational querying.

Tradeoffs make design credible.

Known limitations

Document:

  • analytics may require warehouse offload at higher scale;
  • global Part catalog may change tenant-local SKU assumptions;
  • advanced temporal overlap constraint syntax is DBMS-specific;
  • graph-like routing is outside the relational core;
  • billing/payment domain is intentionally incomplete.

Production-readiness checklist

  • Every table has defined grain.
  • Every important business key has a constraint.
  • Tenant ownership is enforceable.
  • Transactions preserve invariants.
  • Retries are idempotent.
  • Indexes map to named access patterns.
  • Sensitive data is minimized and scoped.
  • Audit/provenance exists for critical actions.
  • Derived data has freshness/rebuild rules.
  • Schema changes have compatible migration paths.
  • Retention/deletion and lineage are documented.
  • Tests cover invalid and concurrent behavior.

Final capstone exercise

Defend one decision

Why does the final design keep both normalized WorkOrder relationships and a denormalized WorkOrderListProjection?

Review answer

The normalized schema remains the authoritative source because it preserves ownership, dependencies, and integrity cleanly. The projection exists only to accelerate a measured hot read, has an explicit freshness SLA, is derived through events/outbox, and can be rebuilt. This separates correctness from read optimization.

Course synthesis

What you should now be able to do

After all 90 lessons, you should be able to:

  • turn narrative requirements into data models;
  • reason formally about keys and dependencies;
  • normalize without losing business meaning;
  • design transaction and concurrency boundaries;
  • choose indexes from workloads;
  • denormalize with explicit ownership;
  • model time, hierarchies, JSON, and flexible attributes;
  • evolve schemas safely;
  • design for tenant security and governance;
  • defend a production database design with evidence.

Course completion

You have completed Course 02 — Data Modeling and Database Design. The strongest next step is to implement the capstone in a real relational DBMS, generate representative data, run the concurrency and migration tests, inspect query plans, and iterate from measurement.

Final principle

A good database design is not merely normalized or fast. It preserves meaning, integrity, operability, security, and change over the full life of the system.

References

  • Ramez Elmasri and Shamkant B. Navathe, Fundamentals of Database Systems.
  • Martin Kleppmann, Designing Data-Intensive Applications.
  • Pramod Sadalage and Scott Ambler, Refactoring Databases.
  • Ralph Kimball and Margy Ross, The Data Warehouse Toolkit.
  • Bill Karwin, SQL Antipatterns.
  • DBMS vendor documentation for transactions, indexing, security, and online schema changes.

Keep knowledge open

Help the academy stay free and grow.

If these tutorials save you time, a small donation supports new lessons, technical review, diagrams, examples, and long-term maintenance.

ETHEthereum / ERC-20 only
0x716c4Ab160C4B66F31a28AE2448BfF68fc3a2ef0

Send only assets compatible with the Ethereum/ERC-20 network. Do not send TRC-20/TRON assets.