The Northwind Operations Reference
How an order moves through the stations, what breaks it, and how each break is repaired.
Audience. Operations engineers and team leads who keep the Thursday promise.
This edition follows the stations as they run in November 2026; every number comes from the October incident reports.
Contents
Preface
Every order Northwind takes comes with a promise printed at checkout: delivered by Thursday. This reference explains how an order keeps that promise, station by station, and what the teams do when a station fails.
Read Chapter 1 first; the other chapters stand on their own. Terms in the text such as idempotency key are collected in the index.
The order journey
1.1Five stations#
An order passes five stations in a fixed order: checkout, payment, warehouse, courier and tracking. Figure 1.1 shows them, and Table 1.1 names their owners.
| Station | Owner | Answers within |
|---|---|---|
| Checkout | Web team | 300 ms |
| Payment | Payments team | 15 s (the bank's limit) |
| Warehouse | Operations | the next pick wave |
| Courier | Logistics partner | the route's departure |
Table 1.1 · Who owns each station
1.2Hand-offs#
A station hands the order on by writing an event; the next station reads it. No station calls another directly, so a slow station never slows the one before it. The events are kept for thirty days.
1.3What the customer sees#
The tracking page reads the same events. It shows one tile per station and the promise under them; see Section 2.1.
Promises and clocks
2.1The promise tile#
The promise is computed when the order is placed and recomputed after every station: computed at checkout. It only moves later when a station is late; it never moves earlier.
2.2Cut-off times#
| Order placed before | Leaves on | Delivered |
|---|---|---|
| Monday 23:59 | Wednesday's first wave | Thursday |
| Tuesday 07:10 (packed) | Wednesday's first wave | Thursday |
| Tuesday 07:11 or later | Thursday | Friday |
Table 2.1 · Cut-off times for a Thursday promise
The second row is the one warehouse staff watch: an order packed by 07:10 on Tuesday still makes Wednesday's first wave (Table 2.1).
Payments that time out
3.1The declines were timeouts#
Nine in ten night-time declines were the bank's fraud check timing out, not a decision about the card. A timeout is not a decline: it is a bank that has not answered yet.
3.2One idempotent retry#
var key = order.id();
var result = bank.authorize(card, amount, key);
if (result.isTimeout()) {
sleep(Duration.ofSeconds(30));
result = bank.authorize(card, amount, key);
}
return result;
- The order id is the idempotency key: a retry is the same request.
- One retry only, thirty seconds later.
The retry changes nothing for the stations after payment; see Section 1.2. The retry is logged with both attempts.
Glossary
| Hand-off | An event one station writes and the next one reads. |
| Idempotency key | The order id, sent with every payment call, so the bank never charges twice. |
| Promise | The delivery day printed at checkout and shown on the tracking page. |
| Wave | A group of vans that leave the warehouse together. |
The glossary is also in the index.
Index
10 terms. Each number is a section: 2.3 is chapter 2, section 3.