Production-Grade Is a Checklist, Not a Compliment
What separates a system a business runs on from a demo that works when everyone behaves: invariants in the database, money in fixed precision, and failure that announces itself.
"Production-grade" gets used as a compliment. It is not a compliment. It is a checklist, and most internal tools fail it quietly for years before the failure becomes visible in the numbers.
Here is the checklist as it appears in a system we built for a field and phone sales brokerage: the operational backend the company runs its entire day on, from GPS-verified field activity to the payout engine that decides what people get paid.
The database is the enforcer
Application code asks politely. The database enforces. In this build, 48 purpose-built indexes (partial, geospatial, JSON, trigram) serve the read paths, and triggers and functions make critical invariants impossible to violate rather than merely discouraged. If a state transition is illegal, it does not happen, no matter which of the 98 endpoints attempted it.
Money is never a float
Every monetary value is fixed-precision. Every timestamp is timezone-aware. These two sentences sound trivial and their absence is responsible for a remarkable share of the reconciliation pain we get hired to fix. The payout engine runs 38 rules across four payout structures with rates from 45 to 120 percent, and reconciles statements into one of eight explicit states with a one-dollar default tolerance. Explicit states, explicit tolerance: ambiguity is a design decision, so make it on purpose.
Guardrails at the door, not in the postmortem
The duplicate checker that guards deal intake runs read-only with a hard 450 millisecond statement timeout: it can reject bad entries, and it can never take the pipeline down. External integrations are throttled to be polite citizens of the client's other systems (one CRM sync self-limits to 90 requests per 10 seconds). Heavy work lives on four background job queues with separate worker processes, off the request path.
Failure announces itself
Authentication uses short-lived tokens with rotating refresh; legacy password hashes upgrade themselves on login. Jobs that fail do so loudly, into queues someone owns. A prototype that needs babysitting is still manual work, just relocated.
The lesson
None of this is exotic. That is the point. Production-grade is not brilliance, it is discipline applied at every layer where a shortcut would have been invisible for the first six months. If your operation runs on a tool that works when everyone behaves, you do not have a system, you have a habit.