Three audiences with incompatible mental models had to share one system. Platform operators think in subscriptions, provisioning and uptime. School administrators think in academic sessions, staff and fees. Parents think about one child. The risk was never the feature list — it was letting the complexity of any one surface bleed into the other two.
Built a tenant provisioning pipeline with observable failure states, so a half-created school is visible rather than silently broken.
Split the product into a platform control plane (subscriptions, invoicing, audit log, health) and a school portal (academics, staff, attendance, LMS, exams, finance).
Used a transactional outbox for side effects, so a failed email or webhook cannot roll back an enrolment.
Enforced read-only mode on subscription lapse instead of cutting access — a school mid-term keeps its records.
Tracked academic-session dependencies explicitly, so an admin can see what is blocking a new session before opening it.
