Interview Bank

From Frontend Engineer to Agent Engineer in 30 Days

D13 Cron Scheduling (Central Scheduler → Stream Delivery) + Cost Metering (Token → USD Ledger, Usage Report)

• When a service runs multiple replicas, why not let each replica start its own cron? What would you do instead?服务部署了多个实例，定时任务为什么不能让每个实例各自起一个 cron？你会怎么做？

  Common in ChinaCommon overseasBasic#scheduling#distributed-systems#cost

  How to reason about it · think before answering

  1. The hinge is the phrase multiple replicas. Saying it would run twice is only the symptom; the interviewer wants the business and dollar consequence.
  2. Make the cost concrete: three replicas each running cron means the job fires three times, users get three identical pushes, and you pay for three model calls. The multiplier tracks replica count, so scaling to ten makes both the bill and the spam tenfold, with no alert firing, because from each process's own point of view it ran exactly once.
  3. Give the right shape: move the decision of who runs when into one central scheduler whose only job, on a cron match, is to publish a task message onto the bus; the execution side keeps using a consumer group so one message reaches exactly one consumer. The key insight is that a scheduled task is not a new execution path, it just swaps the user for a clock as the thing pressing the button, so the worker code stays untouched.
  4. Volunteer the obvious follow-up: doesn't the scheduler become a single point of failure? Two layers. It is stateless, so a crash costs you a few minutes of task delay; if you truly need HA, run two instances and dedupe on the idempotency key at publish time rather than bolting a distributed lock onto the scheduler.
  5. Close with sizing: a central scheduler plus a bus is enough at modest volume. At high volume, or when tasks have dependencies, teams move to a dedicated workflow scheduler with dependency graphs, retry policy and backfill, but the underlying central-decision-plus-queue shape is identical.
  6. Expect: the scheduler was down for 90 seconds and skipped a minute — now what? Replay the last N minutes on startup, one minute at a time. The idempotency key makes redundant publishes harmless, which is exactly what makes at-least-once plus idempotency the easy combination.

  分析过程 · 先想清楚再作答

  1. 题眼在「多个实例」四个字。只答「会重复执行」拿不到分，因为那是现象；面试官想看你能不能把现象换算成业务后果和钱。
  2. 先把重复的代价说具体：3 个副本各起 cron，同一个任务被执行 3 次，用户收到 3 份一样的推送，你付 3 份模型调用的钱。而且这个倍数会跟着副本数走——扩容到 10 个副本，账单和骚扰量一起变成十倍，却不会触发任何告警，因为从每个进程自己的视角看它只是老实地执行了一次。
  3. 然后给出正确的形状：把「谁该在什么时候被执行」收进一个中心调度器，它命中 cron 之后只做一件事——往消息总线投递一条任务消息；执行侧照旧靠消费组分摊，一条消息只会被一个消费者拿到。关键认知是「定时任务不是一种新的执行方式，只是把按按钮的人从用户换成了钟表」，所以执行侧一行代码都不用改。
  4. 接着主动补上「那调度器自己不就成单点了吗」——这是必被追问的一句。答案分两层：调度器无状态、崩了拉起来就行，短暂不可用的代价只是几分钟内的任务延迟；真要高可用就起两个实例，靠投递时的幂等键去重，而不是靠给调度器加分布式锁。
  5. 最后点一句选型：任务量不大时中心调度器加消息总线足够；量大或者任务本身有依赖关系时，业界会换成专门的调度框架（带任务依赖、重试策略、补数），但底层的「中心决定 + 队列分发」结构是一样的。
  6. 可以预期的追问：调度器崩溃 90 秒，中间跨过的那一分钟怎么办？答启动时回看最近 N 分钟逐分钟重放，因为有幂等键兜底，重复投递无害——这正是 at-least-once 加幂等这组搭配能成立的地方。

  Key points

  • Per-replica cron means the job runs N times: N duplicate pushes, N times the model spend, scaling linearly with replica count and silently
  • The right shape is a central scheduler that publishes one message to the bus on a cron match, with a consumer group ensuring exactly one worker picks it up
  • A scheduled task is not a new execution path — only the trigger changed from a user to a clock, so worker code is unchanged
  • The scheduler is stateless: restart on crash, and if you need HA run two and dedupe on the idempotency key rather than adding a distributed lock
  • Missed minutes are recovered by replaying the last N minutes at startup, which is safe because the idempotency key absorbs duplicates

  答题要点

  • 每个实例各自起 cron 等于同一个任务被执行 N 次：用户收到 N 份重复推送，模型调用花 N 倍的钱，倍数随副本数线性增长且不会触发告警
  • 正确形状是中心调度器命中 cron 后只往消息总线投递一条消息，执行侧靠消费组保证一条消息只被一个 Worker 拿到
  • 定时任务不是新的执行路径，只是把触发者从用户换成了钟表，所以 Worker 侧不需要任何改动
  • 调度器是无状态的，崩了拉起来即可；需要高可用就起两个实例靠投递时的幂等键去重，不要给它加分布式锁
  • 崩溃期间跨过的时间点靠启动时回看最近 N 分钟重放补上，幂等键保证重复投递无害
• How do you keep a cron job from being published or executed twice, and how should the idempotency key be built?怎么保证一个 cron 任务不会被重复投递或重复执行？幂等键应该怎么构造？

  Common in ChinaCommon overseasDeep dive#idempotency#scheduling#distributed-systems

  How to reason about it · think before answering

  1. The hinge is that publishing and executing are two separate problems. Most candidates answer half: either only the consumer group (which stops duplicate execution) or only a lock (which stops duplicate publishing, and imperfectly). A complete answer names the duplicate sources on both sides plus one backstop that covers both.
  2. Enumerate the sources: duplicate publishes come from multiple scheduler instances, from replay after a scheduler restart, and from the bus's own at-least-once semantics. Duplicate executions come from a worker crashing mid-processing and the message being reclaimed by another consumer. The two need different treatment.
  3. State the core conclusion: do not reach for a distributed lock, use a uniqueness constraint in the data layer. A lease only gives you probable mutual exclusion — in the instant when the TTL expires while the previous holder is merely stuck in GC, both schedulers believe they hold it and both publish. A uniqueness constraint is evaluated at the final insert, so no matter how many times upstream published, the table gains exactly one row. Do not escalate a problem solvable by a constraint into a distributed coordination problem.
  4. Then the key construction, which is where people fail: the key must be the task id plus the scheduled minute, never the current instant. Two scheduler clocks never align to the millisecond; one wakes at 09:00:00.120 and the other at 09:00:00.480, so keys built from now differ and dedup collapses. Truncate seconds and milliseconds and every instance computes the same string for that minute. In code this is an insert with on conflict do nothing; a conflict means the execution already exists, so ack the message and skip.
  5. Scope it honestly: this guarantees one execution per trigger point, not that side effects inside the execution happen once. If the run sends an SMS or charges a card, those side effects need their own idempotency keys, because the worker can crash after sending and before writing status. Making that distinction earns points.
  6. Expect: what about missed triggers? Prefer over-publishing to under-publishing — replay the last N minutes at startup and let the idempotency key absorb duplicates. At-least-once plus idempotency is the easiest combination in distributed systems; chasing exactly-once first and adding idempotency later usually achieves neither.

  分析过程 · 先想清楚再作答

  1. 题眼在「投递」和「执行」是两件事。很多人只答一半：要么只说消费组保证一条消息一个消费者（那只挡住了执行侧的重复），要么只说加锁（那只挡住了投递侧，还挡不干净）。完整答案要说清两侧各自的重复来源，以及一个能同时兜住的兜底。
  2. 先拆重复的来源：投递侧的重复来自多个调度器实例、调度器重启后的补发重放、以及消息总线本身的至少一次语义；执行侧的重复来自 Worker 处理到一半崩溃后消息被 XAUTOCLAIM 转交给别人。这两类重复用不同手段挡效率完全不同。
  3. 再给核心结论：不要用分布式锁去做互斥，用数据层的唯一约束做去重。原因是锁只能提供「大概率互斥」——租约到期而前任进程其实只是 GC 卡住的那一瞬间，两个调度器都会认为自己持有，各发一次；而唯一约束是在最终落库那一步判断的，无论上游发了几次，任务表里只会多一行。能在唯一约束上解决的问题，不要升级成分布式协调问题。
  4. 然后回答幂等键怎么构造，这是最容易翻车的一步：键必须是「任务 id 加计划触发的那一分钟」，绝不能用当前时刻。两个调度器实例的时钟不可能对齐到毫秒，一个在 09:00:00.120 醒来、另一个在 09:00:00.480 醒来，用 now 算出来的键不一样，去重完全失效。把秒和毫秒截掉之后，无论谁在这一分钟里的哪一刻醒来，算出的键都是同一个字符串。落到代码上就是 insert 加 on conflict do nothing，冲突说明已经有人建过这次执行，直接 ack 掉不执行。
  5. 补一句作用范围：这套只保证「同一个触发点只产生一次执行」，不保证「执行内部的副作用只发生一次」。如果这次执行要发短信、要扣款，那些副作用还得各自带自己的幂等键，因为 Worker 可能在发完短信之后、写完状态之前崩掉。这一层区分是加分项。
  6. 可以预期的追问：那漏发怎么办？答宁可多发不可少发——调度器启动时回看最近 N 分钟逐分钟重放，重复投递被幂等键吃掉。at-least-once 加幂等是分布式系统里最省心的一组搭配，反过来先追求 exactly-once 再补幂等，通常两头都做不好。

  Key points

  • Duplicate publishing and duplicate execution are separate: the former comes from multiple schedulers, restart replay and at-least-once delivery; the latter from a crashed worker's message being reclaimed
  • Dedupe with a database uniqueness constraint rather than a distributed lock: when a lease expires while the holder is only GC-stalled, both schedulers publish, whereas the constraint admits exactly one row
  • Build the key from the task id plus the scheduled minute, never the current instant — instances never wake at the same millisecond, so a now-based key defeats dedup entirely
  • In code this is an insert with on conflict do nothing; on conflict, ack the message and skip execution
  • This guarantees one execution per trigger, not once-only side effects — SMS or payments inside the run need their own keys; prefer over-publishing and let at-least-once plus idempotency absorb it

  答题要点

  • 投递重复和执行重复是两件事：前者来自多调度器实例、重启重放和总线的至少一次语义，后者来自 Worker 崩溃后消息被转交
  • 用数据层唯一约束去重，不要用分布式锁互斥：租约过期而前任还活着的瞬间两个调度器都会各发一次，而唯一约束在落库那一步只放行一条
  • 幂等键必须是任务 id 加计划触发的那一分钟，不能用当前时刻——两个实例的醒来时刻永远不同，用 now 会让去重完全失效
  • 落到代码上是 insert 加 on conflict do nothing，冲突就直接 ack 不执行
  • 这只保证一个触发点一次执行，执行内部的发短信、扣款等副作用要各自带幂等键；宁可多发不可少发，靠 at-least-once 加幂等兜底

D20 Scheduled Jobs and Proactive Outreach: Time Zones, Quiet Hours, Daily Caps, a Notification Provider Abstraction

• Building a scheduled push service for users worldwide, what timezone pitfalls would you hit, and how do you handle the DST switchover day?做一个面向全球用户的定时推送服务，时区上你会踩到哪些坑？夏令时切换那天怎么处理？

  Common in ChinaCommon overseasDeep dive#timezone#scheduling#correctness

  How to reason about it · think before answering

  1. All the signal in this question lives in the DST half. Store UTC, render local is the passing grade; giving a verifiable ruling for the switchover day is what separates knowing the pitfall from having fixed it.
  2. Nail the two basics first: always store UTC (an absolute instant) and convert to the user's zone before any judgement (a wall-clock time). The self-check is one sentence — can this column plus the user's stored timezone uniquely reconstruct the absolute instant? A local time string cannot.
  3. The second pitfall is the timezone field itself: store the IANA identifier (Asia/Shanghai), never a UTC offset. Offsets shift twice a year under DST; the identifier is the rule and the offset is only what that rule evaluated to on one particular day, so it is stale the moment you persist it.
  4. The third is the two anomalies on switchover day: spring-forward makes some local time simply not exist (02:30 on 2026-03-08 in New York), and fall-back makes some local time occur twice (01:30 on 2026-11-01). If your schedule point lands in either window, send at 8am local has no unique answer. State the ruling explicitly rather than leaving it to whatever the library picks: shift a nonexistent time forward past the transition (02:30 becomes 03:30), and take the first occurrence when it happens twice — which is exactly what java.time's ZonedDateTime.of does, so you can assert on it in tests.
  5. The fourth is the one people miss: when a user travels across zones, which timezone counts. Answer: the explicit field on the user profile, never silent drift from device reports; a device report should only prompt the user to confirm a change. Go one level deeper if you can — when the zone jumps more than three hours within 24 hours, treat that day's quiet hours as the union of the old and new zones and stay silent if either is quiet. Being conservative costs a few hours of delay; being aggressive costs a 3am buzz.
  6. Expect: why are these bugs so hard to catch? Because your laptop, CI and production are often all in one zone, frequently UTC, so forgot to convert stays green everywhere. Give the fix: pin the test users to three distinct zones, none equal to the server's, and every server-timezone dependency turns red immediately.

  分析过程 · 先想清楚再作答

  1. 这题的区分度全在夏令时那半句。只答「存 UTC、展示转本地」是及格线，能不能给出夏令时那天的**可验证裁定**决定了你是「知道有坑」还是「填过坑」。
  2. 先把基础两条说死：时间一律存 UTC（存的是绝对时刻），判断前先转成用户本地时区（判断的是墙上时间）。判据是一句可自查的话——只靠这一列加上用户档案里的时区，能不能唯一还原出那个绝对时刻。存本地时间字符串答不上来。
  3. 第二个坑是时区字段本身：必须存 IANA 标识（Asia/Shanghai）而不是 UTC 偏移量。偏移量一年会随夏令时变两次，标识是规则、偏移量只是规则在某一天算出来的结果，存结果的那一刻它就过期了。
  4. 第三个坑是夏令时那天的两种反常：春季前跳会让某个本地时间**根本不存在**（纽约 2026-03-08 的 02:30），秋季回拨会让某个本地时间**出现两次**（2026-11-01 的 01:30）。只要你的调度点落在这两个窗口里，「每天早上 8 点发」就解释不出唯一答案。裁定要显式给出而不是交给库随便选：不存在就顺延到过渡之后（02:30 变 03:30），出现两次就取第一次——这也正是 java.time 的 ZonedDateTime.of 的默认行为，可以直接写成断言测试。
  5. 第四个坑最容易被漏：用户跨时区旅行时，他的时区以哪一次为准。答案是以用户档案里那个显式字段为准、绝不跟着设备静默漂移；设备上报只用来询问是否切换。更细一层可以补：时区在 24 小时内跳变超过 3 小时时，当天的安静时段按新旧两个时区的并集处理，任何一边在安静就不发——保守的代价是晚几小时收到，激进的代价是在人家凌晨三点响一声。
  6. 可以预期的追问：这种 bug 为什么很难被测出来？因为本机、CI、生产常常都在同一个时区甚至都在 UTC，「忘了转时区」在所有测试里都是绿的。给出判据：把测试用户的时区故意设成三个互不相同、且都不等于服务器时区的值，任何依赖服务器时区的判断当场变红。

  Key points

  • Store UTC everywhere, convert to the user's zone before judging; the check is whether column plus zone reconstructs the instant
  • Persist IANA identifiers, not UTC offsets — offsets change twice a year and are stale on write
  • Two DST anomalies: a local time that does not exist (spring forward) and one that occurs twice (fall back)
  • Make the ruling explicit and assertable: shift nonexistent times past the transition, take the first of a duplicated pair (matching java.time)
  • For travellers, trust the explicit profile field, not device drift; on jumps over three hours, treat quiet hours as the union of both zones
  • Pin test users to three zones different from the server's, or the missing conversion stays green in every test

  答题要点

  • 存储一律 UTC，判断前转用户本地时区；自查判据是这一列加时区能否唯一还原绝对时刻
  • 时区存 IANA 标识而不是 UTC 偏移量——偏移量随夏令时一年变两次，存下来就过期
  • 夏令时两种反常：本地时间不存在（春季前跳）、本地时间出现两次（秋季回拨）
  • 裁定要显式且可断言：不存在就顺延到过渡之后，出现两次取第一次（与 java.time 默认一致）
  • 跨时区旅行以用户档案里的显式字段为准，不跟设备漂；跳变超过 3 小时时按新旧时区的并集判安静
  • 测试里把用户时区设成三个不同于服务器的值，否则「忘了转时区」在所有测试里都是绿的