Flash Sale Order Intake

A retailer runs a two-hour flash sale that drives roughly forty times normal checkout traffic. The fulfilment database behind checkout is relational and can absorb only a steady, modest rate of writes; it must never be the reason a customer's order is rejected, so the checkout endpoint has to accept an order and return success even while fulfilment is behind. Orders must survive a fulfilment outage without being lost, and the orders belonging to one customer must be processed in the sequence they were accepted. Once an order is committed, the customer is sent an email confirmation. Checkout is an ordinary HTTPS request from the storefront and the team does not want to run or scale servers for the spike.