A simple browser–application–database design can meet the scenario. During a database failure, the application must avoid false confirmations; a manual intake log is reconciled by ID after recovery. Complexity is justified by requirements, not by the number of boxes in a diagram.

Critical check: The design has a persistent data path, truthful failure behavior and a controlled source of truth during migration.

Final project: Deliver the architecture, responsibility matrix, packaging decision, failure playbook and migration plan. Explain what changes if weekly visitors grow tenfold and which assumptions must be measured first.