Section 10: Six Ways to Break an IP Filter - Interviewer Deep-Dive Challenges

Executive Summary: The deep dives are done, and now the interviewer attacks. Six escalations, each aimed at a promise an earlier section made: independence from the vendor, the legal guarantee, safe updates, the boot path, the IPv6 keyspace, and the architecture's reason to exist. Each gets the same treatment: what they're really asking, the answer with its mechanism and number, and the senior line — the sentence that shows you know where physics ends and policy begins.

The interviewer leans back. "Fine. Let's break it." Each question probes whether a promise is enforced by the system or by hope. A Senior candidate defends everything; a Staff candidate concedes the parts physics owns, keeps the parts the design owns, and says which is which.

Challenge 1: "SentinelDB goes dark for 24 hours."

What they're really asking: Did D1 actually remove the request-path dependency, or does the vendor's availability still leak into yours?

You: "Zero requests are affected — not degraded, unaffected. Every decision is made in-process from the mirrored deny set; no request has ever waited on SentinelDB, so no request notices it's gone." What does happen is that the mirror ages. Re-validation pauses, the coverage metric (≥ 95% of volume with verdicts fresher than 7 days) decays by roughly one freshness class, and the alarm at 2× normal re-validation lag fires so Priya knows before legal asks. The first-look queue backs up too, so the exposure window for genuinely new bad IPs grows — and is measured: exposure (traffic served between first-seen and deny-propagated) is already a per-day metric from Section 9. On recovery, the 120 req/s drains the backlog oldest-first, while everything already in the mirror — 8M verdicts, every country rule, every override — enforces at full strength throughout.

The senior line: "The vendor's availability bounds our freshness, never our availability. That trade was the whole point of D1."

Quick check before moving on: