Section 13: The Copy Is the Product - Final Summary & Candidate Scorecard

Executive Summary: This closing section compresses twelve sections into the artifacts you can rehearse: a sixty-second recap built on one inversion and three clocks; the decisions ledger, D1 through D12, each with its rejected alternative and flip trigger; the three traps from the module's opening and the arithmetic that closes each; a scorecard for mid-level, Senior and Staff performances on this exact question; the variants interviewers reach for next; and how to practice. Nothing here is new — it is the design you already built, folded small enough to carry into the room.

The interviewer's last request is "Summarize it for me," and it is scored: a design you cannot compress is a design you do not own. Everything below is that compression.

The Sixty-Second Recap

The whole design is one refusal: the prompt serves five million requests a second against a vendor API that handles one hundred and fifty, a gap of 33,000×, and nothing in this system pretends otherwise. The inversion: SentinelDB is a data source to mirror, never a request-path dependency — every decision is made in-process at the edge, from a compiled deny set, in about two microseconds, with zero network calls (D1). The split: country blocking — the China case the prompt itself offers — runs on a local GeoIP database and a policy engine; the vendor backs only the bad-IP list, so the legal class never touches the 150-rps ceiling at all (D2). The budget: one crawl scheduler owns the entire vendor allowance, spending 120 requests per second — about 10 million checks a day — by priority, traffic rank times staleness, validating the IPs traffic actually presents instead of scanning an address space that would take 331 days per pass (D3, D7). The honesty: freshness is promised per class, never as one number — country rules in ≤ 15 minutes, overrides in ≤ 60 seconds, brand-new IPs in ≤ 1 hour at p95, re-validated listings in 24–48 hours — the fail-open exposure window is measured and counted rather than hidden, and GeoIP's roughly 99% country-level accuracy is stated as 99%, never rounded up to a guarantee (D4, D8).

The design runs on three clocks. Microseconds to decide: the edge filter answers allow or deny in ≤ 2 µs from an in-process snapshot. Minutes to propagate: a compiled, gated, canaried snapshot reaches all 30 PoPs within 60 seconds, and a legal rule goes from commit to global enforcement inside 15 minutes. Hours to days to re-validate: the scheduler's 120 rps gives first looks within an hour and re-walks the mirror every day or two.

And the story, in two sentences. At 09:14, never-seen 203.0.113.42 hits the Frankfurt PoP and is served in about two microseconds while being quietly queued; at 09:16 the scheduler spends one of its 120 requests on it, SentinelDB says listed, and by 09:17 the delta has reached all thirty PoPs. From then on the IP is denied in two microseconds everywhere — roughly three minutes of fail-open exposure, counted, by design.

Quick check before moving on: