Section 7: Two Microseconds at the Door - Deep Dive: The Microsecond Decision

Executive Summary: This section opens the box Section 6 drew at the edge: the in-process lookup that answers allow/deny five million times a second without ever touching a network (D1). The mechanism is almost embarrassingly small — normalize every address into one 128-bit keyspace, binary-search the family's sorted array of disjoint deny ranges, read the verdict and its rule source off the matching entry — and that smallness is the point: the compiler already merged overrides, country rules, and vendor listings into one final deny array with precedence resolved, so the hot path carries no policy logic at all. Along the way we defend ranges against hash sets and bloom filters (D6), name the LPM trie and when it wins, state the /64 truth about IPv6, and prove the 2 µs claim with cache arithmetic instead of adjectives.

The interviewer taps the edge plane. "Five million times a second, you claim an answer in two microseconds with zero network calls. Open the box. Convince me."

One Keyspace, One Array

You: "The first move is normalization. IPv4 and IPv6 look like two problems; they're one. Every incoming address becomes a 128-bit unsigned integer — IPv4 maps into the v4-mapped v6 block (::ffff:0:0/96), so 203.0.113.42 and a native v6 address live on the same number line. One semantic keyspace: one comparison rule, one code path to test."

Against that keyspace sits the deny set — semantically one set, physically two family-split sorted arrays of (start, end, rule_source) entries, because storing 128-bit pairs for everything would pay IPv6's width on every IPv4 entry. The v4 array keeps 4-byte keys, about 12 bytes an entry with the tag; the v6 array holds ranges at /64 granularity, so 8-byte keys suffice — about 20 bytes an entry. Both arrays share the critical property: disjointness — guaranteed at compile time, never checked at lookup time. The compiler from Section 5 merges adjacent and overlapping ranges when it builds the snapshot, so the edge normalizes the address, picks the family's array, and runs a plain binary search: find the range whose start is the largest value ≤ the key, check whether the key falls inside it, done. No backtracking, no "which of three overlapping matches wins" logic. One search, a verdict, and the rule source that produced it.

The structure is immutable once loaded. Lookups touch no locks, allocate nothing, and read the current snapshot through a single atomic pointer — a new snapshot is built off to the side and swapped in with one pointer store, exactly the way a feature-flag SDK swaps config snapshots under live traffic. If everything upstream dies, the pointer still points at the last good array: fail-static for free.

Quick check before moving on: