Section 9: Four Clocks and a Tripwire - Deep Dive: Freshness, Enforcement & Safe Updates

Executive Summary: Section 2's freshness table was a promise; this section is the machinery that keeps it. Each number is a mechanism: country rules make ≤ 15 min because compile-canary-push is entirely local, scoped overrides make ≤ 60 s by skipping the bake, mirrored vendor entries ride the re-validation cadence to ≤ 24–48 h, and brand-new IPs clear the first-look queue in ≤ 1 h p95 (D8). We walk 203.0.113.42's three-minute exposure window and defend it as a counted cost (D4), then make every snapshot a deployment — delta-cap gate, compiled-in never-block allowlist, 10-minute canary, sub-60-second version pin (D10) — replay the 0.0.0.0/0 drill through those gates, and close with the appeals path (D11) and the false-positive asymmetry that explains why this system fails open at all.

The interviewer taps Section 2's freshness table. "Nice numbers. Where does each one actually come from — and what happens on the day the list itself is wrong?" Two questions, one section. The first is about clocks; the second is about the tripwire that decides whether any clock still matters.

Four Clocks, Four Mechanisms

A freshness promise is only as honest as the mechanism behind it, so you reread the table with the machinery showing (D8):

Country/legal — ≤ 15 min. No vendor in this path: a policy commit joins country_rules against the pinned GeoIP dataset, the compiler emits a snapshot, it bakes 10 minutes on the canary PoP, and distribution takes ≤ 60 s. The 14:00 CN rule was global at 14:14 — ten of those fourteen minutes were the canary, deliberately spent. The class legal cares about is fast because D2 made it local.

Manual overrides — ≤ 60 s. An override skips the 10-minute bake and goes straight through the distribution plane — but only when scoped to a handful of ranges. The exemption is earned by blast radius, not by who clicked: a trust-and-safety analyst unblocking one /32 is an audited human action whose worst case is one wrong range. A mass override — hundreds of ranges, a whole ASN — is a snapshot like any other and takes the full canary path. State it precisely: "humans bypass the gates" is a finding; "small, audited diffs bypass the bake" is a design.

Vendor list, already mirrored — ≤ 24–48 h. This is Section 8's re-validation cadence: ~40% of the 120 req/s budget sweeps the 8M-verdict mirror oldest-first, about every two days, with high-traffic entries revisited daily — hence 24 h for the hot set, 48 h worst case. The number is nothing but arithmetic; a check-only API bounds how fast we can re-ask.

Vendor list, brand-new IP — ≤ 1 h p95. The first-look queue: ~6M newly seen IPs a day against the budget's ~60% first-look share, prioritized by traffic rank × staleness. The attacker ramping up traffic is exactly the one the priority function surfaces first.

Quick check before moving on: