Leaderboard & Counting Service  ·  View 15 of 21  ·  Runtime

Read Paths by Query Type

Five paths, one authorisation model, and one difference that matters.

Editable source SVG draw.io All views
Authorise Resolve version Fetch Adjust Answer Top-N (70% of reads) Tenant + board scope Pinned session version Cache snapshot p99 ≤ 40 ms Resolve display names List + as-of My rank (30% of reads) Member token = subject Last-write version Histogram percentile p99 ≤ 120 ms Own-write overlay ≤ 1 s Rank band + value Neighbourhood Same as my rank Same version Ranked-store slice Exclude opted-out ±k members Closed standing Reward service identity Season id, not version Immutable snapshot Spanner Attach corrections Final rank, sealed Degraded path Unchanged Previous version Cache miss to ranked store p99 ≤ 150 ms Percentile instead of rank Answer says it degraded Leaderboard & Counting Service — Read Paths by Query Type Security / platform Application we own Data store Interface / broker Risk / gap Five paths, one authorisation model, and one difference that matters: only the member's own rank gets freshness spent on it. A closed standing is read by season, never by projection version. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • Only the member's own rank gets freshness spent on it. Top-N, the neighbourhood and the closed standing are all read at a pinned version with no overlay.
  • Rank outside the materialised head is answered from a value histogram, which makes it constant-time and approximate. An exact rank for a member at position 41,208 of 10 million is a count-less-than query nobody is willing to pay for at 120,000 reads a second.
  • A closed standing is read by season id, never by projection version, which is what makes it immune to a projection rebuild.

The degraded path is a product decision

  • When the budget cannot be met, the platform answers with a percentile instead of a rank and says so in the response. The alternative — exceeding the latency budget to be exact — fails the screen.
  • Opted-out members are excluded in the neighbourhood path, so a privacy choice does not depend on the caller remembering to filter.

Risks

  • A percentile where a member expected a number is a product regression even when it is architecturally correct. The degradation needs a designed presentation, not just a flag.
  • Histogram bucket width sets the accuracy of every non-head rank in the system and is a single global tuning parameter it would be easy to set once and forget.
◀  Aggregation Pipeline All views Deployment Architecture  ▶
Solution Architecture v1.0 · Google Cloud · Platform Architecture · 2026-1015-read-paths-by-query