Target is p99 under 10 ms for the decision alone. Measured budget: 0.3 ms when the pod-local lease has capacity, 6 ms when it must refill from Valkey.
Roughly 92% of decisions are served entirely from process memory. That hit rate is the single number the whole design is built around — view 24 shows how routing affinity protects it.
PostgreSQL and ClickHouse are structurally off the hot path. A decision that needed either would be two orders of magnitude over budget.
Why these components
Envoy rather than a custom edge: its ext_authz filter is a stable gRPC contract, so the default integration mode needs no application code.
Go for limiterd and llm-gateway: predictable garbage collection matters more than raw throughput when the SLO is a p99.
Valkey (Redis protocol) for coordination because server-side Lua gives multi-key atomicity in one round trip. That property is what view 12 depends on.
Deliberate omissions
The control plane is not drawn here — view 18 carries it end to end.
Failure and fallback paths are omitted so the happy path stays readable; view 23 draws them.
Only two non-chain edges are shown: the commit of actuals, and the budget refresh. Everything else follows the spine.
