URL Shortener & Link Management Service  ·  View 13 of 23  ·  Data

Two Propagation Paths

One write, two channels, two published bounds — and the reason the fast one can be fast is that it carries only stop instructions.

Editable source SVG draw.io All views
Write Link write create, edit, kill Link table authoritative Fork Change classifier urgent or routine? Fast channel · ≤ 60 s Revocation topic Event Grid Deny-set builder compact delta Slow channel · ≤ 5 min Cosmos change feed ordered per partition Projection worker 12 regions Regional state Hot set Redis Deny-set replica 5 s pull Edge effect Response cache 30 s TTL bounds staleness What the clicker gets durable committed kill or block delta push upsert 410 or interstitial on miss 302 Two Propagation Paths, Two Different Promises Application we own Data store Decision point Queue / topic Security / platform External / third party synchronous failure / alternate event / async One write, two paths, two published bounds. The fast channel carries only stop instructions, which is why it can be small enough to be fast. v 1.0 · owner Platform Architecture · date 2026-09

Why two channels

  • Revocation must be effective in 60 s; an edit may take 5 minutes. Sizing one channel for the tighter deadline means paying that cost on every routine edit.
  • The fast channel carries a compact delta of codes that must stop — small enough to push to 12 regions every few seconds.
  • The slow channel carries full records off the change feed and can be replayed from any point, which is what makes the projection rebuildable.

The numbers

  • Revocation: 30 s p95, 60 s p99 globally. Deny-set pull interval 5 s. Edge response cache TTL 30 s, which bounds the worst case.
  • Edits: 5 minutes p99 globally, 10 s p99 for a newly created link, 1 s p99 in the creating region.
  • All five are stated assumptions and are the numbers most worth arguing with in the whole package.

Risks

  • Two sources of truth on the read path can disagree: a code present in the hot set and also in the deny-set must always lose. The deny-set is therefore checked first, unconditionally (view 09).
  • If the change classifier mislabels a kill as a routine edit, the platform silently misses its safety promise while every dashboard stays green. The 60 s synthetic probe in view 20 exists for exactly this.
◀  Data Model All views Critical Flow — One Click, Resolved  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records13-propagation-paths