URL Shortener & Link Management Service  ·  View 14 of 23  ·  Runtime

Critical Flow — One Click, Resolved

Eighteen messages, of which the first four are what 97% of clicks actually experience.

Editable source SVG draw.io All views
Clicker Front Door PoP Regional resolver Deny-set Hot set (Redis) Link table Click stream 1. GET go.acme.com/spring 2. TLS for branded host, WAF, bot tag 3. cache lookup: host + code 4. cached 302 (97% of clicks end here) 5. miss: forward to nearest region 6. bounded parse of the code shape 7. is this code revoked or blocked? 8. not present 9. coalesce concurrent misses on this code 10. GET link:go.acme.com:spring 11. miss (3% of misses) 12. point read, in-region replica 13. destination, state, rules 14. populate, TTL 24h 15. evaluate rules, merge parameters 16. 302 + Cache-Control: max-age=30 17. 302 to destination 18. access log row — after the response left Critical Flow — One Click, Resolved Nothing in this flow writes to the link table, and the click event is emitted by the edge log rather than by the resolver — which is why a cached redirect is still a counted click. v 1.0 · owner Platform Architecture · date 2026-09

The two things to notice

  • The flow returns at message 4 for most clicks — the cached 302 at the PoP — and everything after it is the minority path.
  • The click event is emitted by the edge access log, not by the resolver. That is the single design choice that lets a redirect be cached for 30 seconds without losing a click (ADR-10, ADR-11).

Latency budget

  • Cached: p50 ≤ 8 ms, p99 ≤ 20 ms. Resolver hit on L1/L2: p99 ≤ 40 ms. Cold to Cosmos: p99 ≤ 120 ms.
  • Coalescing bounds the origin read rate per code per instance to one in flight, which is what makes a viral cold link a latency event rather than a throughput event.
  • Hot-set entries carry a 24 h TTL; the edge response carries 30 s. Two TTLs, two different jobs.

What cannot happen here

  • No write to the link table, no synchronous call to the management plane, and no dependency on the click pipeline being healthy.
  • No credential is held by the resolver, so this flow cannot be turned into a write by any input it receives.