# Consumer Messaging Platform — WhatsApp-Class System

**Solution Architecture v1.0 · Platform Architecture · 2026-08 · 23 views**

A global consumer messaging platform architected around one commitment: the device, not the
server, is the system of record. Clients hold a persistent authenticated socket, the platform
accepts a message and assigns its authoritative order, fanout drives delivery per recipient
device, and the ciphertext is deleted the moment delivery is acknowledged. Message content is
encrypted end to end with the Signal protocol, so the platform routes what it cannot read.

---

## What is here

| Path | Contents |
|---|---|
| `index.html` | Deliverable register — the entry point. Facts, priority flows, requirement coverage, technology by capability, and every view in all three formats |
| `diagrams/*.html` | One self-contained page per view: the inlined diagram plus the reasoning it deliberately omits, with copy / PNG / PDF export |
| `diagrams/svg/*.svg` | The same 23 views as SVG with the diagram XML embedded — re-opens in diagrams.net fully editable |
| `diagrams/drawio/*.drawio` | draw.io native source |
| `diagrams/index.html` | The package's own contact sheet |
| `specs/views.json` | Diagram specifications — the source of truth for every view |
| `specs/manifest.json` | Page titles, subtitles and the summary cards on each view page |
| `ask.md` | The requirement this package answers |

Open `index.html` in a browser. Every link is relative, so the package works from disk with no
server.

## The architecture in one paragraph

Clients connect over the Noise protocol on TCP 443 and hold that socket open. An Erlang/OTP
gateway tier terminates millions of connections per pool; stateless Go services behind it
accept, order, fan out and acknowledge. A message is written once as ciphertext to a wide-column
store, enqueued to a durable inbox per recipient *device*, delivered down an open socket or
behind a silent push wake, and purged on acknowledgement — with a 30-day TTL as the only other
exit. Group messaging uses Sender Keys, so encryption cost is constant in group size while
transport cost stays linear in devices. Multi-device works because the inbox is keyed by device,
which makes a companion a peer rather than a relay. Media is compressed and encrypted on device
with a per-blob key that travels only inside the encrypted message, then served as opaque bytes
from a CDN. The platform runs in two active regions of three availability zones each, behind a
200-site anycast edge, with accounts pinned to a home region.

## Design targets

| | |
|---|---|
| Registered accounts | 2.5 billion |
| Messages per day | 140 billion |
| Peak accept rate | 1 million per second |
| Concurrent sockets | 60 million per regional cluster |
| Send to deliver | under 500 ms at p99, in region |
| Availability | 99.99% on the messaging path |
| Recovery | RTO 15 minutes, RPO effectively zero |
| Server retention | 30 days maximum for undelivered ciphertext |

## Rebuilding the diagrams

Every view is generated from `specs/views.json` and machine-checked for overlapping boxes,
clipped labels, dangling edges and off-page elements. Requires Node and draw.io Desktop.

```bash
bash scripts/build.sh
```

The validator runs with `--strict`: zero errors and zero warnings, or the build stops.