Design a content delivery network that serves static web assets — images, CSS, JavaScript bundles, fonts, and short video segments — from locations close to end users. The core job is to absorb the vast majority of requests at the edge so the origin stays quiet and users see fast, consistent load times worldwide (think the asset layer behind a busy media or e-commerce site).

Operating context. You run a fleet of edge Points of Presence (PoPs) across several continents backed by a small number of origin data centers. Traffic is extremely read-heavy and long-tailed: a few thousand "hot" objects account for most requests while millions of cold objects are hit rarely. Aggregate demand is roughly 500,000 requests/sec at peak across all PoPs, with a target edge cache hit ratio above 95%. Objects range from a 2 KB icon to a 20 MB video chunk. Publishers push new versions of assets throughout the day and expect a stale copy to disappear from the edge within seconds when they explicitly purge it.

Out of scope. TLS certificate issuance and rotation, the origin application that generates the assets, DDoS scrubbing and WAF rules, per-customer billing and usage metering, and dynamic (personalized, non-cacheable) API responses. Assume other teams own those.

What to produce. A high-level architecture covering: the edge PoP topology and how a user request is routed to a nearby PoP; the request flow on an edge hit versus a miss; the cache hierarchy (edge tier, a mid/regional tier, origin) and where origin shielding sits; the cache-key design and how TTL / freshness is decided; the invalidation and purge path (both TTL expiry and explicit purge); and how you keep the origin protected during a cold-cache stampede. Sketch the major components and the request/response flow between them; we will probe specifics during checkpoints.