Evacuating the region: who can actually leave, and what it costs

Reconstructs regional evacuation from GitLab's public DR blueprints, runbooks and gameday timing ledger, Meta's Maelstrom and Taiji papers, Netflix's active-active record, Datadog's failover-safety work, and the postmortems of GitHub 2018, Cloudflare 2023, Roblox 2021, Datadog 2023 and AWS 2025. After reading, an architect can name their organisation's posture (rebuilder, failover-ready, traffic shifter), price the move to the next posture, and audit the two components whose absence silently makes any system a rebuilder: a steering layer outside the region and an ops plane that shares no fate with it.

What you get out of it

• The public record splits organisations into rebuilders (days), failover-ready (the disaster zone), and traffic shifters (minutes); the time to evacuate is a property of the posture, not the incident.
• Automated failover belongs inside the boundary you drill at that cadence; GitHub 2018's remediation was to stop Orchestrator promoting across regions, while Meta automates drains precisely because the same code path runs weekly as a test.
• An async replica is not a failover target during the failures that matter: the same fault that kills the primary inflates the lag that disqualifies the candidates (Datadog's stuck gameday), and fixing it cost a measured 46% in write latency.
• Regions partition the request path, not the change path or the control plane: Datadog's one update hit five regions on three clouds in an hour, and AWS's us-east-1 event stalled nominally regional recoveries worldwide.
• No postmortem in this corpus describes a deliberate regional evacuation that ran and failed; the record cannot prove your evacuation works, only your own production drill can.

Scope

Why this, now. The October 2025 us-east-1 cascade and Cloudflare's 2023 control-plane outage restarted the multi-region argument in most design reviews, while GitLab's gameday ledger and Datadog's 2026 failover-safety post have quietly published the real numbers both sides of that argument need.

What it does not cover. Multi-writer database internals (Spanner/CockroachDB get a price tag, not a chapter), DNS and anycast mechanics, compliance-driven DR paperwork, and restore-from-corruption, which is a backup problem covered by an earlier guide.