Autoscaling Controller · View 16 of 37 · 3 · Data
The rule
- RPO 0 for the two stores whose loss is loss of control. Minutes of RPO for the two whose loss is loss of explanation.
- The desired-state record carries the highest read availability target in the system — 99.95% — because actuation continues from it while the decision engine is down.
Stated assumptions
- Control plane availability ≥ 99.9% monthly; desired-state read availability ≥ 99.95% monthly.
- Signal store RPO ≤ 5 min, journal RPO ≤ 60 s, both invented and both open to argument.
- 15 days raw at 10 s and 13 months at 5 min rollup is sized for a year-on-year seasonal comparison, which is the only use that needs 13 months.
What this permits
- Losing the whole signal store is a fail-static event, not an outage: no scale-in while blind, and the fleet keeps serving.
