Zone redundancy in one region rather than multi-region active-active. Cosmos multi-region write would require conflict resolution on state transitions, and a conflict on a state machine is not a merge problem, it is a correctness problem.
Hub-and-spoke with all egress through Azure Firewall on an FQDN allow-list. A worker that runs partner code is the most likely place a compromise starts, so its egress is the most tightly controlled path in the estate.
Spot node pool for workers with on-demand fallback. Workers are designed to be killed, so the design is already spot-tolerant, and this is the largest single cost lever in the platform.
Recovery targets
RTO 4 hours, RPO 5 minutes for regional loss, achieved by promoting the Cosmos read region, deploying the standby AKS cluster from IaC and replaying incomplete executions from state.
Zone loss is transparent: AKS spreads across three zones, and Service Bus Premium, Cosmos, Redis, SQL and Blob are all zone redundant. No manual action, no data loss.
99.9% API availability is the engineering target and allows roughly 43 minutes of downtime per month. It is a target, not an Azure guarantee, and it assumes the deployment practice in view 23.
Risks
Service Bus is drawn red in the DR footprint deliberately: in-flight messages do not fail over. Regional recovery replays from Cosmos, which is exactly why the queue was never allowed to be the state store.
Geo-DR pairing for Service Bus Premium would replicate entity metadata but not messages, so it was not bought. If a future requirement needs message-level continuity, the design has to change, not just the SKU.
The standby cluster is scaled to zero and exercised only in drills. A DR test that has not been run in the last quarter should be treated as a DR plan that does not work.
