Tier 1, the read path, must not fail: multi-AZ, three index replicas, and a read cache that keeps hot profiles answerable through an index outage.
Tier 2, write and ingest, may lag but must not lose: the change log is the durable buffer and the payload archive is the deep replay source.
Tier 3, the projections, are disposable by design. Losing the graph costs a four-hour rebuild, not a restore.
Recovery objectives
RTO 30 min, RPO 5 min for the aspect store; PITR to any point in 35 days.
Projection rebuild under 4 hours from the change log, longer if it must replay from the archive.
DR rehearsal twice a year, including a full projection rebuild — the recovery path most likely to have rotted.
Accepted risks
Adoption, not infrastructure, is the largest risk. A catalog nobody trusts is replaced by spreadsheets, which is why coverage and certification are operational metrics in view 18.
Source rate limits can push harvest freshness past its target for large estates; the mitigation is prioritised scheduling for certified assets, and it is a stated limitation, not a solved problem.
