Programmable Messaging API · View 17 of 22 · Operations
Decisions
- Route leases are regional, never shared: a carrier window enforced across a cross-region hop would put consensus latency inside the interactive budget.
- The session plane has its own allowlisted egress range per region, so failover means a second set of addresses the carrier has already approved — a contractual task, not a technical one.
- Residency-pinned tenants deliberately have no cross-region failover; they degrade in place.
Assumptions
- RTO 5 min in-region for submit and attempt execution; RTO 20 min to serve from the second region for non-resident tenants.
- The ledger is one multi-region Spanner instance, so registration-class writes pay quorum latency and reads stay local.
Risks
- Standby binds that are never exercised are not standby; the failover claim is only as good as the last rehearsal.
- Carrier egress allowlists are changed by email, on their timetable — the slowest dependency in any regional expansion.
