ADR-011: Residency-aware regional cells
- Source
- From the Staff AI System Design course
- By
- Sourav Banerjee
- Last updated
- 8 Nov 2026
Status: accepted educational architecture, not production approval. Module: T18.12. Date: 2026-11-02. Supersedes: none; prior runtime invariants remain in force. Amended by: ADR-013 for authority placement and writer fencing.
Situation
Read T18.12 and its labelled workload assumptions. The prior accepted architecture is v0.10-stage-10. The existing supplier workflow must carry its access, operation, budget, and release guarantees into this change.
Options Considered
| Option | Benefit | Cost/risk | Decision |
|---|---|---|---|
| Backup only | Lower live cost | Restore and capacity acquisition delay | Insufficient assumed recovery target |
| Home cell and warm eligible secondary | Simple writer ownership, regional locality | Idle reserve and async loss window | Choose |
| Global multi-writer | Local writes in many locations | Conflicts, global quotas, policy freshness and residency | Reject without requirement |
| Synchronous cross-region authority | Stronger acknowledged-state durability | Latency and partition availability cost | Separate future decision |
Decision
Choose tenant home cells and a warm same-geography recovery target, with one writer per tenant. Retain all runtime and T18.11 lineage controls. Add trusted tenant placement, EU-primary and EU-secondary for A/B, US-home for C, data-class replication, regional private/provider profiles, recovery eligibility and usage reconciliation. Fence the previous writer before promotion; current policy, audit, ready approved artefacts and capacity remain mandatory. Async result copies may lose acknowledged operation evidence within the stated RPO; hold the uncertain interval rather than blindly redispatch.
Guarantees and Non-Guarantees
A deterministic plan checks allowed geography, fencing evidence, current policy, audit, artefact readiness and copy lag. A separate ledger deduplicates final aggregate usage evidence, rejects conflicts, and includes failed spend. These checks do not fence a real writer, enforce residency on a provider, replicate data, run DNS/private networking, or establish measured RPO/RTO. The planning assumptions are 60-second RPO and 600-second RTO, with a 360-second illustrative recovery budget.
Consequences and Operational Checks
See failure experiments and metrics. Preserve previous approved serving until every new eligibility gate passes. Retain protected lineage/operation evidence during rollback; never roll back current permissions, tombstones, or unknown external effects.
Revisit Trigger
A zero-loss requirement, measured recovery target failure, different allowed geography, unavailable reserved provider/GPU capacity, or justified global concurrent writes requires a new decision.
Key Takeaways
- Each tenant gets a home cell and a warm same-geography recovery target, with one writer per tenant. Tenants A and B sit in EU-primary with EU-secondary for recovery, and Tenant C sits in US-home.
- Global multi-writer is rejected without a requirement because of conflicts, global quotas, policy freshness and residency. Backup only cannot meet the assumed recovery target, and synchronous cross-region authority is left to a separate decision for its latency and partition cost.
- Asynchronous copies may lose acknowledged operation evidence within the 60-second planning RPO, so the uncertain interval is held, not redispatched. A zero-loss requirement, a failed recovery target or justified global concurrent writes reopens it.