Global multi-region platform: validate and carry forward

1. What does RPO 60 seconds allow, and how is the loss bound computed?
2. What must precede writer promotion, in order?
3. What limits a 60 RPS workload besides app replicas?
4. Why does the EU hostname, not the user's location, keep A/B content in the EU, and what does a 20-second DNS TTL buy?
5. The usage record for attempt 2 arrives twice, then a third record changes its cost. What does the ledger do?

60-second card: bind each tenant to its residency hostname; keep authority and tombstones on a 2-of-3 EU quorum; promote after lease expiry, epoch 8 installed and epoch 7 refused; fail closed without quorum; bound loss as last renewal + lease − watermark; measure end-to-end RTO; reserve allowed-region tokens and slots; hold ambiguous operations; count every attempt per successful workflow; fail back with one lease move.

Exit gates for this stage:

1. Explain, in two minutes without notes, why a healthy US endpoint is ineligible for Tenant A and why 1 of 3 EU voters blocks promotion.
2. Draw the after-architecture: residency hostnames, the US-home sibling, the EU authority quorum with its witness, async EU replication, the promotion gate and the fail-closed branch.
3. Defend two alternatives with this stage's numbers: residency hostnames against an anycast load balancer with EU-only edges (16.2), and partial warm capacity against a full-peak reserve under the 2 million tokens/minute quota (17.2).
4. Diagnose a failed promotion from an observable signal (an accepted epoch 7 probe, a loss bound over 60 seconds, or an approval generation mismatch) and name the mitigation.
5. Build and debug the 17.1 slice (build depth): run labs/test_regions.py, then add a test that asserts your 700,000-success prediction with unit_cost. Add Ledger.adjust, which appends a late-invoice adjustment against an existing attempt without changing its record and raises for an unknown attempt. Test that +500 micro-USD on attempt 2 keeps the original record and raises the total by 500. Explain each ledger result.

Read the architecture snapshot, decisions and ADR-013. Local content verification and learner completion are separate. ADR-013 amends ADR-011 with authority placement, endpoint residency and fencing order; ADR-011's text is otherwise unchanged. T18.13 inherits these regional cells, the EU authority quorum, model lineage, recovery gates, and explicit deployment gaps to define shared platform contracts and migration.

Review after about one, seven, and 21 days. Stop when the five gates pass. These learner gates remain unassessed. Production integrations and deployment controls described here are proposals unless the validation report explicitly records an executed check.

• An RPO of 60 seconds allows up to 60 seconds of acknowledged writes to be lost. The bound is last renewal plus the 20-second lease minus the watermark, frozen at isolation, because a partitioned primary can acknowledge until its lease expires.
• Promotion order is lease expiry plus drift margin, a new quorum lease, the new epoch installed with every store refusing the old one, and EU-primary's stores quarantined. Then come allowed destination, current policy, approval generation, audit, artefacts and capacity.
• A 60 RPS workload is limited by token and request quotas, active slots, database and search, network and model readiness, not by app replicas alone.
• The usage ledger counts a twice-delivered attempt once and rejects a record that changes an existing attempt's cost as conflicting evidence for investigation.