Reserve regional capacity for failover without paying for an idle mirror

• Define which journeys survive a region loss, degraded throughput, recovery duration, and provider scaling lead time. Classify workloads by evictability and stateful capacity by expansion speed.

• Model N-minus-one at actual peak plus replication, backlog, and failover overhead. Include quota, IP, database connections, caches, licenses, and downstream capacity, not just compute.

• Critical traffic has a protected floor, reclaimable capacity can be freed within RTO, stateful tiers are pre-sized, and exercises prove the model. Normal utilization should remain economical.

• Maintain per-region critical reservations, a pool of preemptible batch and development work, autoscaling headroom, preapproved quotas, and evacuation policy that reclaims in priority order. Use traffic cells to ramp failover.

• Capacity telemetry feeds a scenario model and reservation controller. Eviction notices checkpoint suitable jobs; global routing increases traffic only after regional saturation and dependency gates pass.

• Eviction and rescheduling use operation identities so batch work does not duplicate effects. Stateful promotion follows the data authority and fencing protocol, independent of compute availability.

• Plan for failover during peak, provider control-plane impairment, and a second localized failure. Keep manual admission and emergency quotas outside the affected region.

• Standby identities, keys, allowlists, and policy must already exist and be tested. Reclaim mechanisms cannot let low-priority tenants influence critical traffic priority.

• Track protected, borrowed, and actually reclaimable capacity; reclaim time, quota headroom, N-minus-one margin, cold-start duration, and exercise performance.

• Use commitments for stable critical floors and interruptible economics for reclaimable work. Price the residual nonreclaimable reserve against outage risk and contract value.

• Idle reserve is simple and expensive; reclaimable work improves utilization but adds checkpoint and evacuation risk. Count capacity as standby only if it can be freed within the measured objective.

• Tag workloads and measure reclaim time, then move safe batch into the reserve, preapprove quotas, and run progressive evacuations. Revise the model after every demand or architecture change.

• Principal candidates know that capacity is a timed operational capability. They include stateful bottlenecks, quotas, reclaim proof, degraded product policy, and correlated-failure margin.

Interviewer evaluation rubric